ESMA published the final report on the guidelines for outsourcing to cloud service providers. The guidelines apply to competent authorities and various entities under the ESMA remit, including credit rating agencies, investment firms and credit institutions when they carry out investment services and activities, data reporting services providers, and market operators of trading venues. The guidelines apply from July 31, 2021 to all cloud outsourcing arrangements entered into, renewed, or amended on or after this date. In addition, ESMA announced recognition of Euroclear UK & Ireland Limited, a UK-established central securities depository (CSD) as a third-country CSD after Brexit transition on December 31, 2020. Yet another announcement involves registration of DTCC Data Repository (Ireland) PLC (by ESMA) as a trade repository under the European Market Infrastructure Regulation (EMIR) and the Securities Financing Transactions Regulation (SFTR), with effect from December 23, 2020.
The guidelines are intended to help firms identify, address, and monitor the risks arising from cloud outsourcing arrangements. The guidelines are also intended to support a convergent approach to the supervision of cloud outsourcing arrangements across competent authorities in EU. The report incorporates feedback received during the consultation process for these draft guidelines (during June 03, 2020 to September 01, 2020) as well as the relevant outsourcing guidelines from EBA and EIOPA. While working on these guidelines, ESMA has been also mindful of the proposal for a Digital Operational Resilience regulation, which the EC published in September 2020. The guidelines in this report focus on:
- Risk assessment and due diligence that firms should undertake with respect to the cloud service providers
- Governance, organizational, and control frameworks that firms should put in place to monitor the performance of cloud service providers
- How to exit the cloud outsourcing arrangements without undue disruption to business
- Contractual elements that a cloud outsourcing agreement should include
- Information to be notified to competent authorities
The guidelines apply from July 31, 2021 and firms should review and amend accordingly the existing cloud outsourcing arrangements with a view to ensuring that they take into account these guidelines by December 31, 2022. Where the review of cloud outsourcing arrangements of critical or important functions is not finalized December 31, 2022, firms should inform the respective competent authority about this, including the measures planned to complete the review or the possible exit strategy.
Keywords: Europe, EU, Banking, Securities, Outsourcing, Cloud Computing, DTCC, Euroclear, ESMA
The Hong Kong Monetary Authority (HKMA) revised the Supervisory Policy Manual module CG-5 that sets out guidelines on a sound remuneration system for authorized institutions.
The European Banking Authority (EBA) published the final guidelines on the monitoring of the threshold and other procedural aspects on the establishment of intermediate parent undertakings in European Union (EU), as laid down in the Capital Requirements Directive (CRD).
In a recent Market Notice, the Bank of England (BoE) confirmed that green gilts will have equivalent eligibility to existing gilts in its market operations.
The Financial Conduct Authority (FCA) published the policy statement PS21/9 on implementation of the Investment Firms Prudential Regime.
The European Banking Authority (EBA) proposed regulatory technical standards that set out criteria for identifying shadow banking entities for the purpose of reporting large exposures.
The Board of the International Organization of Securities Commissions (IOSCO) proposed a set of recommendations on the environmental, social, and governance (ESG) ratings and data providers.
The European Securities and Markets Authority (ESMA) published recommendations from the Working Group on Euro Risk-Free Rates (RFR) on the switch to risk-free rates in the interdealer market.
The European Central Bank (ECB) published a paper as well as an article in the July Macroprudential Bulletin, both of which offer insights on the assessment of the impact of Basel III finalization package on the euro area.
The International Swaps and Derivatives Association (ISDA) published a paper that explores the impact of the Fundamental Review of the Trading Book (FRTB) on the trading of carbon certificates.
The Prudential Regulation Authority (PRA) published the remuneration policy self-assessment templates and tables on strengthening accountability.