ESMA published the final report on the guidelines for outsourcing to cloud service providers. The guidelines apply to competent authorities and various entities under the ESMA remit, including credit rating agencies, investment firms and credit institutions when they carry out investment services and activities, data reporting services providers, and market operators of trading venues. The guidelines apply from July 31, 2021 to all cloud outsourcing arrangements entered into, renewed, or amended on or after this date. In addition, ESMA announced recognition of Euroclear UK & Ireland Limited, a UK-established central securities depository (CSD) as a third-country CSD after Brexit transition on December 31, 2020. Yet another announcement involves registration of DTCC Data Repository (Ireland) PLC (by ESMA) as a trade repository under the European Market Infrastructure Regulation (EMIR) and the Securities Financing Transactions Regulation (SFTR), with effect from December 23, 2020.
The guidelines are intended to help firms identify, address, and monitor the risks arising from cloud outsourcing arrangements. The guidelines are also intended to support a convergent approach to the supervision of cloud outsourcing arrangements across competent authorities in EU. The report incorporates feedback received during the consultation process for these draft guidelines (during June 03, 2020 to September 01, 2020) as well as the relevant outsourcing guidelines from EBA and EIOPA. While working on these guidelines, ESMA has been also mindful of the proposal for a Digital Operational Resilience regulation, which the EC published in September 2020. The guidelines in this report focus on:
- Risk assessment and due diligence that firms should undertake with respect to the cloud service providers
- Governance, organizational, and control frameworks that firms should put in place to monitor the performance of cloud service providers
- How to exit the cloud outsourcing arrangements without undue disruption to business
- Contractual elements that a cloud outsourcing agreement should include
- Information to be notified to competent authorities
The guidelines apply from July 31, 2021 and firms should review and amend accordingly the existing cloud outsourcing arrangements with a view to ensuring that they take into account these guidelines by December 31, 2022. Where the review of cloud outsourcing arrangements of critical or important functions is not finalized December 31, 2022, firms should inform the respective competent authority about this, including the measures planned to complete the review or the possible exit strategy.
Keywords: Europe, EU, Banking, Securities, Outsourcing, Cloud Computing, DTCC, Euroclear, ESMA
The Bank for International Settlements (BIS) published a paper that studies impact of fintech lending on credit access for small businesses in U.S.
The Prudential Regulation Authority (PRA) issued the policy statement PS8/22 to amend the Own Funds and Eligible Liabilities (CRR) Part of the PRA Rulebook and update the supervisory statement SS7/13 titled "Definition of capital (CRR firms).
The European Banking Authority (EBA) launched the EU-wide transparency exercise for 2022, with results of the exercise expected to be published at the beginning of December, along with the annual Risk Assessment Report.
The Single Resolution Board (SRB) welcomed the adoption of the review of the Capital Requirements Regulation, or CRR, also known as the "CRR quick-fix."
The European Commission (EC) recently adopted the Delegated Regulation 2022/1622, which sets out the regulatory technical standards to specify the countries that constitute advanced economies for the purpose of specifying risk-weights for the sensitivities to equity.
The European Banking Authority (EBA) published the final draft regulatory technical standards specifying and, where relevant, calibrating the minimum performance-related triggers for simple.
The European Central Bank (ECB) is undertaking the integrated reporting framework (IReF) project to integrate statistical requirements for banks into a standardized reporting framework that would be applicable across the euro area and adopted by authorities in other EU member states.
The European Banking Authority (EBA) has been awarded the top European Standard for its environmental performance under the European Eco-Management and Audit Scheme (EMAS).
The Monetary Authority of Singapore (MAS) set out the Financial Services Industry Transformation Map 2025 and, in collaboration with the SGX Group, launched ESGenome.
The Basel Committee on Banking Supervision met, shortly after a gathering of the Group of Central Bank Governors and Heads of Supervision (GHOS), the oversight body of BCBS.