Featured Product

    EIOPA Finalizes Guidelines on Outsourcing to Cloud Service Providers

    February 06, 2020

    EIOPA published the final guidelines on outsourcing to cloud service providers. The guidelines are addressed to national supervisory authorities and inform market participants on how outsourcing provisions in the legislative framework need to be applied in case of outsourcing to cloud service providers. These outsourcing provisions have been set forth in the Solvency II Directive, in the Commission Delegated Regulation 2015/35, and in the EIOPA guidelines on system of governance. The guidelines apply from January 01, 2021 and undertakings should ensure compliance by December 31, 2022.

    The consultation on draft guidelines on outsourcing to cloud service providers ran from July 01 to September 30, 2019 and EIOPA received 28 responses. The stakeholder input helped EIOPA to prepare the final version of these guidelines, which have been streamlined taking into account the principle of proportionality and a risk-based approach to implementation. In the final guidelines, EIOPA mainly focused on outsourcing of critical or important operational functions or activities to cloud service providers. The guidelines cover the following areas:

    • Criteria to distinguish whether cloud services should be considered within the scope of outsourcing
    • Principles and elements of governance of cloud outsourcing, including documentation requirements and list of information part of the notification to supervisory authorities
    • Pre-outsourcing analysis, including a set of criteria to be followed to assess whether a cloud outsourcing arrangement relates to an operational function or activity that is critical or important
    • Principle-based instructions on how the risk assessment of the cloud outsourcing and the due diligence on the cloud service providers should be performed
    • Contractual requirements
    • Management of access and audit rights; security of data and systems; sub-outsourcing of critical or important operational functions or activities; monitoring and oversight of cloud outsourcing; and exit strategies
    • Principle-based instructions for national supervisory authorities on the supervision of cloud outsourcing arrangements including, where applicable, at group level.

    The final report of these guidelines also contains the feedback statement to the consultation, the final impact assessment, and the resolution of non-confidential comments provided by the stakeholders during the consultation. EIOPA developed these guidelines to provide clarification and transparency to market participants and to avoid potential regulatory arbitrage. The guidelines may also foster supervisory convergence regarding the expectations and processes applicable in relation to cloud outsourcing. In accordance with Article 16 of Regulation (EU) No 1094/2010, within two months of the issuance of these guidelines, each competent authority shall confirm if it complies or intends to comply with these guidelines. In case a competent authority does not comply or does not intend to comply, it shall inform EIOPA, stating the reasons for non-compliance.

    The guidelines apply from January 01, 2021 to all cloud outsourcing arrangements entered into or amended on or after this date. Undertakings should review and amend accordingly the existing cloud outsourcing arrangements related to critical or important operational functions or activities with a view to ensuring compliance with these guidelines by December 31, 2022. Where the review of cloud outsourcing arrangements related to critical or important operational functions or activities is not finalized by December 31, 2022, the undertaking should inform its supervisory authority about this, including the measures planned to complete the review or the possible exit strategy. The supervisory authority may agree with the undertaking on an extended timeline for completing that review, where appropriate. The update (where needed) of the undertaking’s policies and internal processes should be done by January 01, 2021 while the documentation requirements for cloud outsourcing arrangements related to critical or important operational functions or activities should be implemented by December 31, 2022.

     

    Related Links

    Effective Date: January 01, 2021

    Keywords: Europe, EU, Insurance, Reinsurance, Guidelines, Outsourcing, Governance, Fintech, Insurtech, Regulatory Arbitrage, Proportionality, Cloud Outsourcing, Supervisory Convergence, Solvency II, EC, EBA, EIOPA

    Featured Experts
    Related Articles
    News

    Regulators Fine Goldman Sachs for Risk Management Failures

    FCA and PRA in the UK, FED in the US, and the authorities in Singapore have fined Goldman Sachs for risk management failures in connection with the 1Malaysia Development Berhad (1MDB).

    October 23, 2020 WebPage Regulatory News
    News

    Canada Hosts International Conference of Banking Supervisors

    BCBS announced that OSFI and the Bank of Canada hosted the 21st International Conference of Banking Supervisors (ICBS) virtually on October 19-22, 2020.

    October 22, 2020 WebPage Regulatory News
    News

    FCA Proposes More Measures to Help Insurance Customers Amid Crisis

    FCA proposed guidance on how firms should continue to seek to help customers who hold insurance and premium finance products and may be in financial difficulty because of COVID-19, after October 31, 2020.

    October 21, 2020 WebPage Regulatory News
    News

    EBA Issues Opinion to Address Risk Stemming from Legacy Instruments

    EBA issued an opinion on prudential treatment of the legacy instruments as the grandfathering period nears an end on December 31, 2021.

    October 21, 2020 WebPage Regulatory News
    News

    ESRB Publishes Non-Bank Financial Intermediation Risk Monitor for 2020

    ESRB published the fifth issue of the EU Non-bank Financial Intermediation Risk Monitor 2020 (NBFI Monitor).

    October 21, 2020 WebPage Regulatory News
    News

    HM Treasury Publishes Policy Statement Amending Benchmarks Regulation

    HM Treasury announced that the new Financial Services Bill has been introduced in the Parliament.

    October 21, 2020 WebPage Regulatory News
    News

    APRA Initiates Action Against a Bank for Liquidity Compliance Breach

    APRA announced that it has increased the minimum liquidity requirement of Bendigo and Adelaide Bank for failing to comply with the prudential standard on liquidity.

    October 21, 2020 WebPage Regulatory News
    News

    PRA Consults on Implementation of Certain Provisions of CRD5 and CRR2

    PRA published the consultation paper CP17/20 to propose changes to certain rules, supervisory statements, and statements of policy to implement elements of the Capital Requirements Directive (CRD5).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule to Reduce Impact of Large Bank Failures

    US Agencies adopted a final rule that applies to advanced approaches banking organizations and aims to reduce interconnectedness in the financial system as well as to reduce contagion risks associated with the failure of a global systemically important bank (G-SIB).

    October 20, 2020 WebPage Regulatory News
    News

    US Agencies Finalize Rule on Net Stable Funding Ratio Requirements

    US Agencies (FDIC, FED, and OCC) adopted a final rule that implements the net stable funding ratio (NSFR) for certain large banking organizations.

    October 20, 2020 WebPage Regulatory News
    RESULTS 1 - 10 OF 6004