SARB Issues Directive on Cloud Computing and Data Offshoring by Banks

The Prudential Authority of the country expects banks to follow a risk-based approach that is aligned with their risk appetite, based on the nature and size of operations, when implementing cloud computing and offshoring the data. The directive specifies that bank must have in place a formally defined and board approved data strategy and data governance framework. Banks must ensure that their risk and control frameworks, including their application, are designed and operative effectively to manage risks associated with the use of cloud computing and/or the offshoring of data. Banks that use cloud computing and/or offshore their data must ensure that they remain compliant with applicable legislation and regulations, both locally and in the country where cloud services and/or data are hosted.

Related Links

• Directive: D3/2018
• Guidance Notes: G5/2018

Effective Date: October 01, 2018

Keywords: South Africa, Banking, Fintech, Cloud Computing, Data Offshoring, Data Governance, SARB