The European Central Bank (ECB) has initiated a public consultation on its new Guide concerning the outsourcing of cloud services to cloud service providers.

This Guide is designed to elucidate the ECB’s interpretation of relevant legal requirements and its expectations for the banks under its supervision.

As banks increasingly adopt cloud computing services from third-party providers, they gain access to potentially cheaper, more flexible, and more secure services. However, this reliance on third parties also introduces significant risks, including IT security issues and potential business disruptions.

Additionally, the cloud services market is highly concentrated, with many banks depending on a limited number of service providers, most of which are based outside Europe. Consequently, the ECB urges banks to explicitly consider these risks.

During its 2023 Supervisory Review and Evaluation Process, the ECB identified several vulnerabilities in banks’ IT outsourcing arrangements. Therefore, third-party risk management, including cloud outsourcing, is a top supervisory priority for the ECB from 2024 to 2026.

The public consultation on the Guide will run until 15 July 2024. Following this period, the ECB will publish the received comments along with a feedback statement and the finalised Guide.

The partner of Fintech section is