Cloud outsourcing arrangements must be compliant by 31 December 2022

Bastiaan Siemers

4 October, 2022

Following the end of the transitional period under the ESMA Guidelines on outsourcing to cloud services providers on 31 December 2022, all cloud outsourcing arrangements subject to these guidelines must be compliant. If this is not the case, the competent regulator must be noticed. In case of critical or important outsourcing, a notice to the competent regulator is always required.

Background

ESMA adopted detailed guidelines on cloud outsourcing arrangements in May 2021. These guidelines relate to the delivery of cloud services by a third party, being services using cloud computing (for example server access and external data storage).

At that time of adoption of the ESMA guidelines, it was stipulated that whereas new arrangements subject to these guidelines must be compliant by 31 July 2021, a transitional period applied to existing arrangements until 31 December 2022. As a result, the financial institutions these ESMA guidelines apply to (including alternative investment fund managers, management companies, investment firms and regulated market operators), were granted another one-and-a-half year to bring their existing arrangements in line with these guidelines.

Deadline: 31 December 2022

As a result of the above, the existing arrangements must be reviewed and, where necessary, updated by 31 December 2022. If the existing outsourcing arrangements still do not meet the ESMA guidelines by 31 December 2022, for example because a review is still pending or amendments have not yet been finalised, the competent authority must be notified and must be informed what measures are planned to finalise the review and make the necessary amendments, and when this is expected to be completed.

Aspects to take into account

The ESMA guidelines include nine guidelines. These guidelines relate to (1) a compulsory outsourcing strategy, (2) an analysis and due diligence required prior to outsourcing, (3) key contract terms, (4) information security, (5) a necessary exit strategy, (6) access and information rights for the party outsourcing and the competent authority, (7) sub-outsourcing conditions (to the extent authorised), (8) notification to the competent authority and (9) supervision.

The ESMA guidelines are largely in line with other rules and regulations on outsourcing and do not include materially new elements. The ESMA guidelines therefore require a step-by-step process cycle of strategy adoption, analysis of envisaged outsourcing, due diligence of the third party, contracting, notification of the competent regulator (where necessary), and monitoring of the arrangement.

Important element of the ESMA guidelines is the distinction between critical or important outsourcing and other outsourcing. Outsourcing is deemed critital or important if failure in performance would materially impair the compliance, financial performance, soundness or continuity of the financial institution outsourcing. Guidelines 5, 7 and 8 apply to critical or important outsourcing only.

Action required

In line with the above, financial institutions subject to the ESMA Guidelines on outsourcing to cloud services providers must make sure their cloud outsourcing arrangements comply with the ESMA guidelines by 31 December 2022. This requires a review of the existing arrangements and, where necessary, amendment to bring the arrangements in line with the ESMA guidelines. It is advisable to do this before 31 December 2022 as otherwise a notice must be given to the competent regulator (usually the AFM). Bear in mind that a notice must anyway be given in respect of outsourcing that is qualified as critical or important.

About the author


Bastiaan Siemers

Bastiaan Siemers is specialized in financial law and securities law. He has in-depth knowledge of virtually all aspects of financial supervision and the accompanying Netherlands and European rules and regulations.

More from Bastiaan Siemers

Dutch remuneration regime for financial undertakings tightenedBastiaan Siemers - June 29, 2022

Company law and corporate governance


Read more
New rules on marketing communications for funds - February 1, 2022

Company law and corporate governance, Regulated markets


Read more
New fund marketing rulesBastiaan Siemers - August 2, 2021

Financing and Securities law


Read more
Brexit: three months and countingBastiaan Siemers - September 30, 2020

Financing and Securities law


Read more
Regulation on Markets in Crypto-assets (MiCA)Bastiaan Siemers - September 24, 2020

Financing and Securities law


Read more
Brexit: it is finally there (but it is still unclear)Bastiaan Siemers - February 28, 2020

Financing and Securities law


Read more
Read more
Brexit updateBastiaan Siemers - October 2, 2019

Financing and Securities law


Read more