EBA Urged To Follow Singapore's Approach To The Regulation Of Cloud Outsourcing By Banks

Banks should not be required to notify regulators before they engage in material cloud outsourcing arrangements, international law firm Pinsent Masons has said.

Pinsent Masons, the law firm behind Out-Law.com, has called on the European Banking Authority (EBA) to follow the example set by the Monetary Authority of Singapore (MAS) in rules MAS has prepared for firms on outsourcing to the cloud. The recommendation was contained in a response the firm submitted to an EBA consultation on draft guidelines on outsourcing to the cloud which closed last week.

Under the Singapore regime, financial firms that wish to enter into "material outsourcing arrangements" are not obliged to pre-notify MAS of those plans. Instead, the firms must be able to demonstrate their compliance to the regulator, including through submissions of the register they need to keep of material outsourcing arrangements at least annually or upon request.

In contrast, the EBA's proposed in its draft guidance that banks should notify 'material' cloud outsourcing arrangements to regulators and disclose certain information concerning those arrangements with them too prior to entering into those contracts.

Pinsent Masons said the "reasoned approach" taken by MAS should be favoured, and said that it did not see anything in EU regulations to prevent financial regulators in Europe "taking a similar approach".

"MAS places the onus on regulated institutions to exercise appropriate due diligence before engaging an outsourcing provider and to be ready to demonstrate compliance whenever called upon by the regulator," Pinsent Masons' response to the consultation said. "Accordingly, MAS imposes specific requirements around the extent to which financial institutions must notify when an event has taken place which has an adverse impact on the service provided but does not require notification before the arrangement is entered into."

"The approach taken by MAS is more consistent with the role the regulator has in intervening when appropriate in accordance with the regulatory framework, as regulators do not have, in contrast, a general role of continuously monitoring technology outsourcing arrangements on an ongoing basis," it said.

Pinsent Masons also said that the EBA should reconsider plans to require banks to notify regulators each time they buy new services from a cloud provider.

"We recommend that the EBA introduce a proportionality test which focuses on the identity of cloud service...