The European Central Bank is investigating the cloud services used by banks, after the ECB found “vulnerabilities in banks’ IT outsourcing strategies”.
The ECB has launched a public consultation on a guide to safely using public cloud service providers, like Amazon Web Services, Google Cloud Platform, and Microsoft Azure, among others.
The guide aims to clarify both the ECB’s understanding of related legal requirements and its expectations for the banks it supervises. “This will make supervision more consistent while helping ensure a level playing field for all banks,” the ECB says.
The guide will draw on risks and best practices observed by the ECB’s joint supervisory teams in the context of ongoing supervision and dedicated on-site inspections, said the European bank.
“Dependency on third parties can expose banks to risks, for example with regard to IT security and possible business disruptions.” For example, it said, if a bank cannot easily substitute outsourced services during a failure, its functions may be interrupted.
In addition, the market for cloud services is “highly concentrated”, with many banks relying on just a few service providers located in non-European countries, the ECB pointed out. Therefore, the ECB considers it “good practice” for banks to explicitly take these risks into consideration.
The ECB says it identified various vulnerabilities in banks’ IT outsourcing arrangements during its 2023 Supervisory Review and Evaluation Process. As a result, third-party risk management, including cloud outsourcing, “remains high” on the list of the ECB’s supervisory priorities for 2024-2026.
In an effort to enhance ICT-related risk management, EU legislators introduced the Digital Operational Resilience Act (DORA), highlighting the need to proactively mitigate risks that could lead to the disruption of critical functions or services. Legal acts such as DORA, and the Capital Requirements Directive, require banks to establish effective governance of risk stemming from outsourcing, as well as to build up frameworks for IT security and for cyber resilience.
The guide will outline the ECB’s understanding of these specific rules and how they apply to the banks it supervises.
The public consultation on the guide on outsourcing cloud services will end on 15 July 2024. The ECB will subsequently publish the comments it receives, together with a feedback statement and the final guide.
