Cloud outsourcing
Also called outsourcing to the cloud, cloud service arrangement
Cloud outsourcing is when a regulated firm relies on a cloud service provider to run systems, store data or deliver functions it would otherwise perform itself. Financial regulators treat it as outsourcing or ICT third-party risk, so firms must assess it, contract for access and audit rights, and plan for exit.
How it works
Before migrating, firms assess whether the cloud service supports a critical or important function, where data will sit, how it is encrypted and who holds the keys. Contracts set audit and access rights, incident notification, data location and termination terms. Firms then monitor the provider through certifications, pooled audits and their own testing, and keep an exit plan that can move workloads elsewhere.
Cloud concentration is a supervisory concern because a small number of hyperscale providers host much of the sector. DORA lets EU authorities designate critical ICT third-party providers for direct oversight, and the UK has its own critical third parties regime. For each firm, a weak exit plan or unclear data location can turn a provider outage into a regulatory breach.
The rules
Incorporate the EBA cloud recommendations and apply outsourcing governance and audit rights to cloud. EBA/GL/2026/09, published September 2026, will repeal them once it applies.
Credit institutions, investment firms, payment and e-money institutionsSet expectations on governance, due diligence, contract terms, security, exit and supervisory notification for cloud outsourcing.
Investment firms, fund managers, CCPs, CSDs and other ESMA-supervised entitiesFCA guidance on meeting outsourcing rules when using cloud and third-party IT services; updated in March 2026 to point to new third-party reporting rules.
FCA-regulated firms outside the scope of the EBA outsourcing guidelinesTreats cloud services as ICT services, with contract, register and exit requirements and direct EU oversight of critical providers.
EU financial entities and their ICT third-party service providersCommon questions
Is every cloud contract an outsourcing?
Not always. It depends on whether the firm relies on the provider to perform a function it would otherwise perform. Under DORA, cloud services are ICT services regardless of the outsourcing label, so register and contract rules still apply.
Why do regulators focus on exit plans for cloud?
Moving large workloads between providers is slow and costly. Regulators expect firms to have a documented, tested way to exit or bring services back in-house so a provider failure or dispute does not stop critical services.
Can firms rely on provider certifications instead of auditing?
Certifications and pooled audits are accepted as part of oversight, but firms keep responsibility. EU and UK guidance expect firms to check that the scope of certifications covers the services they use and to retain full audit rights.
