EU Consultation on Draft Guidelines on Outsourcing to Cloud Service Providers

The European Securities and Markets Authority has opened a consultation on draft guidelines on outsourcing to cloud service providers. The draft guidelines cover: (i) governance, documentation, systems and procedures that firms should have in place; (ii) the assessment and due diligence to be undertaken before outsourcing arrangements are entered; (iii) minimum elements that outsourcing agreements should include; (iv) exit strategies; and (v) access and audit rights. The consultation closes on September 1, 2020. ESMA expects to publish the final guidelines in Q4 2020 or Q1 2021.

The proposed guidelines would apply to the below entities:

• Alternative Investment Fund Managers, Undertakings for Collective Investment in Transferable Securities management companies and depositaries of AIFs and UCITS;
• CCPs, including Tier 2 third-country CCPs which comply with the relevant EMIR requirements, trade and securitization repositories, central securities depositories and market operators of trading venues;
• investment firms and banks when carrying out investment services and activities;
• data reporting services providers;
• credit rating agencies; and
• administrators of benchmarks, including, as of January 1, 2022, recognized third-country administrators of benchmarks which comply with the relevant requirements in the Benchmarks Regulation and administrators of critical benchmarks.

National regulators are expected to implement the final guidelines into their national frameworks. ESMA intends to assess compliance with the guidelines of those entities for which it is responsible for direct supervision, those being Tier 2 third-country CCPs, trade and securitization repositories, CRAs, and from January 1, 2022, DRSPs, recognized third-country administrators of benchmarks and administrators of critical benchmarks.

It is proposed that the final guidelines will apply from June 30, 2021, to all cloud outsourcing arrangements entered into, renewed or amended on or after this date. Firms will be expected to review and amend, if appropriate, existing cloud outsourcing arrangements to take into account the final guidelines by December 31, 2022.

View ESMA's consultation paper on draft guidelines on outsourcing to cloud service providers.

Return to main website.