EBA欧洲银行-Session-8-Roundtable-discussion-17-Oct-18_6页_1mb

报告摘要

EBA Workshop Summary: EBA Recommendations on Cloud Outsourcing – Implementation Benefits and Challenges

Core Content

The European Banking Authority (EBA) conducted a workshop to discuss the implementation benefits and challenges of its recommendations on cloud outsourcing. The session aimed to explore how banks and supervisors can effectively navigate the transition to cloud-based services while ensuring compliance, security, and innovation.

Main Benefits of Implementing EBA Recommendations

The EBA outlined several key benefits that arise from implementing its recommendations on cloud outsourcing:

Clarity of Expectations: The recommendations help establish clear expectations for both banks and cloud service providers (CSPs), ensuring that all parties understand their roles and responsibilities.
Legal Certainty in Contracts: By providing a standardized framework, the EBA recommendations enhance legal certainty in outsourcing contracts, reducing ambiguity and potential disputes.
Level of EU Harmonisation: The EBA emphasizes the importance of harmonizing regulations across EU member states to create a consistent and predictable environment for cloud outsourcing.
Proportionality: The recommendations take into account the varying sizes and complexities of banks, allowing for a proportionate approach to compliance and risk management.
Register as a Useful Tool: A centralized register of cloud outsourcing activities is proposed as a valuable tool for all stakeholders, including supervisors and banks.
Facilitated Dialogue: The recommendations foster better communication and collaboration between the banking industry and regulatory supervisors.

Obstacles to Cloud Adoption by Banks

Despite the benefits, several challenges and obstacles to cloud adoption were identified:

Supervisors

Contractual Restrictions: Supervisors may impose overly restrictive contractual terms that could hinder innovation and flexibility.
Harmonisation at National Level: There is a need for more consistent implementation of EBA recommendations at the national level.
Audits: Current audit requirements are seen as burdensome and lack clarity, potentially leading to outdated practices.
Lack of Trust in Audits: There is a general lack of confidence in the audit processes provided by CSPs.
Notifications for Sub-contracting: The process for notifying sub-contracting activities remains unclear and may require further refinement.

Institutions

Clarity on Materiality Criteria: Banks need clearer guidance on what constitutes materiality for the purpose of notifications.
Global Regulation: Regulations should support cloud adoption on a global scale rather than being technologically neutral.
Cloud-Specific Regulation: There is a need for cloud-specific regulations to address the unique risks and challenges associated with cloud services.
Uncovered Aspects: The recommendations do not fully address the management of multi-model capabilities, which are essential for modern banking.
IT Architecture and Skill Gaps: Banks must ensure their IT infrastructure is "cloud ready" and address the skill gaps among their staff to effectively manage cloud outsourcing.

Going Forward

To address these challenges and realize the benefits of cloud outsourcing, the EBA suggests the following steps:

Certifications for Security Standards: Establishing and implementing certifications for security standards will help ensure that CSPs meet the necessary regulatory requirements.
Switching and Porting: The process for switching and porting data and services between CSPs should be streamlined and standardized.
Implementation of Recommendations at National Level: Member states must work towards consistent and effective implementation of the EBA recommendations at the national level.

Key Questions Raised

Are there other obstacles not mentioned yet?
The workshop highlighted the need to identify and address any additional barriers that may hinder the adoption of cloud services in the banking sector.
What is the outlook for CSPs in the future?
There were concerns about the risks of focusing solely on CSPs within the outsourcing framework, suggesting a broader consideration of all outsourcing models.