EBA欧洲银行-Session-5-Cloud-CSSF-presentation-17-Oct-2018_15页_1mb

报告摘要

Summary of EBA Recommendations on Cloud Outsourcing in Luxembourg

Core Content

The European Banking Authority (EBA) has issued recommendations on cloud outsourcing, which are being implemented in Luxembourg by the Commission de Surveillance du Secteur Financier (CSSF). These recommendations aim to clarify supervisory requirements related to cloud outsourcing, thereby reducing uncertainty for both financial institutions (FIs) and Cloud Service Providers (CSPs). The CSSF has developed a circular (CSSF cloud circular) to align with these EBA recommendations while incorporating Luxembourg-specific regulatory nuances.

Main Objectives

Clarify supervisory requirements related to cloud outsourcing.
Remove uncertainty for both FIs and CSPs.
Support harmonization at the EU level while allowing for national specificities.
Ensure compliance with the EBA recommendations, even when considering Luxembourg's unique implementation.

Key Elements of the EBA Recommendations

Definition of Cloud Computing

Cloud computing is defined based on a recognized terminology (NIST, ENISA), with seven criteria:

On-demand self-service
Broad network access
Resource pooling
Rapid elasticity
Measured service
High degree of automation and industrialization
No unauthorized access to consumer data without prior consent and monitoring mechanisms

Roles and Responsibilities

The EBA recommendations define responsibilities based on the role played in the outsourcing process, distinguishing between:

Signatory: The entity that signs the contract with the CSP.
Consumer: The regulated entity (ISCR) that uses cloud resources for its activities.
Resource Operator: The entity that resells the CSP's cloud services and is fully responsible for service level quality.
Cloud Service Provider (CSP): The provider of cloud computing services.

Cloud Officer

A Cloud Officer is required for the resource operator.
The Cloud Officer must be trained specifically on cloud computing and its regulatory implications.

Authorization and Notification

The CSSF requires authorization or notification for cloud outsourcing.
Support PFS (Support Professional of the Financial Sector) are subject to the same legal framework as financial professionals.
The regulator has the power to sanction Support PFS.
Notification is required for outsourcing to a Support PFS, while non-objection is sufficient for other service providers.

Implementation in Luxembourg

CSSF circular 17/654 (May 2017): Provides a detailed framework for cloud outsourcing in Luxembourg.
EBA Recommendations (December 2017): Offer a harmonized EU approach, which Luxembourg has adapted to fit its regulatory environment.
Regulated entities (ISCR) are responsible for ensuring that the resource operator complies with the cloud circular and has performed due diligence on the CSP.

Progress and Challenges

Improvement in authorisation files: While initially of poor quality, they are now improving.
Proportionality principle: A project is underway to adjust Luxembourg’s expectations for non-material cloud outsourcing.
Enhanced interaction with CSPs: Continuous dialogue with major CSPs has improved understanding of supervisory expectations, especially regarding contractual audit rights.
Systemic risk concerns: The increasing concentration of outsourcing around major CSPs raises concerns about systemic risk, potentially leading to EU-level regulation of CSPs.

Conclusion

Cloud computing is unavoidable in the financial sector due to its efficiency, scalability, and technological advantages.
The high professionalism of CSPs, with significant resources and capabilities, makes them attractive for financial institutions.
Currently, 50% of outsourcing authorisation files received by the CSSF are cloud-related, though they are not yet for core business applications.
The EBA and regulators are monitoring the concentration of outsourcing around major CSPs, and the systemic risk may drive further EU-level regulation in the future.

Key Takeaways

The EBA recommendations provide a legal foundation for cloud outsourcing in the EU.
Luxembourg has adapted these recommendations into its national framework, ensuring compliance and harmonization.
The role of the Cloud Officer and the resource operator is critical in ensuring service quality and regulatory adherence.
The regulator maintains oversight through authorization, notification, and due diligence processes.
The financial sector is increasingly adopting cloud solutions, but regulatory challenges remain in managing systemic risks and ensuring compliance.