EBA欧洲银行-EBA-REC-2017-03-CT-Rec-on-outsourcing-to-cloud-service-providers_6页_231kb

EBA Outsourcing to Cloud Service Providers Compliance Summary

Core Content

This document outlines the compliance status of competent authorities across the European Union (EU), European Economic Area (EEA), and other territories with the EBA's Recommendations on outsourcing to cloud service providers (EBA/REC/2017/03). The recommendations were issued on 20 December 2017 and became applicable on 1 July 2018. The EBA collects and reports the responses from national competent authorities regarding their compliance or intention to comply with the recommendations.

Compliance Status Overview

Key Information

• Application Date: 1 July 2018
• Recommendations Issued: 20 December 2017 (EBA/REC/2017/03)
• Compliance Deadline: Varies by competent authority, with most aiming for 1 July 2018 or later.
• Non-compliance: Bulgaria did not respond within the two-month period, and its status remains unclear.
• Special Notes:
  • The EBA does not accept responsibility for the accuracy of the information provided by competent authorities.
  • The EEA States other than the EU Member States are not required to notify compliance, and the table reflects voluntary submissions.
  • If a competent authority continues to intend to comply after the application date, it is classified as non-compliant unless specific conditions are met (e.g., no relevant institutions exist, or legislative processes are underway).
  • The EBA aims to integrate these recommendations into the EBA Guidelines on outsourcing, which will repeal the recommendations once the guidelines enter into force.

Main Points

• The EBA has collected responses from various competent authorities on their compliance with the outsourcing recommendations to cloud service providers.
• Most competent authorities either comply or intend to comply by the specified deadlines.
• Some authorities, like Germany and France, have partially implemented the recommendations and plan to comply with the integrated version in the future.
• Bulgaria did not respond within the required timeframe, and its status is not confirmed.
• The ECB intends to comply with the recommendations by December 2018, applying them to Significant Institutions as defined in Council Regulation (EU) No 1024/2013.
• The EBA emphasizes that compliance is case-by-case and that it will publish reasons for non-compliance if provided.
• For more detailed information, contact the respective competent authority using details available on the EBA's website.