FCA guidance on using the cloud in Financial Services

Legal and regulatory:

• Firms should undertake a variety of pre-contractual due diligence tasks (e.g. compiling a business case supporting the outsource and reviewing the contract to ensure it complies with the FCA's rules).  This will enable firms to identify and resolve any issues at the outset in order to satisfy themselves that the outsource will not adversely affect operational risk. 

• The firm should identify all the service providers in the supply chain and ensure that the firm's requirements can be complied with throughout the chain. This could be difficult when contracting with a SaaS provider that is subcontracting hosting to a third party. In such circumstances, it can be difficult to ensure such subcontractors provide the requisite comfort to ensure the firm is compliant with its requirements (e.g. access to subcontractor's premises).

Risk management / international standards / data security:

• These considerations cover activities which must be completed pre-contract and during the contract.

• Risk assessment: the recommendations cover pre-contract due diligence (e.g. a risk assessment prior to the outsource to identify issues and steps to mitigate them) and contract protections (e.g. contractual provisions for the prompt notification and remediation of breaches). 

• Data security and standards: the FCA recommends a separate data security risk assessment of the firm's technology estate and the service provider and, linked to this, it states that as part of pre-contract due diligence and contract management it may be helpful if service providers are compliant with applicable information security standards, the logic being that a service provider's adherence to (for example) ISO 27000-series indicates robust data security processes.

• One concern, under data security requirements, is that the firm should have "choice and control regarding the jurisdiction in which their data is stored, processed and managed."  Given the one-to-many model adopted by service providers (which often results in limited changes being countenanced by the cloud provider) and their "follow-the-sun" support model (which means data is often processed in many jurisdictions by support teams around the world) we suspect firms may have challenges in this regard, although it is also the case that many cloud providers do now agree to maintain data within certain jurisdictions only.

Oversight:

• These considerations relate to contract management.

• Since a firm cannot outsource its regulatory responsibilities it should ensure the contract includes appropriate mechanisms to allow it to quickly identify and deal with issues.  For example:

• the firm should ensure its staff have sufficient skills to oversee and challenge service performance and properly manage exit to ensure a seamless transition in-house or to a replacement supplier; and

• the contract should include suitable arrangements for dispute resolution so issues are resolved at the lowest level quickly or escalated where appropriate.

Data protection:

• The Guidance reiterates that cloud outsourcing is subject to data protection law, and that specific ICO guidance on this point should apply.

• The Guidance does not attempt to elaborate on data protection obligations. More important, from a data protection perspective, will be the comparison with stricter contractual requirements which will be imposed by the General Data Protection Regulation.

• The General Data Protection Regulation has now been agreed, and will enter into force during early 2018. As well as requiring more detailed contractual provisions, this will also impose direct obligations on data processors for the first time and significantly increase the severity of potential sanctions.

Effective access to data / access to business premises:

• These considerations align with the FCA's existing rules in the FCA Handbook (i.e. SYSC 8.1.8(9)).

• Effective access to data: the FCA defines "data" widely to include "firm, personal, customer and transactional data".

• Access to business premises: this is often a hot topic with service providers who are sensitive to any access to premises such as data centres that will store many customers' data. 

• It is clear that the FCA expects physical access to business premises (for firms where the FCA's requirements apply as rules, e.g. common platform firms) which could cause problems for service providers. However, there is room for manoeuvre: where service providers can show legitimate security concerns they may be able to limit access to some sites (e.g. data centres).

Change management: firms should agree comprehensive procedures to govern changes so that new risks are not introduced as services are changed.

Continuity and business planning / exit plan: firms should have in place robust procedures to ensure continuity of service in the event of an unforeseen disruption to the outsourced services. This could include business continuity planning, step-in rights (if practical), identifying the appropriateness of insourcing activities and effective exit planning procedures to ensure seamless transition to a new service provider if necessary.

Resolution: the outsourced services should be organised in a way that does not create additional complexity or a barrier to the resolution or orderly wind-down of the firm.