Circular Letter No. CC/2019/00000025

Circular Letter No. CC/2019/00000025 2019-02-07 Page 1 of 2 Sent to: Banks; Savings Banks; Central Credit Agricultural Mutual Box; Agricultural Credit Mutual Boxes; Agricultural Credit Mutual Boxes (not belonging to SICAM); Credit Financial Institutions; Brokerage Financial Companies; Brokerage Companies; Asset Management Companies; Intermediaries of the Money or Exchange Markets; Investment Consulting Companies; Multilateral Trading System Management Companies; Shareholding Management Companies. Mod. 99999924/T – 01/14 Subject: Recommendations regarding external outsourcing to cloud computing service providers

On December 20, 2017, the European Banking Authority (EBA) approved a set of recommendations – “Recommendations on external outsourcing to cloud computing service providers” (hereinafter “Recommendations”) – addressed to credit institutions and investment firms regarding the outsourcing of cloud computing services, with a view to strengthening and harmonizing outsourcing practices in this area.

These Recommendations can be consulted on the EBA website: https://www.eba.europa.eu/-/eba-issues-guidance-for-the-use-of-cloud-service-providers-by-financial-institutions

The Bank of Portugal communicated to the EBA its intention to comply with these Recommendations starting January 1, 2019.

The Bank of Portugal emphasizes the importance of the robustness of outsourcing practices by institutions, particularly regarding cloud computing services, and indicates that practices in this matter must incorporate, among others, prior communication to the competent national authority of the external outsourcing of these services for activities considered material, the maintenance of a contract register, and the need to ensure contractual rights of access and audit.

In this context, the Bank of Portugal, in the exercise of the competence attributed to it by Article 17 of its Organic Law, approved by Law No. 5/98 of January 31, intends to transmit the following:

1. Credit institutions and investment firms subject to the supervision of the Bank of Portugal under the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of December 31, in its current wording, must, from January 1, 2019, observe the requirements provided for in the Recommendations.

2. The provisions of this Circular Letter do not cover entities classified as significant under paragraph 4 of Article 6 of Council Regulation (EU) No. 1024/2013 of October 15, 2013, conferring specific tasks on the ECB concerning policies relating to the prudential supervision of credit institutions, and Regulation (EU) No. 468/2014 of the European Central Bank of April 16, 2014, establishing the framework for cooperation within the Single Supervisory Mechanism between the European Central Bank and national competent authorities.

Page 2 of 2 BANK OF PORTUGAL Headquarters: Rua do Comércio, 148 • 1100-150 Lisbon • Portugal T +351 213 130 000 • www.bportugal.pt Tax ID No. 500792771 • Share Capital: € 1,000,000 • Registration at the Lisbon C.R.C., No. 51 Mod. 99999924/T – 01/14

3. The Recommendations provide minimum content applicable to the matters in question and must be applied in the context of requirements already defined, particularly in the “Guidelines on outsourcing” of the Committee of European Banking Supervisors (CEBS) on external outsourcing, of December 14, 2006.

4. Credit institutions and investment firms must notify the Bank of Portugal, by February 15, 2019, of the contracting of cloud computing services relating to activities considered material that have occurred between January 1, 2019, and February 14, 2019.

5. From February 15, 2019, credit institutions and investment firms must notify the Bank of Portugal of the contracting of cloud computing services relating to activities considered material, within a period of at least 10 business days prior to such contracting, via the BPnet Portal, for which purpose they must send the information required in point 4.2 of the Recommendations.

The possibility of the Bank of Portugal requesting additional information, as provided for in the Recommendations, is reserved.