Circular to Credit Institutions on Banking Rule BR/14

Circular 4th February 2019 Circular to Credit Institutions on Banking Rule BR/14 The Authority is hereby issuing an annex to Banking Rule BR/14 on the “Outsourcing by Credit Institutions authorised under the Banking Act 1994” (hereinafter the “Rule”).

Annex 1 – Outsourcing to Cloud Service Providers Annex 1 to the Rule provides guidance for the specific context of institutions that outsource to cloud service providers and stipulates the supervisory requirements and processes that apply in such scenarios. By implementing the EBA Recommendations EBA/REC/2017/03, ‘Recommendations on outsourcing to cloud service providers’ which refer to credit institutions and investment firms, the Annex applies specifically to credit institutions, as defined in Article 2(1) of the Banking Act (Chapter 371 of the Laws of Malta), and sets out the manner in which materiality of cloud outsourcing is assessed and reported to the Authority. Additionally, the Annex provides guidance on the security of the data and systems used whilst addressing the treatment of data and data processing locations in the context of cloud outsourcing. The Annex includes requirements for credit institutions to mitigate the risks associated with ‘chain’ outsourcing, where the cloud service provider subcontracts elements of the service to other providers. Finally, the Annex guides credit institutions on the contractual and organisational arrangements for contingency plans and exit strategies that shall be in place in relation to cloud outsourcing. Revisions to BR/14 Minor revisions to BR/14 were undertaken to allow for the inclusion of the above-stated Annexes. The revised BR/14 and Annex shall come into force with immediate effect. Any queries in relation to the above should be directed to Banking Supervision (Policy Section) on bsupolicy@mfsa.com.mt. Communications Unit