Circular to Financial Institutions on Banking Rule BR/14

Circular 7th February 2019

Circular to Financial Institutions on Banking Rule BR/14 The Authority has on 4th February 2019 issued an annex to Banking Rule BR/14 on the “Outsourcing by Credit Institutions authorised under the Banking Act 1994” (hereinafter the “Rule”). This Rule and Annex are applicable in full to Financial Institutions authorised in terms of the Financial Institutions Act (Cap. 376).

Annex 1 – Outsourcing to Cloud Service Providers Annex 1 to the Rule provides guidance for the specific context of institutions that outsource to cloud service providers and stipulates the supervisory requirements and processes that apply in such scenarios. By implementing the EBA Recommendations EBA/REC/2017/03, ‘Recommendations on outsourcing to cloud service providers’, the Annex sets out the manner in which materiality of cloud outsourcing is assessed and reported to the Authority. Additionally, the Annex provides guidance on the security of the data and systems used whilst addressing the treatment of data and data processing locations in the context of cloud outsourcing. The Annex includes requirements for institutions to mitigate the risks associated with ‘chain’ outsourcing, where the cloud service provider subcontracts elements of the service to other providers. Finally, the Annex guides institutions on the contractual and organisational arrangements for contingency plans and exit strategies that shall be in place in relation to cloud outsourcing. Revisions to BR/14 Minor revisions to BR/14 were undertaken to allow for the inclusion of the above-stated Annexes. The revised BR/14 and Annex shall come into force with immediate effect. Any queries in relation to the above should be directed to Banking Supervision (Policy Section) on bsupolicy@mfsa.com.mt. Communications Unit