EBA REC 2017 03 Compliance Table on Outsourcing to Cloud Service Providers

Recommendations compliance table EBA/REC/2017/03 20 December 2017; Date of application – 1 July 2018 (Updated – 18 March 2021) Recommendationson outsourcing to cloud service providers The following competent authorities* comply or intend to comply with EBA’s Recommendations on outsourcing to cloud service providers:
Competent authority
Complies or intends to comply Comments Member State BE Belgium National Bank of Belgium Intends to comply By 01.07.2018. The National Bank of Belgium in in the process of integrating these recommendations in its regulatory framework. BG Bulgaria Българска народна банка (Bulgarian National Bank) No response No notification of compliance was received by the EBA within the two-month time limit. CZ Czech Republic Czech National Bank Yes As at 12.04.2018, notification date. DK Denmark Danish Financial Supervisory Authority Intends to comply By 01.01.2019. The enforcement of the current executive order on outsourcing is in accordance with the recommendations a the entry into force of the recommendations. A revised executive order in alignment with the recommendations is planned to enter into force by 01.01.2019. DE Germany BaFin Intends to comply By respective implementation period that will be fixed for the Outsourcing guidelines.

Competent authority
Complies or intends to comply Comments BaFin already complies with the major part of the Recommendations on outsourcing to cloudservice providers (EBA/REC/2017/03) except with the provisions for adequately informing thesupervisors (REC 4.2). The recommendations on informing the competent authorities of material activities to be outsourced to cloud service providers and on maintaining an updated register by the institutions for all its activities outsourced to cloud service providers are currently not fully implemented. However, since EBA intends to fully integrate the Recommendations on outsourcing to cloud service providers into the EBA Guidelines on outsourcing and to repeal them when the Guidelines enter into force, BaFin intends to comply with the integrated version of the recommendations by the respective implementation period that will be fixed for the Outsourcing guidelines. EE Estonia Finantsinspektsioon Yes As at 09.05.2018, notification date. IE Ireland Central Bank of Ireland Intends to comply By 01.07.2018. EL Greece Bank of Greece Yes As at 17.03.2021, notification date. Recommendation adopted with the Executive CommitteeAct of the Bank of Greece No. 178/5/2020. HR Croatia Hrvatska narodna banka (Croatian National Bank) Yes Please be informed thatnational measurenecessary for compliance with the Guidelines is:
Decision on actions in exercising the power to write down and convert capital instruments(OG23/2018) https://www.hnb.hr/documents/2 0182/2060837/e-decision-actions￾in-exercising-the-power-to-write￾down-convert-capital￾instruments.pdf/8ea6f633-8665- 412a-a8b9-3beacd2c6fed

Competent authority
Complies or intends to comply Comments By 01/07.2018. ES Spain Banco de España Intends to comply By 01.07.2018. FR France ACPR Email received Email dated 20.04.2018. ACPR is currently implementing all the provisions of these EBA recommendations. Unfortunately, the calendar of our internal formal validation process will not permit that ACPR meets the deadline of 28 May to express our intention to comply with such Recommendations. However, we should in principle be in position to express our compliance through a decision that will be madeby the ACPR college by mid-July. IT Italy Bank of Italy Intends to comply By 31.12.2018. With regard to credit institutions, the Bank of Italy Regulation on banks' outsourcing of IT system, including outsourcing to cloud service providers, is already compliant with the EBA Recommendations. As to investment firms, general rules on outsourcing are set forth by the 2007 Bank of Italy andConsob Joint Regulation implementing the Consolidated Law on Finance. As a result of legislative innovations introduced in 2017 to implement the MIFID 2 package these rules are currently under review and a new Regulation will be adopted in 2018; within this framework compliance with the Recommendations will be ensured. CY Cyprus Central Bank of Cyprus Intends to comply By 31.12.2018. LV Latvia Financial and Capital Market Commission Yes As at 09.05.2018, notification date.

Competent authority
Complies or intends to comply Comments LT Lithuania Bank of Lithuania Intends to comply By 01.07.2018. LU Luxembourg Commission de Surveillance du Secteur Financier (CSSF) Yes As at 28.05.2018, notification date. HU Hungary Magyar Nemzeti Bank (The Central Bank of Hungary) Intends to comply By 01.07.2018. MT Malta Malta Financial Services Authority Intends to comply By such time as the necessary legislative or regulatory proceeds have been completed. NL Netherlands De Nederlandsche Bank Yes As at 23.05.2018, notification date. AT Austria Austrian Financial Market Authority Yes As at 18.05.2018, notification date. PL Poland Komisja Nadzoru Finansowego Yes As at 30.05.2018, notification date. PT Portugal Banco de Portugal Intends to comply By 01.01.2019. RO Romania National Bank of Romania Yes As at 04.06.2018, notification date. SI Slovenia Bank of Slovenia Intends to comply By 01.07.2018. SK Slovakia Národná Banka Slovenska Intends to comply By the date of finalisation of draft GL on outsourcing. FI Finland Finanssivalvonta (FIN￾FSA) Intends to comply By 01.07.2018. SE Sweden Finansinspektionen Yes As at 28.05.2018, notification date. UK United Kingdom Prudential Regulation Authority Intends to comply By 01.07.2018. Financial Conduct Authority Intends to comply By 01.07.2018. EU Institutions - Agencies

Competent authority
Complies or intends to comply Comments ECB European Central Bank (for Significant Institutions as defined in Council Regulation (EU) No 1024/2013 of 15 October 2013 conferring specific tasks on the European Central Bank concerning policies relating to the prudential supervision of credit institutions) Intends to comply By December 2018. EEA – EFTA State IS Iceland Fjármálaeftirlitið (Financial Supervisory Authority, lceland) Yes As at 28.05.2018, notification date. LI Liechtenstein Financial Market Authority Liechtenstein (FMA) Intends to comply By 01.12.2018. Due to the implementation of new processes the Principality of Liechtenstein will comply with the recommendations per 1 December 2018. NO Norway The Financial Supervisory Authority of Norway Intends to comply By 01.07.2018. European Territories under Article 355(3) TFEU UK United Kingdom Gibraltar Financial Services Commission Yes As at 12.06.2018, notification date. *The EEA States other than the Member States of the European Union are not currently required to notify their compliance with the EBA’s Guidelines. This table is based on information provided from those EEA States on a voluntary basis. Please note that, in the interest of transparency, if a competent authority continues to intend to comply after the application date, it will be considered “non-compliant” unless (A) the Guidelines relate to a type of institution or instruments which do not currently exist in the jurisdiction concerned; or (B) legislative or regulatory proceedings have been initiated to bring any national measures necessary to comply with the Guidelines in force in the jurisdiction concerned. Notes
Article 16(3) of the EBA’s Regulationsrequires national competent authorities to inform us
whether they comply or intend to comply with each Guideline or recommendation we issue. If a

competent authority does not comply or does not intend to comply it must inform us of the reasons. We decide on a case by case basis whether to publish reasons. The EBAendeavour to ensure the accuracy of this document, however, the information is provided by the competent authorities and, as such, the EBA cannot accept responsibility for its contents or any reliance placed on it. For further information on the current position of any competent authority, please contact that competent authority. Contact details can be obtained from the EBA’s website www.eba.europa.eu.