Banks and payment institutions
The EBA Recommendation on outsourcing to cloud service providers (EBA/REC/2017/03) came into force on 1 July 2018, cancelling the cloud computing circular dating from 6 December 2011. If the circular still required notification of all cloud computing initiatives to DNB, notifications of material cloud outsourcings now suffice.
The EBA Recommendations discuss seven specific subjects, i.e.
- Assessment of materiality
- Obligation to inform supervisory authorities adequately.
- Access and audit rights
- Security of data and systems
- Location of data and data processing
- Continuity plans and exit strategies.
For the full text of the Recommendations, see https://www.eba.europa.eu/documents/10180/2170125/Recommendations+on+Cloud+Outsourcing+%28EBA-Rec-2017-03%29_NL.pdf/cd841280-842c-42d2-a277-e02b982aedd4
Solvency II does not distinguish between outsourcing and cloud outsourcing. DNB must be notified of material (critical, important) outsourcing only. Hence, there are no additional requirements for the use of cloud solutions. This cancels the cloud computing circular dating from 6 December 2011.
DNB published a circular on cloud computing on 6 December 2011 following numerous questions on cloud computing.  The circular discusses the risks associated with could computing relevant for financial institutions. The circular also applies to the pensions sector. The implementation of the IORP II directive also obliges pension funds to notify DNB of outsourcing. Pension funds will receive further information on this. The cloud computing circular will therefore also be cancelled for pension funds.
The circular discusses the statutory framework for outsourcing (i.e. including cloud computing). As the circular prescribes, DNB expects cloud initiatives to be notified before these services are actually obtained.
 There are many definitions going round for cloud computing DNB uses the definition from the EBA Recommendations on outsourcing to cloud service providers (EBA/REC/2017/03).