ECB Cloud Outsourcing Guide (2025)

Abstract

Supervisory guidance from the ECB setting out expectations and observed good practices for banks under ECB Banking Supervision when outsourcing cloud services to cloud service providers, aligned with DORA and related EU prudential requirements, covering governance, risk assessment, resilience, security, exit strategies, monitoring and audits.

Key Takeaways

• ✓
  Clarifies supervisory expectations for managing cloud outsourcing risks under DORA, including governance, roles and responsibilities, and ex ante risk assessment before entering cloud outsourcing arrangements.
• ✓
  Highlights cloud-specific risk areas such as concentration risk and vendor lock-in, multi-tenancy, data location and processing risks, and complex sub-outsourcing chains.
• ✓
  Emphasises resilience and business continuity for cloud-supported critical or important functions, including backup, disaster recovery assessment and testing, and extreme unavailability scenarios.
• ✓
  Recommends strong ICT and data security controls for cloud use, including encryption and cryptographic key management, IAM controls, monitoring and logging, and restricting/monitoring data locations.
• ✓
  Stresses the need for realistic exit strategies and termination rights (including contractual transition periods), plus independent monitoring and internal audit coverage that does not rely solely on CSP reports or certifications.

Keywords