On 30 September 2025, the European Securities and Markets Authority (ESMA) issued the official EU translations of the guidelines on outsourcing to cloud service providers by depositaries under the Alternative Investment Fund Managers Directive and the UCITS Directive that are not subject to the Regulation on digital operational resilience for the financial sector.

The guidelines apply from 30 September 2025 to all cloud outsourcing arrangements entered into, renewed or amended on or after this date.

Within two months, Member State competent authorities must notify ESMA whether they (i) comply, (ii) do not comply, but intend to comply, or (iii) do not comply and do not intend to comply with the guidelines.