On 3 June 2020, the European Securities and Markets Authority (ESMA) issued a consultation paper on guidelines on outsourcing to cloud service providers.

The purpose of the draft guidelines is to provide guidance on the outsourcing requirements applicable to firms where they outsource to cloud service providers. The draft guidelines are intended to help firms identify, address and monitor the risks that may arise from their cloud outsourcing arrangements (from making the decision to outsource, selecting a cloud service provider, monitoring outsourced activities to providing for exit strategies).

When finalised ESMA will take the guidelines into account when assessing the extent to which (i) compliance with the relevant European Market Infrastructure Regulation (EMIR) requirements by a Tier 2 third-country central counterparty is satisfied by its compliance with comparable requirements in the third country pursuant to Article 25(2b)(a) of EMIR, and (ii) application of the relevant IOSCO principles by a third-country administrator of benchmarks seeking recognition is equivalent to compliance with the applicable requirements in the Benchmarks Regulation pursuant to Article 32(2) of the Benchmarks Regulation.

ESMA will consider the responses it receives to the consultation paper in Q3 2020 and expects to publish a final report and guidelines in Q4 2020/Q1 2021.

When finalised the guidelines will apply from 30 June 2021 to all cloud outsourcing arrangements entered into, renewed or amended on or after that date.