A bank or insurer running core services in the public cloud answers to several supervisors at once, and each one frames cloud as outsourcing or third-party risk with its own vocabulary, registers, notification triggers and contract clauses. In the EU, DORA now governs ICT services including cloud while the EBA has finalised revised third-party risk guidelines for non-ICT services; the UK PRA applies SS2/21; Australia's APRA applies CPS 230; Singapore's MAS applies Notice 658 and its banks' outsourcing guidelines; and US federal banking agencies apply their 2023 interagency third-party guidance. This map lines up what each expects for cloud arrangements: scope, materiality, registers, notification, contract terms, audit access and exit. It is for cloud programme leads, third-party risk and procurement teams, CISOs and compliance staff at regulated firms and the cloud and SaaS suppliers that serve them. Status as checked on 12 November 2026; confirm against each regulator's current publication before acting. This page summarises regulator publications and secondary readings of them. Confirm against the official text before relying on it.
Key takeaways
- Materiality drives everything. Each regime reserves its heaviest requirements for cloud services supporting critical or important functions (DORA, EBA), material outsourcing (PRA), material service providers (APRA), outsourced relevant services (MAS) or critical activities (US agencies).
- Registers are mandatory in most regimes. DORA Article 28(3) requires a register of all ICT contractual arrangements, APRA set 1 October 2025 for the first material service provider register, and MAS publishes an outsourcing register template with Notice 658.
- Audit rights must reach the cloud provider. DORA Article 30(3)(e) requires unrestricted rights of access, inspection and audit for the firm and its supervisor on critical or important functions; the US guidance lists the right to audit and require remediation among contract provisions.
- Exit plans must be tested, not written once. DORA Article 28(8) requires documented, sufficiently tested and periodically reviewed exit strategies, and the PRA treats business continuity and exit (SS2/21 Chapter 10) as going beyond the EBA baseline.
- Several regimes are moving in 2026 and 2027. APRA's CPS 230 amendments commence on 1 July 2026, the PRA's revised SS2/21 takes effect on 18 March 2027, and the EBA published final guidelines on third-party risk management for non-ICT services on 18 September 2026, with a two-year transitional period.
Regulations and frameworks at a glance
| Instrument | Jurisdiction | Who it covers | Status as checked 12 November 2026 |
|---|---|---|---|
| EBA Guidelines on outsourcing arrangements (2019) and draft guidelines on third-party risk management for non-ICT services | EU | Institutions within the EBA's remit | On 8 July 2025 the EBA consulted (to 8 October 2025) on draft guidelines that revise and update the 2019 guidelines for non-ICT services; final guidelines published 18 September 2026, pending translation, with a two-year transitional period (EBA) |
| PRA Supervisory Statement SS2/21 Outsourcing and third party risk management | UK | Banks, building societies, PRA-designated investment firms, Solvency II insurers and reinsurers including Lloyd's, third-country branches | Effective since 31 March 2022; current version effective 31 December 2024; revised version published 18 March 2026, effective 18 March 2027 |
| DORA, Regulation (EU) 2022/2554, Articles 28 to 30 | EU | Financial entities in scope of DORA, and their ICT third-party service providers | Applies since 17 January 2025 |
| APRA Prudential Standard CPS 230 Operational Risk Management | Australia | APRA-regulated entities (banks, insurers, superannuation) | Effective 1 July 2025; pre-existing contracts by the earlier of renewal or 1 July 2026; amendments commence 1 July 2026 |
| MAS Notice 658 Management of Outsourced Relevant Services and Guidelines on Outsourcing (Banks) | Singapore | Full and wholesale banks (Notice 658); banks and merchant banks (Guidelines) | Notice 658 effective 11 December 2024; the earlier Guidelines on Outsourcing remained in effect until 10 December 2024 |
| Interagency Guidance on Third-Party Relationships: Risk Management | US | Banking organisations supervised by the OCC, Federal Reserve and FDIC | Issued 6 June 2023; rescinded OCC Bulletins 2013-29 and 2020-10 |
The wider cyber regulation picture for financial services is in the Financial Services Cyber Regulation Map; this page covers cloud and outsourcing expectations only.
Scope and materiality
Every regime asks the firm to classify the cloud arrangement first. The label differs, but the test is broadly whether failure of the service would materially affect the firm, its customers or its regulatory compliance.
| Regime | Term for the highest tier | What the regulator emphasises |
|---|---|---|
| DORA | ICT services supporting critical or important functions | Pre-contract assessment of whether the service supports such a function, including ICT concentration risk under Article 29 (Article 28(4)) |
| EBA (non-ICT) | Critical or important functions | Draft guidelines focus on critical or important functions and aim for consistency with DORA where possible |
| PRA SS2/21 | Material outsourcing | Links outsourcing to operational resilience and supports adoption of cloud and other new technologies |
| APRA CPS 230 | Material service providers | Material service providers are listed in the MSP register (paragraph 51) and new or changed material arrangements are notified (paragraph 59) |
| MAS Notice 658 | Outsourced relevant services | Requirements banks must comply with to manage outsourcing risks, backed by Banking Act section 47A |
| US interagency guidance | Critical activities | Each bank decides which activities are critical: those that could cause significant risk if the third party fails, significantly affect customers, or significantly affect financial condition or operations |
- Classify by function, not provider: the same cloud platform can host a critical payments service and a non-critical analytics sandbox. Classify each arrangement or workload, not the vendor as a whole.
- Re-classify on change: DORA Article 28(3) asks firms to inform the authority when a function becomes critical or important, so a pilot that grows into production changes the obligations.
- Proportionality: the US guidance states that not all third-party relationships present the same level of risk or criticality, and DORA exempts microenterprises from parts of Article 28. Smaller firms should still classify, but can scale depth of due diligence and monitoring.
Registers and notification
| Regime | Register | Notification to the regulator |
|---|---|---|
| DORA | Register of information on all ICT contractual arrangements at entity, sub-consolidated and consolidated level, distinguishing critical or important functions (Article 28(3)) | At least yearly reporting on new arrangements; timely notice of planned contracts for critical or important functions |
| EBA (non-ICT) | Firms may use a single register for ICT and non-ICT services | As set out in the final guidelines (published 18 September 2026) |
| PRA SS2/21 | Set out in SS2/21; the version effective 18 March 2027 adds the operational incident and third-party reporting changes | Revised third-party reporting from 18 March 2027 following PS7/26 |
| APRA CPS 230 | Material service provider register; first completed registers were due by 1 October 2025 (paragraph 51) | Notification of new or materially changed material arrangements and offshoring (paragraph 59) |
| MAS | Outsourcing register using the MAS template (version 1.1 published with Notice 658) | As set out in Notice 658 and the MAS FAQ on Notices 658 and 1121 |
| US interagency guidance | Oversight across the relationship life cycle, scaled to risk and criticality | Regulatory Supervision is one of the contract subjects the guidance lists |
DORA register mechanics are covered in depth in the DORA Register of Information Guide, and APRA's regime in the APRA CPS 230 Operational Risk Management Guide.
Contract terms regulators expect
Contract expectations converge on the same subjects. DORA is the most prescriptive, so many global firms use Article 30 as the template and add local terms.
| Subject | DORA Article 30 | US interagency guidance heading | Other regimes |
|---|---|---|---|
| Service description and subcontracting | 30(2)(a): full description; whether subcontracting of critical functions is allowed and on what conditions | Nature and Scope of Arrangement; Subcontracting | Check each local text |
| Data location | 30(2)(b): regions or countries of service and data processing, with advance notice of changes | Foreign-Based Third Parties | APRA requires notification of offshoring |
| Data security and return | 30(2)(c) and (d): availability, authenticity, integrity, confidentiality; access, recovery and return of data on insolvency or termination | Confidentiality and Integrity; Responsibilities for Providing, Receiving, and Retaining Information | PRA SS2/21 Chapter 7 on data security goes beyond the EBA baseline |
| Service levels and incidents | 30(2)(e) and (f); 30(3)(a) precise quantitative and qualitative targets | Performance Measures or Benchmarks | APRA links service providers to critical operation tolerances |
| Audit and access | 30(3)(e): unrestricted rights of access, inspection and audit for the firm, an appointed third party and the competent authority | The Right To Audit and Require Remediation; Regulatory Supervision | Check each local text |
| Business continuity and testing | 30(3)(c) provider BCPs; 30(3)(d) participation in threat-led penetration testing | Operational Resilience and Business Continuity | PRA SS2/21 Chapter 10 |
| Termination and exit | 30(2)(h) termination rights and notice periods; 30(3)(f) exit strategies with a mandatory transition period | Default and Termination | PRA SS2/21 Chapter 10 |
- Pooled audits and certifications: DORA Article 30(3)(e)(ii) allows alternative assurance levels where other clients' rights would be affected, and the US agencies note that firms may use collaborative arrangements or external parties to supplement monitoring. Pooled audits and independent reports help, but the contractual right must still exist.
- Microenterprises: under DORA a microenterprise may agree that audit rights are delegated to an independent third party appointed by the provider, while keeping the right to request information from it.
Clause-level detail is in the DORA Article 30 Contractual Provisions Guide.
Exit, concentration and resilience
- DORA: Article 28(8) requires exit strategies for ICT services supporting critical or important functions that account for provider failure, service deterioration, disruption or termination; plans must be documented, sufficiently tested and periodically reviewed, with alternative solutions and transition plans identified. Article 29 brings ICT concentration risk into the pre-contract assessment.
- PRA: SS2/21 places business continuity and exit plans in Chapter 10, one of two chapters the PRA identifies as going beyond the EBA guidelines, and sits alongside the UK operational resilience regime.
- APRA: CPS 230 ties service provider management to critical operations and tolerance levels, with notification of tolerance breaches (paragraph 42).
- US: the interagency guidance gives termination its own life cycle stage alongside planning, due diligence, contract negotiation and ongoing monitoring.
- Direct oversight of providers: under DORA, critical ICT third-party providers are now overseen directly. See the DORA CTPP Oversight Guide, and for exit planning the Cloud Concentration Risk and Exit Strategy Guide.
Where identity and access fit
None of these instruments is an identity standard, but supervisors test cloud arrangements through access evidence. Cloud administrative roles, federation trusts, workload identities, API keys and provider support access are the paths through which a cloud arrangement can fail.
- Data security clauses need identity evidence: DORA Article 30(2)(c) confidentiality and PRA SS2/21 Chapter 7 data security are demonstrated through who holds administrative access to the tenant, how keys are managed and how provider support access is approved and logged.
- Exit includes identities and keys: a tested exit must move or recreate federation, workload identities, secrets and encryption keys, not just data. The Cloud Exit Plan Template includes these.
- Registers should list integrations: SaaS and cloud services connected through OAuth grants and service principals are ICT arrangements too, and often missing from registers.
Measuring compliance
- Register completeness: share of cloud and SaaS arrangements found in spend, network and OAuth data that appear in the register.
- Contract coverage: share of critical or important cloud contracts with audit, data location, subcontracting and exit transition terms in place.
- Exit test coverage: critical cloud services with an exit test in the last 12 months.
- Notification timeliness: regulator notifications and register submissions made by their deadlines.
- Provider access reviews: provider support and administrative access reviewed on schedule.
Compliance steps
- Build one control set: map DORA Article 28 to 30, SS2/21, CPS 230, Notice 658 and the US guidance into one requirement list, using the most demanding wording where they overlap.
- Classify every cloud arrangement: apply each regime's materiality test per workload and record the result in the register.
- Remediate contracts: gap-assess cloud agreements against the contract table above; prioritise audit and access rights, data location, subcontracting and exit transition periods.
- Submit registers and notifications on time: diary DORA reporting, APRA register updates and PRA reporting changes from March 2027.
- Test exit: run a desk-based exit test first, then a technical test for at least one critical service, and record evidence for supervisors.
- Monitor and re-classify: review classifications when services change, and track regulatory changes (EBA final guidelines and their transitional period, APRA amendments from 1 July 2026, PRA SS2/21 from 18 March 2027).
Common failure patterns
- Classifying the vendor, not the service: one cloud contract covers critical and non-critical workloads, and the register shows only the lower tier.
- Standard terms accepted: click-through cloud terms without the audit, data location or exit transition provisions regulators expect.
- Paper exit plans: exit strategies that have never been tested, contrary to DORA Article 28(8).
- Shadow SaaS missing from registers: business-led SaaS connected through OAuth integrations never reaches procurement or the register.
- Late re-classification: a pilot becomes critical without notifying the regulator or upgrading the contract.
Practitioner checklist
- Maintain one register of cloud and ICT arrangements that satisfies DORA, APRA, PRA and MAS formats.
- Record the materiality classification and rationale per workload.
- Confirm audit, inspection and supervisor access rights in every critical cloud contract.
- Record data processing locations and require advance notice of changes.
- Test at least one critical cloud exit plan each year, including identities and keys.
- Diary 1 July 2026 (APRA amendments) and 18 March 2027 (PRA SS2/21 revision).
- Check the EBA's final non-ICT third-party guidelines and update group policy.
- Include OAuth-connected SaaS and provider support access in third-party reviews.
Standards and references
- EUR-Lex: Regulation (EU) 2022/2554 (DORA)
- EBA: Final guidelines on third-party risk management (18 September 2026)
- EBA: Consultation on draft Guidelines on third-party risk management for non-ICT services
- Bank of England PRA: SS2/21 Outsourcing and third party risk management
- APRA: Operational risk management (CPS 230)
- MAS: Notice 658 Management of Outsourced Relevant Services
- Federal Register: Interagency Guidance on Third-Party Relationships: Risk Management
- OCC: Bulletin 2023-17 Third-Party Relationships
Related NHI Mgmt Group resources: Financial Services Cyber Regulation Map · DORA Article 30 Contractual Provisions Guide · Cloud Concentration Risk and Exit Strategy Guide · APRA CPS 230 Operational Risk Management Guide · Third-Party Risk Management Guide. This guide summarises financial regulators' cloud outsourcing expectations and is not legal advice.