Cloud contracts in financial services: regulatory issues to address

However, while the case for cloud adoption in financial services grows stronger, there are regulatory issues for firms to navigate when seeking to negotiate contracts with cloud computing providers, and other contracting considerations in relation to cloud service arrangements to carefully consider too.

The main regulatory issues to address in cloud contracts concern audit rights, subcontracting, data and security, and termination and exit.

Audit rights

The various regulatory rules to which UK financial institutions are subject require that both the financial institution itself and its regulator has rights to access and audit suppliers. These rights need to include the possibility of on-premises access.

In the early days of cloud contracts, this was a real problem area. Suppliers would push back hard on the right to go on-premises, arguing that this was not practical and would not be of any use to a financial institution anyway – “why do you want to look at a bunch of racks”? This might seem like a fair argument, but the regulatory rules require that rights of access are unrestricted – the “price” of outsourcing is that the financial institution can exercise appropriate oversight at its discretion.

From the perspective of financial institutions, these types of provisions are fine to incorporate in the contract – it is just important to ensure that they don’t cross the line into restricting the audit rights so that they cannot say they have “unrestricted” audit rights.

Subcontracting

The regulatory requirements around subcontracting do not sit easily with the cloud service provider model.

Where the subcontracting arrangement qualifies as a ‘material’ outsourcing then the financial institution needs to have a commitment from the cloud service provider to flow down certain contractual requirements to sub-contractors.

The obligation to comply with applicable law and the key contract provisions is a required provision to be flowed down, and this tends to be negotiable with cloud service providers. It is trickier, however, to flow down audit rights – many cloud service providers argue that this is not practical.

Fortunately, however, while many smaller software-as-a-service (SaaS) providers who rely on cloud infrastructure from the main cloud providers such as AWS or Microsoft tell us that they are not able to flow down audit rights, those cloud service providers do now provide regulatory-compliant audit rights. This means, institutions can often require the SaaS provider to secure an appropriate financial services addendum from its cloud provider and thereby meet the regulatory requirements.

Perhaps the biggest challenge in relation to subcontracting is the requirement for the financial institution to approve subcontractors. In large outsourcings, securing that right in the contract is usually fine, but in the commoditised world of SaaS it doesn’t work for the service provider – they will say that they have a one-to-many service and they cannot tolerate a position where one customer stops them using a subcontractor that they want to use for their overall service to customers.

In the UK, the Prudential Regulation Authority rules state that the financial institution must have the right to “object to” a material sub-outsourcing and/or terminate the contract where the sub-outsourcing would have adverse effect on the arrangement. SaaS providers will, therefore, argue that the regulations do not require a financial institution to have “approval” rights over subcontracting. Instead, they will agree to notify subcontracting to the financial institution and, if the financial institution objects, they will sometimes agree to discuss and try to resolve the situation, but failing that they offer the financial institution the option to terminate.

While this approach is compliant from a regulatory point of view in respect of the subcontracting requirements, it doesn’t particularly help in practice. This is because the financial institution faces being left without a solution because they are forced to terminate, which in turn will trigger other regulatory concerns around operational resilience and being able to maintain a service to customers. That also brings into focus provisions around exit assistance, discussed below.

In practice it seems unlikely that a major cloud service provider will engage a subcontractor that will cause such an adverse reaction to a financial institution – and the chances are that if one financial institution feels this way, others will too, which would be likely to encourage a rethink.

Data and security

In relation to data, there are a number of provisions in cloud contracts that financial institutions should focus on.

Regulatory provisions require that the financial institution is aware of the location of its data at all times. That applies where the data is at rest or in transit. There is a potential tension between cloud providers, keen to be able to be flexible in relation to where data is hosted and processed, and the increasing regulation around data location. Financial institutions need to make sure that the data location regulatory requirements they are subject to are reflected in their contracts with cloud service providers.

Often the contract will contain an agreed “zone” for the data which the service provider will agree to stay within, and the financial institution can then give permission for data to be hosted or processed within that zone.

Another important issue is data sovereignty – the right of the financial institution to control disclosure of and access to its data – in the cloud context, the financial institution needs to understand in what circumstances third parties may be able to require access to its data and to try to control that through the contract.