Mauritius: Cloud in Financial Services

The banking sector in Mauritius is regulated by the Bank of Mauritius ("Central Bank”) whose principal representative is the Governor.

The Financial Services Commission ensures the sound conduct of business in the financial services sector and in the global business sector. It has responsibility for institutions other than banks, such as insurers, pension funds, collective investment schemes and payment intermediary services.

Cloud services are in principle permitted. Financial institutions must however perform the requisite due diligence and apply sound governance and risk management practices when moving to the cloud.³

With regards to banking services, the Central Bank permits the use of cloud services for non-core banking activities. According to the Guidelines, activities that are considered ‘core’ and should not be outsourced are: (i) board and senior management functions such as strategic oversight, (ii) internal audit function, and compliance function. However, exceptions for certain intra-group outsourcing of core banking activities may be allowed. The Central Bank will consider this on a case-by-case basis. Financial institutions which intend to outsource these core banking activities must seek the prior authorization of the Central Bank.

That said, the Guidelines also state that the use of cloud-based services for banking activities is “a form of outsourcing”⁴. Where a bank provides computer access to its customers, it must provide such security for their internet and proprietary platforms as the Central Bank considers adequate.⁵

While cloud services are in principle permitted, specific aspects of the regulatory regime should always be carefully considered to ensure both cloud provider and cloud user compliance based on specific use cases and cloud architecture.

There is presently no specific law governing cloud services in Mauritius. For financial institutions there are, however, the "Guidelines on Outsourcing by Financial Institutions", issued by the Central Bank.⁶ In the insurance sector, insurers which provide services over the Internet must implement and maintain appropriate mechanisms to address security concerns relating to the confidentiality of personal information transmitted between the consumer and the insurer. In addition, insurers must also ensure that there are business continuity arrangements at all times to avoid business disruptions and to ensure availability of their platform.⁷

In addition to the above Guidelines, a bank must maintain client confidentiality in respect of customer information. The duty of confidentiality covers any information relating to the affairs of the customers, including any deposits, borrowings, or transactions or other personal, financial or business affairs.

Under the current regime, a move to the cloud by a bank will be subject to the following key principles:

• the financial institution remains responsible and accountable for maintaining oversight of cloud-based services and managing the risks of adopting cloud-based services, as in any other form of outsourcing arrangement;
• the financial institution must have recourse to private or hybrid clouds for hosting applications with "sensitive data"⁸, and under no circumstances should data be stored on personal, free or community-based cloud storage services;
• the financial institution must ensure that data on the cloud and the channel to access them are encrypted;
• the cloud service provider should have a proven track record of at least 3 years;
• the financial institution must obtain the consent of their clients for their information to be stored on the cloud in specified jurisdictions;
• the financial institution must include a clause in its agreement with the cloud service provider, authorising the bank or any firm authorized by the bank to carry out examinations at the cloud servers/data centres, at any time; and
• there must be a proper exit mechanism in place to provide for the deletion of all data stored on the cloud servers, in the event that the financial institution switches to another service provider or stops the service for any other reason. This arrangement should be included in the contract with the cloud service provider.

Approval of the regulator is, in principle, not needed. However, a financial institution that intends to outsource a material activity is required to notify and obtain the prior authorization of the Central Bank. The "Guidelines on Outsourcing by Financial Institutions" define material outsourcing as the outsourcing of "an activity of such importance that any weakness or failure in the provision of this activity could have a significant impact on the financial institution’s ability to meet its regulatory responsibilities and/or to continue in business".

A financial institution intending to outsource non-material activities does not need to seek the prior authorization of the Central Bank, provided the activities do not require approval or authorization under the Banking Act.

A bank engaging in any material outsourcing⁹ must be able at all times to provide the Central Bank with specified necessary information and ensure the right of the Central Bank to carry out its supervisory functions and objectives, including the right to access information and on-site visits if the Central Bank considers necessary. The contract between the financial institution and the cloud service provider must explicitly allow for on-site visits and unhindered inspections of the outsourced activities by the financial institution and the Central Bank.

Customer information which constitutes personal data may be transferred to another country in specific circumstances. Permitted circumstances include where: (i) the Data Protection Commissioner (“Commissioner”) has been provided proof of appropriate safeguards with respect to the protection of the personal data; (ii) the data subject has given explicit consent to the proposed transfer (after having been informed of the possible risks of the transfer owing to the absence of appropriate safeguards, if any); and (iii) the transfer is necessary, for example, for the performance of a contract between the data subject and the data controller, or for the conclusion or performance of a contract between the data controller and another person in the interest of the data subject.¹⁰

Microsoft holds itself accountable to and is subject to laws of general application applicable to information technology service providers, and has binding agreements which, in its view, will likely constitute adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring that its products and services comply with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.