South Africa: Cloud in Financial Services

Under the new FSR Act and subject to a transitional period, all financial institutions are regulated by the following two main regulators:

• The Prudential Authority housed in the SARB will have the objective of maintaining and enhancing the financial safety and soundness of financial institutions; and
• The Financial Sector Conduct Authority will bear responsibility for market conduct regulation and supervision of financial institutions and the protection of customers.

Yes, cloud services are in principle permitted.Banks are expressly permitted to move to the cloud, provided that they comply with certain requirements.² While a move to cloud services is not outsourcing in the traditional sense, outsourcing regulations will also likely apply. For the outsourcing of certain functions and activities, a number of requirements must be fulfilled. In general, regulator approval is not required but prior notification to and/or approval by the regulator may be required for certain material functions and activities.³

Although cloud services are in principle permitted, specific aspects of the regulatory regime should always be carefully considered to ensure both cloud provider and cloud user compliance based on specific use cases and cloud architecture.

In relation to banks, the Prudential Authority has recently issued new rules which specifically permit banks to use cloud computing and to offshore data ("Cloud Rules").⁴ The Cloud Rules require each bank to adopt a principle-based and risk-based approach to cloud computing and data offshoring.
The Cloud Rules are designed to complement existing regulatory requirements and must be considered and observed in the context of a bank's overall legislative framework.

For a bank, its move to the cloud will therefore likely be regulated under:

• The Cloud Rules;⁵
• Outsourcing rules:⁶ Certain types of outsourcing are regulated, including outsourcing of material business activities or functions, and "offshoring";
• Cyber-resilience rules:⁸ A bank's cyber resilience will be reviewed against international best practice guidance⁹ for financial market infrastructures. This requires that a bank should implement appropriate risk-mitigation measures, either by means of outsourcing or third party agreements, or by internal resources which are available to it in-house without undue delay; and
• banker-client confidentiality: A bank must maintain client confidentiality in respect to customer information. Banking secrecy covers information relating to the customer's account, the customer's transactions with the bank, and information relating to the customer acquired through the keeping of his account. The duty to respect privacy and confidentiality is expressly recognised in the Code of Banking Practice.

For an insurer, Directive 159.A.i¹⁰ currently regulates outsourcing by long- and short-term insurers. With the advent of the FSR Act, it is expected that amended legislation and standards will regulate outsourcing.¹¹

Furthermore, as ‘accountable institutions’,¹² both banks and insurers must ensure that their ‘know-your-client records’ are retained on terms which permit them free and easy access to the records, and that the records are readily available to the relevant regulator.⁸ Such records may be kept in electronic form and must be capable of being reproduced in legible format.⁹

Under the current regime, a move to the cloud by a bank or insurer will be subject to the following key principles: (i) the financial institution remains responsible for the function (ii) the arrangement must not compromise the services provided to clients and (iii) the services must be regularly monitored.

While the new regime under the FSR Act has not yet been finalised, we expect similar rules to follow through to the new regime.

Generally, regulatory approval is not needed for a move to the cloud. However, if a move to the cloud amounts to outsourcing, then prior notification to and/or approval from the regulators may be required,depending largely on the materiality of the outsourced function or activity.¹⁹ A bank will be required to provide prior notification before it "offshores" any material²⁰ activity.²¹ Similar rules also apply to insurers. the Prudential Authority) has indicated that, while it does not support the outsourcing by a bank of certain material functions, it may consider granting approval on a case-by-case basis.²²

A bank outsourcing any material activity or function must be able at all times to provide the Registrar of Banks with necessary information and ensure the right of the Registrar of Banks to carry out its supervisory functions and objectives, including the right to access information and conduct on-site visits if the Registrar of Banks considers necessary.²³The Cloud Rules specifically require a bank to ensure that the use of cloud computing does not prevent any regulatory mandated access to information, nor impacts on a regulator's ability to fulfil its duties.²⁴

Similarly, an insurer outsourcing any control, management, or material function must appropriately assess, monitor, manage, and regularly review the performance of the outsourced service provider,²⁶ and ensure that it has continued access to information²⁷ and that the outsourced service provider permits the regulator access to its business and information relevant to the applicable function or activity.²⁸ Indications are that similar rules will follow through to the new regime.²⁹

The Cloud Rules impose no requirement for data to reside within South Africa. Instead, the Cloud Rules require a bank to implement a data strategy and governance framework, and to maintain an asset register of its information assets.³⁰ The bank should also consider the impact of different jurisdictions in light of the bank's data strategy and data governance framework, and the potential impact on the role of the supervisor and access to data.³¹ The bank should ensure that data is not held in jurisdictions that may inhibit effective access to data for the bank's South African supervisors.³²

Under the Protection of Personal Information Act (POPIA), personal information may be transferred out of SA provided the requirements of POPIA are met. POPIA³³ permits the transfer of personal information to a third party who is in a foreign country in specific circumstances, including if the recipient is subject to a law, binding corporate rules or binding agreement which provides an adequate level of protection as contemplated in POPIA or with the data subject's consent. Microsoft holds itself accountable to and is subject to laws of regions in which it maintains data centres, and has binding agreements which, in our view, provide adequate protection. In addition, Microsoft adheres to the EU Model Clauses as well as the EU Privacy Shield and the ISO 27018 Privacy Standard. Microsoft is also committed to ensuring compliance with the EU General Data Protection Regulation (GDPR) which came into force in May 2018.