Achieve compliance while reaping the benefits of the cloud

With consumer behaviour changing, companies need to adapt fast. We see this need in all sectors, including banking. However, being a highly regulated industry can slow down the innovation process. So, how do you stay compliant and address customer needs simultaneously?

For the European Union, the European Banking Authority (EBA)1 issued a set of recommendations for banks in December 2017. The recommendations shed some light on the controls needed to ensure compliance and provided a regulatory convergence for banks in the EU in relation to the cloud. With this guidance, it is now clear to banks and Cloud Service Providers on how to achieve compliance while reaping the benefits of the cloud.

Banks benefit from using IBM Cloud to stay compliant in a number of ways

The first way that banks can benefit from using IBM Cloud is through our expertise around financial compliance. Promontory Financial Group, an IBM Company, is helping clients resolve critical issues, particularly those with a regulatory dimension. Promontory professionals have unparalleled regulatory experience and insight and provide our clients with frank, proactive advice informed by best practices and regulatory expectations.

Second, to help banks take a risk-based approach when deploying to IBM Cloud, we clearly document the technical and organizational measures we take around data security and privacy. These are defined for IBM Cloud in the Data Security and Privacy principles and additional specifics are covered in each IBM Cloud Service Data Sheet. Moreover, these two documents also define the business continuity plan and the data hosting and data processing locations each service uses. All this information is publicly available, simplifying the risk assessment process. If you need additional security for a workload, IBM can provide you with the extra bit.

These security measures are accompanied by independent third-party certifications, showing IBM Cloud compliance with globally accepted standards. For the specific audit and access rights required by the EBA recommendations, we developed a “Cloud Addendum for Financial Services,” which describes the process in detail.

Finally, and to help further with risk assessment, we give our customers the option to exit an IBM Cloud service if we make changes that cannot be accepted for legal reasons. Moreover, we shall provide customers assistance to transfer the service to another cloud provider or to on-premise if they prefer.

In summary, IBM Cloud certifications and the additional information we offer help banks make a decision when outsourcing to IBM Cloud so that the client’s required measures are in place to comply with regulations.

To learn more, read how IBM supports banks and helps them stay compliant with the European Banking Authority recommendations on cloud computing.