Critical Cloud Outsourcing Treated as 'Just IT'
Calpe Bank Ltd is a small Gibraltar bank with £600m assets. It has outsourced its core banking platform, payment processing and customer authentication to a single cloud provider incorporated in a jurisdiction the GFSC does not regard as providing adequate data protection. The contract has no audit rights, no service-level credits, no exit plan, and permits the provider to subcontract to affiliates without notice. The bank's head of IT left four months ago; the interim head is a project manager with no operational resilience experience. The provider hosts data for 80,000 customers. A recent eight-hour outage prevented card payments and was not reported to the GFSC. The GFSC's supervisory team has asked for the bank's outsourcing register, a risk assessment and evidence of board oversight. The CEO says the arrangement is 'just IT' and that the board need not be involved. The next board meeting is in two weeks.
1. Assess the board's and CEO's position that the outsourcing is 'just IT'.
Read the worked answer
That position is wrong. Core banking, payment processing and customer authentication are critical functions. Outsourcing them does not transfer the bank's regulatory responsibility or the board's accountability. The board must own the third-party risk, operational resilience, data protection and customer harm implications. A material outsourcing arrangement requires due diligence, a written risk assessment, contractual safeguards, monitoring, business continuity and an exit plan. The GFSC expects the board to understand which functions are critical and how the bank would continue to operate if the provider failed.
The CEO's comment is itself evidence of a governance failure. The board should reject the 'just IT' framing, appoint a board-level owner for the arrangement, and require a report on the outage, the provider's jurisdiction, subcontracting and the missing exit plan. The interim head of IT also lacks the experience to assure the board, so independent technical support should be obtained.
2. Identify the contractual and regulatory gaps and explain what should be done about the provider's jurisdiction and subcontracting.
Read the worked answer
The contract lacks audit and access rights, service levels, exit assistance, data return, security commitments and controls over subcontracting. Those gaps prevent the bank from monitoring the service and from demonstrating regulatory oversight. The bank needs contract amendments or a replacement provider. Any amended contract should give the bank and, where appropriate, the GFSC access to information and premises, set service levels and remedies, require notification and approval of subcontractors, impose data protection and security terms, and provide termination and exit assistance.
The provider's jurisdiction raises data protection and regulatory access concerns. The bank should complete a transfer risk assessment, put in place lawful safeguards, and consider whether the GFSC would regard the jurisdiction as adequate. Subcontracting to affiliates without notice must stop. If the provider will not accept the necessary terms, the board should plan to replace it, with a staged migration and continuity safeguards.
3. What immediate steps should the bank take before the board meeting, including reporting the outage?
Read the worked answer
The bank should report the eight-hour outage to the GFSC now, explain its customer impact and the remedial action taken, and not wait for the board meeting. It should also notify the GFSC of the outsourcing arrangement and the supervisory gaps identified. The interim head of IT should be supported by an experienced operational resilience adviser, and the bank should compile the outsourcing register, a business impact analysis and a risk assessment for the provider.
Before the board meeting, management should test continuity arrangements, identify manual workarounds, review customer redress, and prepare an exit options paper. The board should establish a remediation plan with deadlines: contract renegotiation, independent assurance, data protection review, subcontracting controls and a tested exit plan. The board minutes should record that the arrangement is material and that the board, not only management, is accountable. If the provider cannot be brought up to standard quickly, the board should approve a migration plan.