KYC Cloud Subcontracting and the 'Non-Material' Label
A Hong Kong-incorporated bank stores scanned KYC documents for 1.2 million customers with a cloud provider in Singapore. The outsourcing register classifies the arrangement as non-material because no customer-facing service depends on it. The provider subcontracted storage to a second provider in Australia without notifying the bank. A security researcher reports that a misconfigured storage bucket exposed about 1,200 scanned identity documents for 36 hours. The provider told the bank five days after discovery; the contract requires notification within 48 hours. The bank's KYC records are the evidence base for its AML/CFT obligations and cannot be reconstructed quickly if lost. The vendor contract has no audit rights over subcontractors and no data-residency clause. The head of procurement wants to renew for three years at a 20% discount; compliance wants to terminate immediately; the CRO must decide within 10 working days, before the current contract expires.
1. Was the 'non-material' classification defensible? Set out the test you would apply and your conclusion.
Read the worked answer
The 'non-material' label fails the criticality test. Criticality is not about whether customers touch the service directly; it is about the impact if the activity fails or data is compromised, the bank's dependence on it, substitutability, and regulatory consequence. KYC documents are the evidence base for AML/CFT obligations, record-keeping and STRs; if they are unavailable, corrupted or disclosed, the bank faces compliance and reputational harm that no customer-facing outage is needed to produce.
The data is sensitive identity data, and the provider's undisclosed subcontracting means the bank does not know where it is stored. The arrangement should be reclassified as material/critical, the register corrected, and the outsourcing risk reassessed. Practical conclusion: the classification was not defensible. The absence of a customer-facing dependency is irrelevant. The failure also exposes a contract-governance gap: no audit rights over subcontractors and no data-residency clause means the bank cannot evidence control to its regulator or its own board.
2. What notifications, contractual remedies and remediation would you require before any renewal?
Read the worked answer
Notifications: inform HKMA promptly, since the activity is critical and a data breach has occurred; assess PCPD and customer notification under the bank's policy and PCPD guidance; notify the data protection officer and fraud team. Contractual remedies: require the provider's forensic root-cause analysis, a subcontractor inventory, audit rights extending to subcontractors, data-residency and access-control commitments, a 24-hour breach notification clause, termination for cause, indemnity and security certification.
Before renewal: independent validation that the exposed bucket is closed; evidence that other buckets and identities are secured; a data-flow map; confirmation that no data was exfiltrated; and a right to audit. The 20% discount is irrelevant to the risk decision. If the provider will not accept audit rights and subcontractor approval, do not renew for three years; use a short bridge extension while migrating. The CRO should document the decision against the outsourcing policy and record the residual risk and its owner.
3. What would a credible exit plan need to show, and what would make you reject immediate termination?
Read the worked answer
A credible exit plan must show: a complete data inventory and extraction in a machine-readable format; deletion certification from both providers; a tested migration to an alternative provider or in-house; parallel running; records-retention compliance; cost and timeline; customer and AML impact; regulatory communication; and a named owner. It should also show how the bank will avoid recreating the same concentration risk.
Immediate termination should be rejected because unavailability of KYC records may itself breach AML record-keeping requirements and disrupt onboarding and STRs; termination without a migration path converts a confidentiality incident into an availability and compliance incident. That does not make renewal safe. The right decision is a short bridge extension with enhanced controls and a migration plan, not a three-year renewal and not immediate termination. The exit plan should be tested, not just documented, and the board should see the residual dependency until migration completes.