The Cloud Migration That Compliance Has Not Seen
A licensed commercial bank, Senaya Bank, plans to move its KYC document archive and transaction-monitoring platform to a cloud vendor. The vendor will store data in two data centres, one in the bank's home country and one overseas. The draft contract auto-renews for five years, gives the bank no right to audit the vendor, permits sub-outsourcing without approval, and requires the vendor to notify breaches within 10 days. The vendor suffered a ransomware incident eight months ago that it disclosed only after a customer complaint. The bank's regulator requires prior notification of material outsourcing arrangements and approval of data-location changes. The project sponsor says the migration will save 30% of operating cost and must go live in six weeks. Compliance has not been asked to sign off; the IT manager says 'security is an IT issue'. The bank serves 1.2 million retail customers and holds sensitive KYC files.
1. Assess the outsourcing, data protection and governance risks. Can compliance sign off on the current proposal?
Read the worked answer
Risk assessment
This is a material outsourcing arrangement. The bank is transferring KYC files and transaction-monitoring data, which are core compliance records and sensitive personal data. The risks include data location and cross-border transfer, loss of audit access, uncontrolled sub-outsourcing, weak breach notification, vendor concentration, and the vendor's undisclosed ransomware incident. The proposed contract does not meet basic outsourcing standards: no audit right, no approval for sub-processors, a 10-day breach notification, and automatic five-year renewal. The statement that security is an IT issue is wrong; the board and compliance own the risk.
Can compliance sign off?
Not on the current terms. Compliance should withhold sign-off and escalate to the board or outsourcing committee. Before go-live the bank needs a documented due diligence, a data protection impact assessment, confirmation that the regulator has been notified and any approval obtained, and a contract with audit and access rights, sub-processor approval, breach notification, data-localisation commitments, service levels and termination assistance. An exit plan and tested backups are essential. The 30% saving and six-week deadline are commercial pressures, not risk mitigants.
2. Set out the conditions the bank should require before go-live, including contract terms, regulatory steps and exit planning.
Read the worked answer
Contract and controls
The bank should require: identification of all data locations and sub-processors, with prior approval for changes; a right to audit and to obtain independent assurance reports; breach notification within a short, defined period and cooperation with regulatory reporting; security controls, encryption and access management proportionate to KYC data; clear ownership of data and return or deletion on exit; a tested exit plan and transition assistance; business continuity and incident response arrangements; and service levels with remedies. The vendor's prior ransomware incident must be explained and assessed, not accepted because it was disclosed late.
Regulatory and governance steps
The bank must notify the regulator before the material outsourcing and obtain approval for the overseas data location. The board should approve the arrangement after receiving the risk assessment and the compliance opinion. Compliance should have ongoing monitoring rights and a seat in the governance forum. The exit plan should identify an alternative provider or in-house fallback, data retrieval formats and maximum transition time. If the contract cannot be amended and the regulatory approvals obtained in time, the migration should be delayed. IT security is part of the control environment, but accountability for customer data and regulatory compliance remains with the bank.