The DORA regulation (EU 2022/2554) has applied since 17 January 2025 and reshapes cloud governance in the European financial sector. Among other requirements, it mandates a formal exit strategy, a map of critical third-party providers and monitoring of concentration risk. French regulation aligns with it through the ACPR (cloud notice) and the AMF for market participants. The references cited are published in the Official Journal of the European Union and on acpr.banque-france.fr.
Who this framework is for
Systemic banks
- G-SIB or O-SII status: enhanced ECB and ACPR supervision.
- Cloud concentration risk monitored by prudential authorities.
- Documented exit strategy required by DORA for critical third-party providers.
Retail banks
- Customer data in an EU region, access logging.
- PCI DSS on the payment infrastructure.
- Operational continuity: short RTO for online banking and the mobile channel.
Insurers
- Solvency II: continuity, security and auditability of information systems.
- Actuarial data and health data (GDPR article 9) handled separately.
- Contractual portability and reversibility commitments.
Fintechs and neobanks
- E-money institution (EME) or payment institution (EP) licence issued by the ACPR.
- Cloud-native architecture, strong dependency on managed service providers.
- DORA pressure from banking partners on the subcontracting chain.
The applicable references
DORA (Digital Operational Resilience Act)
Regulation (EU) 2022/2554, applicable since 17 January 2025. Establishes a uniform digital operational resilience framework for the financial sector: ICT risk management, threat-led penetration testing, register of critical third-party providers, mandatory exit strategy and notification of major incidents.
EBA Guidelines on outsourcing
Guidelines EBA/GL/2019/02 on outsourcing by financial institutions, integrated into the prudential framework. They require a prior risk assessment, provider due diligence and strengthened contractual clauses for critical or important functions.
ACPR: cloud notice
ACPR notice on the use of cloud, published in 2019 and regularly updated. Governs data classification, location, audit rights and reversibility. Cross-referenced with the DINUM doctrine when the institution acts on behalf of the State.
MiFID II and data location
Directive (EU) 2014/65 and the MiFIR regulation: retention of electronic records and electronic communications for 5 to 7 years depending on the category. Location obligations are not explicit but interact with the GDPR and DORA regimes.
Four recurring situations
Core banking
Requirements
- Short RTO/RPO (often under 4h/15min) on vital information systems.
- Full audit (Tier 1) and right of physical inspection of data centres.
- Tested exit strategy: real ability to switch to another provider.
Candidate providers: EU providers with Tier III or IV data centres, ISO 27001 and ISAE 3402 certifications and a DORA commitment.
Regulatory reporting
Requirements
- WORM (Write Once Read Many) archiving of FINREP, COREP and AnaCredit reports.
- Cryptographic traceability of submissions.
- Multi-year retention without degradation.
Candidate providers: sovereign EU object storage with sealing, eIDAS qualified signatures and a location commitment.
Retention of logs and communications
Requirements
- 5 to 7-year retention of electronic communications (MiFID II).
- Indexing for rapid response to AMF or ACPR requests.
- Encryption at rest with customer-managed keys (BYOK or HYOK).
Candidate providers: EU storage with an indexing engine and an eIDAS-certified external HSM.
AI fraud detection
Requirements
- Models trained on pseudonymised data, raw data kept in an EU region.
- Explainability of decisions (GDPR article 22 for automated decisions).
- No transfer of data for training third-party models.
Candidate providers: EU AI platforms with a contractual commitment to data isolation and non-reuse.