Cloud Compliance

Cloud compliance refers to meeting all regulatory requirements, security standards, and data protection regulations when using cloud services. For banks and financial institutions, it is particularly critical because BaFin imposes strict requirements on cloud usage. Under Section 25b of the German Banking Act and MaRisk requirements, financial institutions must conduct comprehensive risk analyses for cloud outsourcing, ensure audit rights, and maintain exit strategies. Since January 2025, DORA has further tightened these requirements with mandatory ICT third-party risk management. A professional cloud compliance strategy protects against regulatory sanctions and creates the foundation for secure cloud transformation.

BaFin sets concrete requirements for cloud usage through several regulatory frameworks: MaRisk (AT 9) governs outsourcing management and requires risk analysis before any cloud outsourcing. The BaFin guidance note on cloud services demands a materiality assessment, contractual audit rights, data localization, and a documented exit strategy. BAIT and DORA supplement these with IT governance, information security, and operational resilience requirements. Since March 2026, financial institutions must also submit their ICT third-party provider register in xBRL-CSV format to BaFin. ADVISORI supports you in fully implementing all BaFin requirements.

ADVISORI guides financial institutions through the complete implementation of DORA requirements for cloud environments. This includes establishing an ICT risk management framework under Articles 6–16 DORA, implementing incident reporting processes, creating and maintaining the ICT third-party provider register, and conducting Threat-Led Penetration Testing (TLPT). We develop cloud governance structures that cover both DORA Articles 28–30 on third-party management and existing BaFin MaRisk requirements. We rely on automated compliance monitoring and establish processes for regular review of cloud provider compliance.

BSI C

5 (Cloud Computing Compliance Criteria Catalogue) is the German standard for cloud security with

121 controls across

17 requirement areas. BaFin explicitly references C

5 as suitable evidence for the security of cloud outsourcing arrangements. Financial institutions need a C

5 Type

2 attestation when using cloud services for regulated business processes — BaFin expects proof of the ongoing effectiveness of security measures over at least six months. ADVISORI supports gap analysis, C

5 audit preparation, and selection of C5-certified cloud providers.

The EBA Guidelines on Outsourcing (EBA/GL/2019/02) provide the European framework for cloud outsourcing in the financial sector. They require an assessment of whether a cloud outsourcing arrangement is critical or important, and set comprehensive requirements for due diligence, contract design, monitoring, and exit planning. BaFin has fully adopted these guidelines. For financial institutions this means: every cloud usage must be systematically assessed, contractually secured, and continuously monitored. ADVISORI develops EBA-compliant cloud outsourcing frameworks that meet both European and national requirements.

Multi-cloud strategies in regulated environments require unified governance across all cloud providers. ADVISORI implements cloud-agnostic governance frameworks with centralized policy management, unified monitoring, and consolidated compliance reporting. This includes harmonizing security policies across AWS, Azure, and Google Cloud, automated policy enforcement via Infrastructure-as-Code, integrated dashboards for cross-provider compliance monitoring, and systematic vendor risk assessment per BaFin MaRisk and DORA requirements. This ensures all cloud environments consistently meet regulatory requirements.

A cloud compliance roadmap for banks typically encompasses five phases: (1) Cloud readiness assessment with gap analysis against BaFin, DORA, and EBA requirements, (2) Development of the cloud governance framework with policies, roles, and processes, (3) Implementation of technical controls including security architecture, monitoring, and BSI C5-compliant measures, (4) Vendor management setup with due diligence, SLA governance, and ICT third-party register, (5) Continuous compliance with automated monitoring, regular audits, and regulatory reporting. ADVISORI guides every step and tailors the roadmap to your specific situation and cloud strategy.