Policy Resource

GFMA Publishes White Paper on Public Cloud Portability

Financial Institutions’ (FIs’) growing reliance on cloud services has raised concerns about concentration risk and financial stability.   To address this, regulators are considering mandating portability of data and services between cloud providers.  However, this paper details why portability – or any other resiliency solutions – should not be prescribed, and that regulators should take a risk-based approach.

Instead of mandating portability, GFMA recommends regulators adopt a risk-based approach, allowing FIs to use portability as one of several tools, tailored to FIs’ specific needs and risk profiles.

This paper provides key details and background regarding cloud services resilience solutions.  This includes details regarding portability and the cloud regulatory landscape.

Based upon these details, the paper lays out the following recommendations:

• Adopt a Principles-Based Regulatory Approach: Allow FIs to tailor resilience strategies based on their specific operational needs and risk profiles, rather than prescribing uniform technical measures.
• Consider Portability for Targeted Use Cases: Portability may be considered where it adds demonstrable value, such as for high-risk or mission-critical applications.
• Promote Collaborative Innovation: Support industry collaboration to establish standards and best practices that enhance flexibility and resilience without stifling innovation.
• Prioritize Transparency and Preparedness: Emphasize the importance of transparent resiliency strategies and regular testing, ensuring institutions are well-prepared for disruptions without mandating specific technical solutions.

– 17 March 2025 –

---

Download PDF: