APRA provides fresh guidance on cloud services

Introduction

The Australian Prudential Regulation Authority (APRA) has published an information paper¹ that sets out some of the prudential considerations and key principles that APRA-regulated entities should consider in the context of outsourcing arrangements involving "shared computing services", which include cloud services. In this legal update we review the information paper and highlight some of APRA's concerns on the use of cloud services by APRA-regulated entities, the first such guidance since 2010. Whilst APRA acknowledges that cloud services continue to evolve so they could potentially address the compliance requirements of regulated entities, it remains unconvinced that public cloud is suitable to host critical systems.