A firm migrates its trading server and client database to a cloud region in another country over a weekend, tells nobody, and then finds the question on its next supervisory return. The migration was fine. The silence was the problem.
Cloud use by regulated firms is not restricted in most jurisdictions. It is conditioned. Supervisors have converged on a set of expectations: know what you have put in the cloud, classify it, keep contractual rights to inspect and to leave, know where the data sits, and tell the regulator when the arrangement is material.
When notification is expected
The trigger is normally criticality rather than technology. If the cloud arrangement supports a function classified as critical or important, the heavier duties apply, and in several regimes that includes prior notification to the supervisor. Hosting a marketing site is not the same decision as hosting the order book and the client ledger.
Some regimes require notification before entering the arrangement, some on a periodic register submission, and some only on request during supervision. A few operate a prior approval model for specific activities. That variation is exactly why this cannot be answered generically, and why the question belongs in the authorisation conversation rather than in the sprint planning.
What is consistent is that supervisors expect to be told about material changes too: a move to a new region, a change of provider, a significant change in the sub-outsourcing chain, or a shift in what data leaves the country.
What the notification contains
Where a form exists it tends to ask for the same information the outsourcing register already holds, which is the practical argument for building the register first. Provider identity and group, the function being outsourced, the criticality classification with reasoning, the countries where services are performed and data is stored, sub-outsourcing arrangements, the risk assessment performed, the audit and access provisions in the contract, and the exit strategy.
The reasoning section carries more weight than founders expect. A supervisor is assessing whether the firm understood what it was doing, not whether the provider is reputable. A notification that describes a provider's certifications at length and says nothing about the firm's own assessment reads as a purchase, not a decision.
Audit and access rights, the clause that gets skipped
Supervisory guidance across several regimes expects the firm and the regulator to have effective access to information about the outsourced function, and effective rights of audit or inspection, including where feasible physical access. Standard cloud terms address this through published certifications, pooled audits and reporting, and the acceptability of that varies by regulator and by criticality.
The failure case is a firm that signs consumer grade terms for a production trading system and later cannot demonstrate any access right at all. Contracting properly means reading the enterprise terms, understanding which addenda apply, and recording the answer in the register alongside the fields listed in keeping an outsourcing register.
Notification triggers, forms and deadlines differ substantially between regulators, and some require prior notification while others do not. Nothing here tells you what applies to your licence. Confirm the requirement with counsel or a compliance consultant in your jurisdiction before you migrate.
Data location is a separate question
Where the workload runs and where personal data is processed are related but not identical, and both get asked about. Trading firms hold identity documents, proof of address, payment instruments and transaction history, which is a heavy personal data set. The transfer analysis under privacy law sits beside the outsourcing analysis, and neither substitutes for the other. The privacy side is covered in GDPR for trading firms, the residency side in data residency rules.
Some regimes add localisation expectations for specific record types, or require that records remain accessible from the licensed entity's home country within a defined period. Those requirements shape the architecture, so they belong in the design conversation rather than in a review after go live.
Exit is part of the entry decision
The last section of any credible cloud notification is how the firm would leave. Not a promise that data is portable, but a described route: what formats the data comes out in, how long a migration takes, whether a second provider has been identified, what happens to backups and records that must be retained after the contract ends, and who pays.
An exit plan that has never been tested is an assumption. Firms with a critical dependency on one region are, in resilience terms, one provider incident away from a continuity event, which is the link between this document and the continuity plan. EU firms will find these expectations formalised, and the framework is described in DORA regulation explained.
The practical order for a firm planning a migration: classify the function, check the notification trigger for your licence with counsel, get the contract terms right, tell the regulator if required, then move. Reversing those steps is how a routine infrastructure decision turns into a supervisory conversation.
"Nobody gets in trouble for using the cloud. They get in trouble for not being able to say which regulated function is sitting in it, in which country, on whose contract, and how they would get it back."
— Roman Onta, Executive Director, SINGUARD
Key Takeaways
- Criticality, not technology, drives the duty, so classify the function before deciding whether notification is needed.
- Notification forms ask for the same fields as the outsourcing register, so build the register first.
- Effective audit and access rights must exist in the contract, and consumer grade terms will not carry a production system.
- Data location and privacy transfer analysis are separate questions from outsourcing, and both get asked.
Frequently Asked Questions
Do we have to tell our regulator before moving to a cloud provider?
That depends on the regime and on whether the function is classified as critical or important. Some supervisors expect prior notification for material outsourcing, others collect it through a periodic register or on request. Confirm the trigger for your licence before you migrate.
What does a regulator want to see in a cloud notification?
Provider identity, the function and its criticality classification with reasoning, the countries where the service is performed and data is stored, sub-outsourcing, the firm's own risk assessment, audit and access provisions, and the exit strategy.
Are cloud certifications enough to satisfy audit rights?
Sometimes, depending on the regulator and the criticality of the function. Supervisory guidance generally expects effective access to information and effective inspection rights, and how far published certifications and pooled audits satisfy that is a jurisdiction specific question for your advisers.
About the Author
Roman Onta is an Executive Director at SINGUARD. He builds the Prop Firm CRM, the Broker CRM, Scalegram and CopySignals side by side with his brother Alex Onta, and he helped on the design of eTrader, the division Alex built and leads. His ground is worldwide payment processing, AML compliance and the corporate structures brokers are built on, work the two of them carry together, shaped by executive roles in the UAE and international corporates. He lives and works in Dubai for most of the year. Meet the executive duo leading Singuard's five divisions.