Regulators have always taken a keen interest in how financial services are adopting the cloud, with a particular focus on operational resilience. Big banks are expected, among other things, to understand the risks of cloud, and have mitigation plans in place. And, says the Prudential Authority of the South African Reserve Bank, when it issued its directive back in 2018, financial institutions must also know how their data is classified, where and how it’s stored, and have plans at the ready in the event of data loss and breach.

As the cloud has spread throughout financial institutions, and more cloud services are adopted, the SARB is said to have become much more comfortable with this model.