Supervisory Expectations on Cloud Outsourcing After DORA: A Consolidated Reading of the ECB Guide and Its Interaction with EBA and ESMA Guidelines

The European Central Bank (ECB) Guide on outsourcing cloud services to cloud service providers, published 16 July 2025, is formally non-binding but operates as a de facto supervisory benchmark for institutions under direct ECB supervision. It does not supersede the Digital Operational Resilience Act (DORA); it supplements it, translating DORA and Capital Requirements Directive (CRD) requirements into detailed recommended practices specific to cloud outsourcing. Joint Supervisory Teams (JSTs) are expected to use it as a benchmark in supervisory assessments. The note sets out what the Guide says and isolates the areas in which its "good practices" set an operational bar above prevailing industry practice. It reads the Guide against the parallel revision of the European Banking Authority (EBA) outsourcing guidelines, the revised European Securities and Markets Authority (ESMA) guidelines on outsourcing to cloud service providers, both of which moved in July 2025, and the direct EU-level oversight of critical ICT third-party providers in operation since November 2025. Three expectations are the least reconcilable with prevailing practice: encryption in use, transparency over sub-outsourcing chains, and exit plans whose feasibility has been independently verified.