Croatia

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Croatia are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who are the financial regulators?

  Hrvatska Narodna Banka (the Croatian National Bank or HNB) supervises credit institutions, credit unions, payment institutions, and electronic money institutions and a separate authority, the Croatian Financial Services Supervisory Agency (HANFA) supervises stock exchanges and regulated markets, investment firms and securities issuers, brokers and investment advisors, insurance and reinsurance companies and intermediaries, investment and pension fund management companies, pension insurance companies, and investment and pension funds.
  

• What regulations apply to financial institutions using AWS?

  The Digital Operational Resilience Act (DORA) is a pan-European legislative framework for operational and cyber resilience in the financial sector. DORA outlines the following:

  • Improvements in information and communications technology (ICT) and security risk-management requirements
  • A harmonized regime for ICT incident reporting
  • Development of a digital operational resilience testing framework
  • An oversight framework for critical ICT third-party providers

  DORA doesn't restrict or limit how financial entities (FEs) subject to DORA requirements adopt and use cloud services.
  

  The HNB has updated its decision on outsourcing. Customers should review the decision and specifically note the requirement to notify HNB when outsourcing critical or important functions.

  Local regulations, guidelines and laws in Croatia may also apply to financial institutions in Croatia when they use cloud services. Customers should note the Decision on Adequate Information System Management (Croatian Official Gazette 37/2010) adopted by the HNB, as well as the Act on Cybernetic Security of Key Services Providers and Digital Service Providers (Cybernetic Security Act) and its Regulation on Cybernetic Security of Key Services Providers and Digital Service Providers.

  The financial regulators in Croatia have also confirmed the applicability of the following guidelines on outsourcing arrangements from the European Supervisory Authorities ("ESAs"). The ESAs' guidelines provide guidance to entities using or planning to use cloud services and cover a variety of contractual and operational areas, including access and audit rights, security of data and systems, location of data and data processing, sub-outsourcing, and contingency plans and exit strategies.

  • European Banking Authority Guidelines on outsourcing arrangements published on 25 February 2019 (“EBA Guidelines”) apply to credit institutions, investment firms, electronic money institutions and payment institutions.
  • European Insurance and Occupational Pensions Authority Guidelines on outsourcing to cloud service providers published on 6 February 2020 ("EIOPA Guidelines") apply to insurance and reinsurance undertakings.
  • European Securities and Markets Authority Guidelines on outsourcing to cloud service providers published on 18 December 2020 ("ESMA Guidelines") apply to certain types of firms regulated by ESMA.

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institutions customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, including the ESAs' guidelines and local regulations, guidelines, and laws.
  

• Key considerations for financial institutions using AWS

  AWS is committed to offering customers a strong compliance framework and advanced tools and security measures that customers can use to evaluate meet, and demonstrate compliance with applicable legal and regulatory requirements.

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

  2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. For example, Section 4 of the EBA Guidelines contains materiality assessment considerations for financial institutions.
  

  3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

  4. Notify the relevant regulator(s) in Croatia when the workload is deemed critical or important in accordance with applicable regulatory requirements.
  

  Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

• Key data privacy and protection considerations for financial institutions using AWS

  Financial institutions in Croatia using AWS services should also consider applicable privacy requirements, including the General Data Protection Regulation (“GDPR”) and the Croatian Act on the Implementation of the GDPR.
  

  If customers process or are planning to process the personal data of data subjects in the European Union (EU), they should visit AWS’s General Data Protection Regulation (GDPR) Center. More information on these requirements is available at Navigating GDPR Compliance on AWS.
  

Resources