Italy

Regulations

• Can financial institutions use AWS?

  Yes. Financial institutions in Italy are permitted to use cloud services, provided that they comply with applicable legal and regulatory requirements, such as those described below. 

• Who are the financial regulators?

  In Italy, the Bank of Italy, Commissione Nazionale per le Società e la Borsa (CONSOB), Istituto per la Vigilanza sulle Assicurazioni (IVASS), and Commissione di Vigilanza sui Fondi Pensione (COVIP), oversee the banking, securities, (re)insurance markets, and pension funds, respectively.

• What regulations apply to financial institutions using AWS?

  The Digital Operational Resilience Act (DORA) is a pan-European legislative framework for operational and cyber resilience in the financial sector. DORA outlines the following:

  • Improvements in information and communications technology (ICT) and security risk-management requirements
  • A harmonized regime for ICT incident reporting
  • Development of a digital operational resilience testing framework
  • An oversight framework for critical ICT third-party providers

  DORA doesn't restrict or limit how financial entities (FEs) subject to DORA requirements adopt and use cloud services.
  

  For banking, the Bank of Italy has issued requirements for banks in Italy on, inter alia, risk analysis, security, business continuity, and exit strategy considerations as part of its Circular 285/2013 supervisory provisions for banks, which was amended to implement the EBA Guidelines (as defined below) (see TITLE IV-Chapter 4, Section VI).

  For securities, investment service providers in Italy (“intermediaries”, who can be investment firms or other types of entities) need to meet similar (but not identical) obligations under the Bank of Italy's Regulation dated 5 December 2019 implementing articles 4-undecies and 6, para. 1, lets. b) and c-bis) of the Italian Financial Act, when outsourcing “essential or important operative functions or any investment business or service.”

  For insurance and reinsurance companies, they should consider the requirements stipulated in IVASS’s Regulation No. 38 of 3 July 2018, which also covers issues around outsourcing, access rights, subcontracting, and contingency planning.

  For open-ended pension funds, they should comply with COVIP’s Resolution dated 13 January 2021 - Supervisory Instructions for firms managing open-ended pension funds, pursuant to Article 5-decies, para. 1, of Legislative Decree No. 252/2005, which sets out corporate governance requirements, including on outsourcing.

  The financial regulators in Italy have also confirmed the applicability of the following guidelines on outsourcing arrangements from the European Supervisory Authorities ("ESAs"). The ESAs' guidelines provide guidance to entities using or planning to use cloud services and cover a variety of contractual and operational areas, including access and audit rights, security of data and systems, location of data and data processing, sub-outsourcing, and contingency plans and exit strategies.

  • European Banking Authority Guidelines on outsourcing arrangements (“EBA Guidelines”) apply to credit institutions, investment firms, electronic money institutions and payment institutions.
  • European Insurance and Occupational Pensions Authority Guidelines on outsourcing to cloud service providers ("EIOPA Guidelines") apply to insurance and reinsurance undertakings.
  • European Securities and Markets Authority Guidelines on outsourcing to cloud service providers ("ESMA Guidelines") apply to certain types of firms regulated by ESMA.
    

  Regulations are changing rapidly in this space, and AWS is working to help customers proactively respond to new rules and guidelines. AWS encourages its financial institutions customers to obtain appropriate advice on their compliance with all regulatory and legal requirements that are relevant to their business, local regulations, guidelines and laws. 

• Key considerations for financial institutions using AWS

  Financial institutions who are using or planning to use AWS services can take the following steps to better understand their compliance needs:

  1. Consider the purpose of the workload(s) under consideration and the relevant categories of data in order to anticipate which legal and regulatory requirements may apply.

  2. Assess the materiality or criticality of the relevant workload(s) in light of local requirements. For example, Section 4 of the EBA Guidelines contains materiality assessment considerations for financial institutions.
  

  3. Review the AWS Shared Responsibility Model and map AWS responsibilities and customer responsibilities according to each AWS service that will be used. Customers can also use AWS Artifact to access AWS’s audit reports and conduct their assessment of the control responsibilities.

  4. Notify the relevant regulator(s) in Italy when the workload is deemed critical or important in accordance with applicable regulatory requirements.
  

  Customers who have further questions about how AWS services can enable their security and compliance needs, or who would like more information, can contact their account representative.

• Key data privacy and protection considerations for financial institutions using AWS

  Financial institutions in Italy using AWS services should also consider applicable privacy requirements, including the General Data Protection Regulation (“GDPR”) and the Italian Privacy Code (Legislative Decree No. 196/2003, as amended by the Legislative Decree No. 101/2018).

  If customers process or are planning to process the personal data of data subjects in the European Union (EU), they should visit AWS’s General Data Protection Regulation (GDPR) Center. More information on these requirements is included in Navigating GDPR Compliance on AWS.
  

Resources