Print Article

JFSC off -the fence about OUTSOURCING and using the CLOUD – they say you MUST notify if using the cloud


The JFSC has been silent up to now on whether using the cloud for IT is outsourcing. Many firms have erred on the side of caution and notified them, but many have not.

For those that have not, I’m afraid you must now act as the JFSC has said


This statement is found in the JUNE 2022 JFSC consultation and proposed revision to current Outsourcing Policy (OSP) and Guidance Notes.

And specifically in the following section[s]

    • 1.3.1 There is no consistent definition of ‘Cloud Services’ within the International community and, as a result, its meaning can be open to different interpretations.
    • For the Revised OSP we have adopted the same definition currently used by the UK FCA (which is broadly consistent with the National Institute of Standards and Technology, U.S. Department of Commerce definition).
    • 1.3.2 We considered amending the Revised OSP to provide that where a Service Provider performs Outsourced Activity in the form of Cloud Services on behalf of a Business as part of its non-Regulated Activity, such Outsourced Activity would not be caught.
    • However, due to the associated concentration risks and the fact that this option would not be in line with international standards we opted instead, to provide tailored guidance and provisions in the revised OSP to where a Service Provider performs Outsourced Activity in the form of Cloud Services.
    • 1.3.3 Taking into account the complex supply chains and nuances associated with Cloud Services, the Revised OSP provides an exception to the rule in terms of the Sub-Outsourcing of Cloud Services.
    • Whilst a Business MUST STILL NOTIFY US ABOUT ITS PRIMARY CLOUD SERVICE PROVIDER, it does not have to with any Sub-Outsourcing Cloud Services arrangement.

Online Outsourcing Notifications

  1. The JFSC will no longer accept paper submissions for Outsourcing Notifications.
  2. From 29 June 2020, businesses must submit their Outsourcing Notifications via the myJFSC portal. While the requirements for submitting Outsourcing Notifications have not changed, the move to digital submissions should make it easier for businesses to provide us with their information and supporting documents.
  3. To ensure you are set up for online submissions, you need to make sure you have a user on your portal account who can complete the Outsourcing Notification on behalf of your business.
  4. You will also need an Authorised Portal User who can submit a notification. If you need to set up a portal user, you can send your request to the Regulatory Maintenance team:


JFSC consultation and proposed revision to current Outsourcing Policy (OSP) and Guidance Notes.

Summary of proposed key changes:

  • Where a Service Provider performs outsourced activity in the form of telecommunication services on behalf of a business, such outsourced activity is not caught
  • Specific guidance is provided where a service provider performs outsourced activity in the form of Cloud Services
  • Managed Trust Company Business is now exempt from the application of the Revised OSP

More detailed information on each key change is set out in the JFSC consultation.

Who will the Revised OSP impact?

  • The Revised OSP will impact any person to whom the provisions of the Revised OSP apply. The requirement for all Supervised Persons to comply with the Revised OSP represents a change of policy insofar as only regulated persons carrying on regulated business have had to comply with the current OSP and Guidance Notes to date.

Next steps

  • Close Wednesday 31 August 2022.
  • Following the JFSC consultation, we will publish feedback and issue a final form Revised OSP in October.
  • There will then be a three-month transition period for compliance with the Revised OSP – January 2023



The Team

Meet the team of industry experts behind Comsure

Find out more

Latest News

Keep up to date with the very latest news from Comsure

Find out more


View our latest imagery from our news and work

Find out more


Think we can help you and your business? Chat to us today

Get In Touch

News Disclaimer

As well as owning and publishing Comsure's copyrighted works, Comsure wishes to use the copyright-protected works of others. To do so, Comsure is applying for exemptions in the UK copyright law. There are certain very specific situations where Comsure is permitted to do so without seeking permission from the owner. These exemptions are in the copyright sections of the Copyright, Designs and Patents Act 1988 (as amended)[]. Many situations allow for Comsure to apply for exemptions. These include 1] Non-commercial research and private study, 2] Criticism, review and reporting of current events, 3] the copying of works in any medium as long as the use is to illustrate a point. 4] no posting is for commercial purposes [payment]. (for a full list of exemptions, please read here]. Concerning the exceptions, Comsure will acknowledge the work of the source author by providing a link to the source material. Comsure claims no ownership of non-Comsure content. The non-Comsure articles posted on the Comsure website are deemed important, relevant, and newsworthy to a Comsure audience (e.g. regulated financial services and professional firms [DNFSBs]). Comsure does not wish to take any credit for the publication, and the publication can be read in full in its original form if you click the articles link that always accompanies the news item. Also, Comsure does not seek any payment for highlighting these important articles. If you want any article removed, Comsure will automatically do so on a reasonable request if you email