For banks, cloud outsourcing falls within the scope of supporting activities that are permitted to be outsourced, which means adhering to the following criteria: (a) low risk; (b) no requirement for a high-competence qualification in banking; and (c) is not directly related to decision-making processes that impact a bank's operations. There is arguably an exception for cloud outsourcing conducted by broker dealers. Under the Financial Services Authority (Otoritas Jasa Keuangan (OJK)) Regulation No. 50/POJK.04/2020 on Internal Control for Securities Companies that Carry out Business Activities as Broker Dealers, outsourcing to cloud service providers may not be considered as outsourcing on the basis that the services to be outsourced do not represent the entire IT function.