6. What are the potential consequences for breaching financial services rules on cloud outsourcing?
Enforcement action is regularly brought over failures in outsourcing situations.
There have been sanctions against investment companies by the Autorité des Marchés Financiers ("AMF"), among others, where there were outsourcing arrangements at stake. Most of the time, outsourcing compliance failures are not the only wrongdoing. The AMF has also found that the internal control measures are not adequate.
In recent years, the AMF has imposed fines ranging from EUR 200,000 to EUR 300,000 on financial institutions. Separately, the data protection authorities also now bring their own proceedings.