Financial services firms in Jersey have been warned to review their use of cloud and cyber security providers after the island’s regulator uncovered outsourcing arrangements that had not been properly identified or reported.
The Jersey Financial Services Commission (JFSC) found deficiencies in five of the eight firms examined as part of its 2025 thematic review of outsourcing controls.
The review covered businesses operating across the deposit-taking, fund services, investment and trust company sectors. While the regulator found a “generally acceptable” level of compliance, all but one of the findings identified were classed as minor.
Among the weaknesses uncovered in the findings, published last week, were failures to recognise that certain cloud and cyber security services fell within the scope of the JFSC’s outsourcing policy, resulting in firms failing to meet regulatory notification requirements for some outsourced arrangements.
The regulator also identified inadequate contingency planning for the disruption or unexpected termination of outsourced services.
Some firms did not have documented contingency plans and were unable to explain what they would do if a service provider failed. Others had not tested whether their arrangements remained suitable and effective.
The JFSC also found instances where group-wide policies had not been tailored to Jersey’s regulatory requirements or the operational needs of the local business.
Financial crime concerns were also raised, with some firms unable to evidence that outsourced providers had been informed of their responsibility to report suspicions of money laundering, terrorist financing or proliferation financing.
All eight firms received direct feedback, while those where deficiencies were identified were required to submit formal remediation plans.
The JFSC said: “Firms are expected to consider the broader implications of findings or self-identified gaps and ensure that remediation is proportionate to the risks identified.”
It added that firms may be asked during future supervisory engagement to demonstrate the steps they have taken to address weaknesses. The regulator said it may revisit outsourcing in future supervisory work to assess firms’ continuing compliance.
