Qatar Central Bank - Cloud Computing Regulation

The Qatar Central Bank (QCB) is the primary regulatory authority responsible for the supervision and control of the banking, insurance, and financial services sectors in the State of Qatar. The QCB seeks to ensure the stability of the financial system, protect consumers, and promote a secure and innovative digital financial ecosystem.

Some of the key QCB regulations for financial institutions to consider when outsourcing their information technology activities to the cloud are:

• Cloud Computing Regulation: Comprehensively governs the entire cloud lifecycle for financial institutions, including IT planning, risk management, due diligence, data localization, operational security, and exit planning. Institutions retain ultimate accountability for risk management and oversight of outsourced cloud activities.
• Data Handling and Protection Regulation: Mandates the creation of a data classification framework, sets strict data residency requirements for sensitive data, and outlines requirements for data retention and third-party access.
• Sector-Specific Security Regulations: Provides granular cybersecurity instructions tailored to different financial sub-sectors. This includes the Insurance Sector Cyber Security Regulation, the Information and Cyber Security Regulation for Payment Service Providers, and the Technology Risk Instructions for Financial Services Operators.
• Technology Risks Circular: Provides foundational guidance on managing technology and e-banking risks, with principles on risk management, business continuity, and outsourcing that are directly applicable to cloud arrangements.
• Artificial Intelligence Guideline: Sets requirements for AI governance, risk management, and outsourcing when using AI systems.

Qatar Financial Services Regulations: A Guide for Institutions Using Google Cloud

This guide highlights Google Cloud's core commitment to security and compliance and details how our services align with key security and risk considerations typically addressed in the QCB regulations. It provides you with useful information to assist you with understanding how we can support you with meeting the QCB requirements as an outsourced service provider.