Waqar Uddin

The Missing CSP Certification: Navigating SBP's 'Reputable' Standard

February 15, 2026 (2w ago)0 views

The Certification Assumption

Most financial institutions in Pakistan approach cloud adoption with a reasonable assumption: the State Bank of Pakistan maintains a certification process or approved vendor list for cloud service providers. After all, how can banks select CSPs without knowing which ones meet regulatory standards?

The reality is more nuanced and more instructive.

BPRD Circular No. 01 of 2023, which governs cloud outsourcing for Pakistan's financial sector, contains no CSP certification framework. Instead, Section E states that regulated entities "may outsource all types of workloads to reputable onshore CSPs." The circular defines what "reputable" means through the institution's own due diligence process, not through a pre-approved vendor list.

This creates a fundamental shift in responsibility. Rather than relying on SBP-certified providers, banks must develop their own frameworks for evaluating cloud service providers—frameworks that satisfy regulatory expectations without explicit certification criteria.

How do you evaluate a cloud provider when the regulator defines the destination but not the path?

What BPRD Circular No. 01 of 2023 Actually Says

A close reading of BPRD Circular No. 01 of 2023 reveals the regulatory framework's actual structure—and the source of industry confusion.

The "Reputable Onshore CSP" Standard

Section E of the circular establishes the fundamental requirement for cloud outsourcing:

"REs may outsource all types of workloads to reputable onshore CSPs."

— BPRD Circular No. 01 of 2023, Section E

Source: BPRD Circular 01/2023

This single sentence contains the entire CSP selection framework. The circular does not define "reputable." It does not specify certifications required. It does not establish evaluation criteria. Instead, it places the burden of determining reputability on the regulated entity itself.

Institutional Approval vs. CSP Certification

The circular distinguishes between two scenarios:

ScenarioSBP RequirementWho Gets Approved
Onshore CSPs"Reputable" standardBanks evaluate; no SBP pre-approval
Offshore CSPs"Subject to SBP approval"Banks submit requests; SBP approves case-by-case

Critical distinction: When banks seek to use offshore CSPs for material workloads, SBP approves the institution's outsourcing arrangement, not the CSP itself. There is no path for a CSP to obtain pre-certification from SBP.

What the Circular Actually Requires

The circular mandates that regulated entities conduct due diligence assessing:

However, the circular provides no specific criteria for evaluating these factors. ISO 27001, SOC 2 Type II, and other international certifications are not explicitly required or recognized. Each institution must determine what evidence sufficiently demonstrates "reputability."

The Interpretive Challenge

This framework creates interpretive space that institutions must navigate carefully. Questions without clear answers include:

The circular's approach trusts institutions to exercise judgment—but provides limited guidance for developing that judgment consistently across the sector.

The Two-Regulator Context: SBP vs. MoIT

A separate development adds important context to the CSP landscape in Pakistan. In 2024, the Ministry of Information Technology and Telecommunication (MoIT) established a Cloud Office and formulated accreditation criteria for cloud service providers under the Pakistan Cloud First Policy.

This creates an interesting contrast:

FrameworkRegulatorApproachStatus
SBP Cloud GuidelinesState Bank of Pakistan"Reputable" standard; institutional due diligenceActive for financial sector
MoIT CSP AccreditationMinistry of ITFormal accreditation criteria with tiersEstablished 2024 for government use

Important distinction: MoIT's accreditation framework applies to government cloud procurement, not financial sector outsourcing. The two frameworks operate independently. A CSP accredited by MoIT is not automatically "reputable" under SBP guidelines, nor does SBP recognize MoIT accreditation as meeting its requirements.

This two-regulator landscape reflects different regulatory philosophies. MoIT has chosen to establish explicit CSP standards for government use, while SBP has opted for an institutional-due-diligence approach that places evaluation responsibility on regulated entities.

International Benchmarks: How Other Regulators Handle CSP Selection

Examining international approaches provides valuable context for understanding SBP's framework—and reveals that SBP is not alone in avoiding CSP certification.

Switzerland's Approach: Clear Criteria, No Pre-Approval

The Swiss Bankers Association (SBA) Cloud Guidelines establish detailed criteria for evaluating CSPs without maintaining an approved vendor list. The framework uses a three-tier model based on data sensitivity:

The Swiss model demonstrates that regulators can provide specificity without creating certification bureaucracy. Banks use published criteria to conduct their own due diligence.

Singapore's Approach: Institutional Responsibility

The Monetary Authority of Singapore (MAS) Technology Risk Management Guidelines require financial institutions to conduct comprehensive due diligence on cloud providers. MAS does not maintain a certified CSP list. Instead, it specifies assessment areas:

The Singapore approach emphasizes that cloud adoption responsibility remains with the institution, not the regulator.

European Union: Proportionality and Registers

The European Banking Authority (EBA) Guidelines on Outsourcing require institutions to:

Like SBP, EBA does not certify CSPs. Unlike SBP, EBA provides more specific guidance on assessment criteria and proportionality frameworks.

Key Insight

None of these jurisdictions maintain CSP certification programs. All place evaluation responsibility on financial institutions. SBP's approach is consistent with international practice—though it provides less specific guidance than peers.

A Proposed Framework: What SBP Certification Could Look Like

While SBP has not established CSP certification, examining what such a framework could entail helps institutions understand what "reputable" might mean in practice. The following is a proposal for discussion—not an existing framework.

Tier 1: Basic Reputability

This tier represents foundational requirements that any CSP serving the financial sector should meet:

Use case: Non-critical workloads, development environments, non-sensitive data processing.

Tier 2: Enhanced Assurance

This tier adds requirements for material workloads and sensitive data:

Use case: Material workloads, customer data processing, operational systems.

Tier 3: Financial Sector Excellence

This tier addresses the highest-sensitivity use cases:

Use case: Core banking systems, critical financial infrastructure, highly sensitive data.

How to Use This Framework

Institutions can adapt this proposed framework to develop their own evaluation criteria:

  1. Map workloads to appropriate tiers based on data sensitivity and criticality
  2. Evaluate CSPs against tier-specific requirements
  3. Document decisions and rationale for regulatory examination
  4. Review annually as workloads and provider capabilities evolve

This framework draws on international precedents (Switzerland's SBA, Singapore's MAS) adapted to Pakistan's regulatory context.

Practical Due Diligence: A Checklist for Banks

In the absence of explicit SBP certification criteria, banks need practical frameworks for evaluating CSPs. The following checklist provides actionable guidance derived from BPRD Circular requirements and international best practices.

Security and Compliance

Financial Stability

Data Residency and Sovereignty

Audit and Oversight

Exit and Portability

Red Flags: When to Seek Additional Assurance

🚩 High concern indicators:

🟡 Medium concern indicators:

Documentation Best Practices

When evaluating CSPs, document:

  1. Evaluation criteria used and why
  2. Evidence reviewed (certifications, reports, contracts)
  3. Decision rationale for selection or rejection
  4. Risk assessment and mitigation measures
  5. Review date and trigger events for re-evaluation

This documentation supports regulatory examination and demonstrates good faith compliance efforts.

Navigating the Ambiguity: Practical Guidance

The absence of explicit CSP certification criteria requires banks to develop robust internal frameworks. Here are practical approaches that align with SBP's expectations.

Develop Internal Evaluation Standards

Rather than waiting for SBP certification, institutions should:

Engage Proactively with SBP

For significant cloud initiatives:

Leverage International Standards

While SBP doesn't require specific certifications, international standards provide useful benchmarks:

These certifications demonstrate CSP capability even if not explicitly required by SBP.

Monitor Regulatory Developments

The regulatory landscape evolves. Institutions should:

Risk Assessment Framework: When Is "Reputable" Enough?

Banks must make judgment calls about CSP selection. This framework provides guidance for those decisions.

Risk Factors to Consider

FactorLower RiskHigher Risk
Data sensitivityPublic marketing dataCore banking transaction data
System criticalityInternal toolsCustomer-facing payment systems
CSP track record5+ years with financial institutionsNew entrant, no FI references
CertificationsISO 27001 + SOC 2No third-party certifications
Data residencyClear Pakistan-only processingUnclear sub-processor locations
Financial stabilityProfitable, establishedStartup, limited financial history

Decision Framework

Green (Proceed with Standard Due Diligence):

Yellow (Enhanced Due Diligence Required):

Red (Seek Alternatives or Expert Consultation):

When to Engage External Experts

Consider engaging specialized cloud risk consultants or legal advisors when:

Conclusion: Moving Forward with Clarity

The absence of SBP CSP certification does not mean the absence of standards. BPRD Circular No. 01 of 2023 places evaluation responsibility on regulated entities, trusting them to develop appropriate due diligence frameworks.

This approach has advantages:

It also has challenges:

Practical path forward:

  1. Accept the framework as it exists—not as you wish it were
  2. Develop robust internal evaluation criteria using international benchmarks
  3. Document everything for regulatory examination
  4. Engage proactively with SBP for significant initiatives
  5. Monitor developments and adapt as guidance evolves

The financial institutions that navigate this ambiguity successfully will be those that treat CSP evaluation as a core competency—not a compliance checkbox. The proposed frameworks and checklists in this article provide starting points; institutions should adapt them to their specific risk profiles and regulatory contexts.

Disclaimer: This article provides analytical content for informational purposes. It does not constitute legal, compliance, or professional advice. Institutions should consult qualified advisors for specific guidance on cloud outsourcing decisions.

Current as of: February 2026

Sources:

Keywords: SBP Cloud Guidelines, CSP Certification, Cloud Service Provider, BPRD Circular 01/2023, Cloud Computing, Financial Sector Regulation, Due Diligence