The Bank of Mozambique has established new data processing, storage and outsourcing requirements for credit institutions and financial companies, replacing its 2003 framework. Institutions must maintain primary and secondary data centers, with primary facilities and core systems hosted and operated in Mozambique. Locating secondary data centers or peripheral systems abroad requires authorization, while certain systems supplied by global providers are subject to at least 30 days’ prior notice. Cloud arrangements are subject to approval or notification depending on the system and location. Banks, microbanks and electronic money institutions must process information exclusively in private clouds. Institutions must assess providers’ legal, technical and operational capabilities, ensure cybersecurity and data availability, and include regulatory access, audit rights, service standards, subcontracting controls and exit arrangements in contracts. The requirements enter into force 60 days after publication. Existing institutions must submit an inventory of systems, data centers and relevant contracts within that period and achieve full compliance within 12 months after the rules take effect.
2026-08-31Bank of Mozambique
Bank of Mozambique sets data localization and cloud outsourcing requirements for financial institutions
The Bank of Mozambique requires credit institutions and financial companies to keep primary data centers and core systems in Mozambique and obtain approval for specified offshore and cloud arrangements. Banks, microbanks and electronic money institutions may use only private clouds, while outsourcing contracts must provide security, audit, regulatory access and exit protections. Existing institutions have 12 months after the rules take effect to comply fully.