security and data confidentiality. this includes implementing stringent data security measures such as encryption and associated cryptographic key management to protect sensitive information. it is vital that these 2 / 4 bis - central bankers'speeches measures are regularly reviewed and updated in response to evolving threats. additionally, we consider it good practice for banks to maintain a clear policy on data location, ensuring that data storage and processing comply with both regulatory requirements and the institution's own risk management policies. moreover, we advise banks to subject all cloud services to rigorous testing, including disaster recovery plans. in particular, we say that banks should not solely rely on certifications provided by csps but also conduct their own independent checks to validate these critical processes. indeed, i would highlight that the external certifications provided by csps may not always be tested as robustly as banks would hope. banks should be careful not to be too trusting, like the financial sector was before 2008 when it trusted the credit rating agencies. regular audits and continuous monitoring of csps are essential to verify compliance with agreed standards and to promptly identify any emerging risks. robust exit strategies are another important element in the area of cloud outsourcing. comprehensive exit plans ensure seamless transitions and minimise any potential disruptions. these plans should include clear roles and responsibilities, effective data portability solutions and provisions for business continuity. regular testing of disaster recovery strategies is crucial, ensuring that both the bank and its csps are prepared for various scenarios, including abrupt service discontinuation. i encourage all of you to view these guidelines not as mere regulatory hurdles, but as strategic enablers. robust governance and risk management frameworks are not just about meeting supervisory expectations a€ “ they are about safeguarding the integrity of banks and the trust that depositors put in them. let me now turn to some of the comments we have received. many of them concern the legal nature of the guide and how it relates to existing regulation. again, let me be very clear here : the guide does not establish any new regulatory requirements. it simply sets out our supervisory expectations and provides examples of good practices. some of the other comments relate to more specific issues, such as the need for backups in separate locations, cloud resilience measures and the definition of concentration risks. we very much welcome this detailed feedback and will adjust the guide as necessary to clarify our expectations. we plan to have the final version ready by the end of the year. conclusion let me conclude. cloud outs

was part of this staff of this great institution for fifteen years. so in a way, it is coming the full cycle. it ’ s like coming back home after a long absence. it is a great pleasure, privilege and an honour to be able to come back. of course, i am deeply indebted to his excellency the president for appointing me as the governor of the central bank of sri lanka. i am also indebted to the hon. prime minister and the hon. finance minister for supporting my appointment and i very much hope that i will be able to fulfill the trust they have reposed in me. when i met the president, he just told me one thing, he said “ do your work in a straight way and do not fear anybody in discharging your duties. ” now my intention is to follow his direction. when i met the honourable prime minister, he laid out his vision for where he wants to take this country and there is a big role for the central bank. and in many ways, if we are not able to fulfill our functions in the way it should be fulfilled – in - terms of creating a platform for macroeconomic stability with strong macroeconomic fundamentals, having financial sector stability so there is confidence right through the system – nothing else is possible. that is the first step, to get strong macroeconomic fundamentals, to have the financial sector which is the lifeblood of the country stable, and people within the country and outside having confidence in it. so that is our responsibility. and as i said, because i genuinely believe that nothing else will really take off, unless we are able to do our job well, to fulfill our functions well. so we have a big responsibility, and i look to all of you for assistance and cooperation in doing this. as the deputy governor mentioned, i did play a little bit of sport in my youth and one of the lessons bis central bankers ’ speeches that i learnt, the key lesson probably, from playing sport, is that a captain is only as good as his team. you know, however smart or clever the captain is, unless his team has talent and there is teamwork, it ’ s not going to work. having been through the process myself, i know how the central bank recruits its people. it is able to draw on the best people in the country. so in front of me i know there is enormous talent. and the important thing though, is that talent alone is not