UKNF recommendations on SaaS security: what should financial institutions check?

Recent attacks on Polish cloud software providers and disclosed incidents of security breaches of data processed by them have demonstrated how heavily the security of financial institutions depends on third-party providers. In response, on October 5, 2026, the Polish Financial Supervision Authority (UKNF) published recommendations on reviewing the security of SaaS (Software as a Service) services and managing ICT third-party risk. It was highlighted that financial market entities should immediately verify which SaaS services they use, what data they entrust to providers, and whether they are properly managing the associated risk.

Do the UKNF SaaS recommendations create new legal obligations?

It is worth emphasizing at the outset that the recommendations do not establish new legal obligations. They do, however, show how the UKNF expects the implementation of DORA requirements, the EU Regulation on digital operational resilience for the financial sector, in relation to SaaS services. For each review area, the UKNF points to specific provisions of DORA and delegated acts that the review is intended to serve. The UKNF recommends that the review cover the following areas:

• identification of services used and data entrusted,
• verification of provider security,
• verification of integrations, connections, and permissions,
• protection of technical credentials and certificates,
• assessment of subcontractors and data flows,
• limitation of the scope and retention period of data,
• incident preparedness and business continuity maintenance,
• cooperation with CSIRT KNF, the sector-specific incident response team, and the use of threat intelligence.

Who do the UKNF SaaS recommendations apply to?

The recommendations are addressed to financial market entities supervised by the KNF, in particular banks, payment institutions (both authorized and small payment institutions), insurance companies, investment firms, and investment fund managers. References to DORA should be applied taking into account the personal scope of this Regulation as well as the principle of proportionality. Indirectly, the recommendations also apply to SaaS providers serving the financial sector, who should expect additional inquiries, audits, and contract modifications from their clients.

What should financial institutions do now?

In light of the UKNF recommendations, entities should primarily:

• prepare a full inventory of SaaS services, including accounting, HR, sales, and communication tools acquired directly by business units, and for each service identify the owner, supported processes, and categories of processed data,
• limit the scope and retention period of data transferred to providers to the strict minimum required, including in backup copies, exports, and test environments,
• review technical accounts, administrative access rights, tokens, and API keys, disable unused integrations, and ensure the ability to rapidly cut off access without waiting for provider action,
• verify the authenticity, currency, and scope of certificates and audit reports of providers,
• review contractual provisions regarding incident reporting, access to logs, and the return and deletion of data upon termination of cooperation,
• conduct an exercise involving an administrative account compromise or a security breach of the provider’s environment,
• document the review results and draw up a remediation action plan indicating priorities, action owners, and implementation deadlines.

Is a SaaS provider’s certificate enough?

One of the most significant elements of the recommendations is a shift away from a formal assessment of providers. The UKNF indicates that holding a certificate should not be treated as sufficient confirmation of service security. It must be checked whether the certificate or audit report covers the specific service and environment in which the entity’s data is processed, and the assessment should also take into account the effectiveness of security measures, test results, and the manner of remediating identified deficiencies. Material changes to the service, security incidents, or a change in the scope of certification should constitute grounds for reassessing the provider.

Summary: what the UKNF recommendations mean for the financial sector

The published recommendations are a clear signal that the use of third-party services does not relieve a financial institution of responsibility for fulfilling obligations arising from DORA. The effectiveness of measures taken should be evaluated on the basis of verifiable results, in particular the currency of the inventory, the scope of granted permissions, test results, and service recovery capabilities. Irrespective of DORA, a breach of customer data security at a SaaS provider may give rise to obligations and risks under the GDPR.

Although the UKNF recommendations are non-binding, they should not be treated merely as a collection of best practices. They demonstrate the direction of supervisory expectations and can serve as a key reference point during compliance assessments against DORA requirements in the course of UKNF supervisory activities.

How can you align SaaS vendor agreements with the UKNF recommendations and DORA?

We support financial institutions and ICT providers in aligning their SaaS service cooperation with DORA requirements, the GDPR, and the supervisory expectations of the UKNF. We review vendor agreements, including provisions on incident reporting, access to logs, subcontracting, and data return and deletion, and we audit internal procedures against regulatory recommendations. We also assist in gap identification and the drafting of remediation action plans.

Contact us to verify whether your internal procedures and existing contracts align with the regulator’s recommendations.