Key takeaways
- The Bank of Tanzania issued Cloud Computing Guidelines for Financial Service Providers in August 2025.
- Institutions already using cloud are reported to need written BoT approval within 12 months of the guidelines taking effect.
- Existing outsourcing rules say banks must not outsource primary data centres outside Tanzania.
- Approval depends on evidence: architecture, contracts, security controls, DR and an exit plan. Start building it now.
What the guidelines are
In August 2025 the Bank of Tanzania (BoT) issued the Cloud Computing Guidelines for Financial Service Providers, 2025, under the Banking and Financial Institutions Act and the National Payment Systems Act. They set out how the BoT evaluates applications from banks, financial institutions and payment providers that want to use cloud computing.
The published document is organised into five parts: an introduction, evaluation criteria for approval, the cloud computing contract, the institution's cloud computing policy, and general provisions.
Key requirements reported so far
- Approval for existing cloud use: institutions already using cloud before the guidelines took effect are reported to need written BoT approval within 12 months.
- Contracts approved before implementation: cloud arrangements must be in a written contract, which needs BoT approval before going live.
- Primary data centre in Tanzania: the BoT Outsourcing Guidelines for Banks and Financial Institutions (2021) state that banks shall not outsource primary data centres outside the country.
- Mission-critical systems: the definition of mission-critical systems was one of the most debated points during consultation, and it determines what can and cannot be hosted offshore.
- Policy and governance: institutions need a board-approved cloud policy, reviewed regularly.
The earlier 2023 version reportedly required prior approval for non-mission-critical systems, prohibited offshore hosting of mission-critical data, and expected audit rights, exit strategies and annual policy reviews. Check which provisions carried into the final 2025 text.
Summary based on the published guideline document and press reporting in 2025. It is not legal advice. Read the official text on the Bank of Tanzania website and confirm obligations with your compliance team.
What this means for your technology
Most banks will end up with a hybrid design: regulated and mission-critical systems in Tanzanian data centres, with public cloud used only for workloads the BoT approves. That design has to be visible, controlled and provable:
- Data classification that decides where each system may run.
- In-country primary and DR sites for mission-critical workloads.
- Automated, auditable change management (CI/CD with approvals and scanning).
- Strong access control: SSO, MFA, least privilege, recorded admin sessions.
- Centralised, tamper-proof logs and monitoring.
- Tested backups, DR failover and an exit plan from each provider.
A 90-day readiness plan
| Phase | What to do |
|---|---|
| Days 1–30 | Inventory every cloud service in use, classify systems, map data flows, and identify gaps against the guidelines. |
| Days 31–60 | Design the target hybrid architecture, close access and logging gaps, and automate one critical system end to end as a reference. |
| Days 61–90 | Run a DR test, assemble the evidence pack (architecture, policies, contracts, test results) and prepare the BoT application. |
Our cloud approval reference architecture and 50-control checklist follow this structure. Ask for a copy.
How CItoCD helps
We design and build regulator-ready hybrid platforms for East African financial institutions: in-country private cloud and Kubernetes, DevSecOps pipelines, monitoring, DR and the technical evidence your submission needs. We start with a free 30-day pilot on one system, and support institutions across Tanzania, Kenya, Rwanda and the rest of Africa.