ESMA Guidelines on Outsourcing to Cloud Service Providers (ESMA50-157-2403) 38: Assess the adequacy of certifications and reports for critical or important functions and avoid sole reliance

What does 38 require?

For critical or important functions a firm assesses whether the third-party certifications and audit reports it uses are adequate and sufficient for it to comply with its obligations under applicable legislation, and aims not to rely solely on those certifications and reports over time.