BMA Outsourcing Consultation Paper (2018-11-05)

Summary

This is a consultation paper in which the Bermuda Monetary Authority (BMA) proposes new prudential guidance on outsourcing, intended to take effect from 1 January 2020 and to replace the 2007 outsourcing guidance for banks and deposit companies. It sets out expectations for how licensed entities should evaluate, manage and monitor risks arising from outsourcing arrangements with third-party service providers, including group-affiliated providers, and invites industry comment before finalisation.

• Who it covers: Applies to any 'Relevant Licenced Entity' (RLE) — Banks, Credit Unions, Trust Companies, Corporate Service Providers, Money Service Businesses, Investment Businesses, Fund Administrators and Deposit Companies licenced by the BMA, plus the Bermuda Stock Exchange.
• Scope of outsourcing covered: Applies to all outsourcing to third parties (external or intra-group), except arrangements already covered by AML/ATF guidance notes 5.149 to 5.174.
• Material outsourcing focus: Extra scrutiny applies to 'material outsourcing' — outsourcing of activities deemed critical by senior management — including a requirement for prior BMA approval before entering new material outsourcing agreements.
• Required policies: RLEs must maintain policies and procedures covering outsourcing risk appetite, criteria for materiality, service-provider due diligence, contractual terms, and ongoing post-contract monitoring.
• Existing arrangements: RLEs must review existing outsourcings to identify any that are material, then either seek BMA prior approval or have the CEO formally attest compliance with the new guidance.
• New material outsourcing process: Once the guidance is in force, proposals for new material outsourcing must be submitted to the BMA in writing at least 60 calendar days before the intended start date, with Board approval obtained beforehand.

The paper is a draft consultation, not yet binding guidance; the BMA invited comments from licensed entities and other interested parties by 4 January 2019, and the guidance itself was proposed to come into force on 1 January 2020.

Key obligations

• RLEs must have policies and procedures covering outsourcing risk appetite, criteria for materiality, service provider due diligence, contract terms, and ongoing monitoring
• RLEs must obtain prior BMA approval before entering into a new material outsourcing arrangement, submitting the proposal in writing at least 60 calendar days before the intended commencement date, with prior Board approval
• For existing outsourcings identified as material, RLEs must either submit a complete application for BMA prior approval no later than 30 August 2019, or have the CEO formally attest in writing to the Authority no later than 23 December 2019 that the arrangement complies with the guidance
• Outsourcing agreements must be in writing and specify service levels, performance monitoring, BCP/DRP obligations, sub-contracting conditions, termination triggers, and access rights for the RLE, its auditors and its regulator
• Interested parties were invited to submit comments on the proposed guidance to outsourcing@bma.bm no later than 4 January 2019

Applies to

Banks, Credit Unions, Trust Companies, Corporate Service Providers, Money Service Businesses, Investment Businesses, Fund Administrators, Deposit Companies, Bermuda Stock Exchange

Deadlines

• 4 January 2019: Deadline for licensed entities and interested parties to submit comments on the consultation paper to outsourcing@bma.bm
• 1 January 2020: Proposed date the new outsourcing guidance comes into force
• 30 August 2019: Deadline for RLEs choosing the prior approval route to submit a complete application for existing outsourcings deemed material
• 23 December 2019: Deadline for RLEs choosing the CEO attestation route to submit attestations for existing material outsourcings
• 60 calendar days before commencement: New material outsourcing proposals must be submitted to the BMA in writing at least 60 calendar days before the intended start date, once the guidance is in force