Consultation Paper - Operational Resilience and Outsourcing Package (2025-01-14)

Summary

This is a BMA consultation paper seeking industry feedback on a proposed Operational Resilience and Outsourcing Code and accompanying Guidance Notes. It sets out draft standards requiring regulated entities to identify critical services, manage outsourcing risk, and demonstrate resilience through governance, testing and self-assessment. The Code and amendments to primary Acts are not yet final; comments were due by 14 March 2025.

• Scope: Applies to Relevant Entities (REs) licensed under eight Bermuda Acts, including banks and deposit companies, trust businesses, corporate service providers, money service businesses, investment businesses, fund administration providers, digital asset businesses (Class F), commercial insurers (Classes 3A/3B/4/C/D/E), Class IIGB and IILT insurers, and insurance managers, brokers, marketplace providers and agents. Sandbox/test-licensed entities are excluded.
• Important Business Services (IBS): REs must identify, document and regularly review IBS whose disruption could cause significant harm to consumers, stakeholders or financial stability, and map all resources, systems, data and third-party dependencies supporting them.
• Outsourcing: Boards must approve a risk management policy for vendor evaluation, monitoring and concentration risk; material outsourcing of critical activities will require prior notification to the BMA under proposed Act amendments, with a 30-day no-objection window.
• Governance: Boards and senior management must set strategic direction, approve resilience and risk appetite, oversee BCPs/DRPs, and receive regular Op Res reporting.
• Self-assessment and returns: Proposed amendments would require REs to complete an annual board-approved self-assessment against the Code, retained for at least five years and available to the BMA on request.
• Testing and communication: REs must test IBS resilience against severe-but-plausible scenarios, review test plans annually or after significant change, remediate vulnerabilities promptly, and maintain tailored internal/external communication plans for disruptions.

The BMA intends to finalise the Code during 2025 after the 60-day consultation. Once final, most REs will have until 31 March 2028 to comply, except banks and deposit companies licensed under the Banks and Deposit Companies Act, which must comply by 31 March 2026. Existing legislation and guidance remain applicable until the Code takes effect.

Key obligations

• Submit written comments on the consultation to policy@bma.bm by close of business 14 March 2025
• Once the Code is finalised, Relevant Entities must identify, document and regularly review their Important Business Services (IBS) and map all supporting resources, including third-party and intra-group dependencies, with annual board approval of the mapping
• Boards must approve and maintain a policy for assessing, monitoring and reviewing outsourcing service providers, including risk evaluations before entering outsourcing arrangements and management of concentration risk
• REs must notify the BMA before implementing outsourcing of a critical activity (material outsourcing) and may only proceed after receiving a no-objection notification within 30 days, or respond within 28 days to any preliminary objection notice
• REs must treat substantial alterations to a previously approved material outsourcing arrangement as a new material change in business requiring fresh notification
• Boards must complete and approve an annual self-assessment demonstrating compliance with the Code, retain it for at least five years, and make it available to the BMA on request
• REs must test resilience of IBS against severe but plausible disruption scenarios, review test plans annually or after significant changes, and promptly remediate identified vulnerabilities
• REs must maintain and regularly test internal and external communication plans for disruptions affecting IBS
• Compliance with the finalised Code is required by 31 March 2028 for most REs, and by 31 March 2026 for banks and deposit companies

Applies to

Corporate Service Providers, Trust Businesses, Money Service Businesses, Investment Businesses, Fund Administration Provider Businesses, Banks and Deposit Companies, Digital Asset Businesses (Class F), Commercial Insurers (Class 3A, 3B, 4, C, D, E), Class IIGB and IILT Insurers, Insurance Managers, Insurance Brokers, Insurance Marketplace Providers and Agents

Deadlines

• 14 March 2025: Deadline for industry and stakeholders to submit consultation comments to policy@bma.bm
• 31 March 2026: Compliance deadline for Relevant Entities licensed under the Banks and Deposit Companies Act
• 31 March 2028: Compliance deadline for all other Relevant Entities
• 30 days following receipt of original notification: Period within which BMA will issue a no-objection notification for a proposed material outsourcing arrangement before the RE may proceed
• 28 days: Period given to an RE to submit further information after BMA serves a preliminary notice contemplating objection to an outsourcing arrangement