Outsourcing for Banks, Deposit Companies, the Bermuda Stock Exchange, Corporate Service Providers, Trust Companies, Money Service Businesses, Investment Businesses, Fund Administrators and the Credit Union (28 June 2019)

Summary

This BMA guidance note sets out expectations for how licensed entities must manage outsourcing arrangements, covering both existing arrangements at the time the guidance takes effect and any new material outsourcing entered into afterwards. It replaces the Authority's 2007 outsourcing guidance for banks and deposit companies and extends the framework to a wider range of licensed entities. AML/ATF-related outsourcing already covered by separate 2016 AML/ATF guidance notes is excluded.

• Who it applies to: Banks, Deposit Companies, the Bermuda Stock Exchange, Corporate Service Providers, Trust Companies, Money Service Businesses, Investment Businesses, Fund Administrators and the Credit Union licensed by the BMA (collectively 'Relevant Licenced Entities' or RLEs).
• Core requirement: RLEs must have policies and procedures to manage and monitor existing outsourced activities and to assess risks before outsourcing new activities, with proportionality based on whether an activity is a 'material outsourcing' (a critical activity whose failure would materially affect the RLE).
• Existing material outsourcings: On identifying an existing material outsourcing, an RLE must either seek prior Authority approval before the guidance takes effect, or have its CEO (or a Board-nominated senior executive) formally attest that the arrangement complies with the new guidance, subject to later supervisory verification.
• New material outsourcings: Going forward, RLEs must submit a prior notification letter to the Authority before entering a new material outsourcing arrangement; the Authority then has a 20 working day period to request information, object, confirm no objection, or remain silent (silence after 20 days is treated as no objection).
• Governance expectations: Management remains responsible for outsourced activities regardless of outsourcing; RLEs must conduct risk evaluations and service provider due diligence, maintain written outsourcing agreements covering material terms, oversee sub-contracting arrangements, and monitor service provider performance on an ongoing basis.

The guidance also addresses heightened scrutiny for concentration risk, cross-border outsourcing, and outsourcing of innovative technologies such as AI, DLT, or cloud services, requiring more rigorous contingency planning and monitoring where activities cannot easily be transferred back in-house.

Key obligations

• RLEs must maintain policies and procedures to manage, monitor and assess risk of outsourcing arrangements, including criteria for what constitutes a 'material outsourcing'.
• For existing material outsourcings, RLEs must either submit a complete prior approval application to the Authority between 1 October 2019 and 3 January 2020, or provide a CEO (or Board-nominated senior executive) attestation of compliance no later than 30 April 2020.
• If a prior approval submission is deemed incomplete, the RLE loses the pre-approval route for that outsourcing and must use the CEO attestation route instead.
• For new material outsourcing arrangements, RLEs must submit a prior notification letter to the Authority containing specified details before implementation, and observe the resulting 20 working day review period before proceeding.
• RLEs must ensure written outsourcing agreements are in place covering material terms, due diligence, contingency plans, and performance monitoring, and must approve in writing any changes to sub-contracting arrangements before they commence.
• RLEs must apply heightened due diligence, monitoring and contingency planning where outsourcing involves high concentration risk, cross-border service providers, or activities that cannot readily be transferred back in-house.

Applies to

Banks, Deposit Companies, Bermuda Stock Exchange, Corporate Service Providers, Trust Companies, Money Service Businesses, Investment Businesses, Fund Administrators, Credit Union

Deadlines

• 1 May 2020: Guidance comes into force.
• 1 October 2019 to 3 January 2020: Window for RLEs to submit complete prior approval applications for existing material outsourcings.
• 30 April 2020: Deadline for CEO (or nominated senior executive) attestations for existing material outsourcings not submitted for prior approval.
• 60 calendar days: Authority's target timeframe to give a decision after a complete and comprehensive prior approval submission is made.
• 20 working days: Period after receipt of a prior notification letter for a new material outsourcing during which the Authority may request information, object, confirm no objection, or remain silent (silence treated as no objection).