Guidance Note on the Outsourcing of Functions by Entities Licensed Under The Protection of Investors (Bailiwick of Guernsey) Law, 2020

Summary

This is a guidance note from the Guernsey Financial Services Commission setting out its expectations for outsourcing arrangements entered into by entities licensed under the Protection of Investors (Bailiwick of Guernsey) Law, 2020. It applies whether functions are outsourced to an affiliated group entity or an external third party, and whether the service provider is inside or outside the Bailiwick. The Commission does not pre-approve outsourcing arrangements but expects to be told about them and will assess compliance with this guidance during ongoing monitoring, including on-site visits.

• Principle 1: Licensees must carry out due diligence when selecting a service provider and establish documented processes to monitor its ongoing performance and compliance.
• Principle 2: There must be a legally binding written contract with each service provider, with detail proportionate to the materiality of the outsourced activity, covering matters such as subcontracting, confidentiality, responsibilities, IT security, liability, dispute resolution, business continuity, choice of law, and termination/exit.
• Principle 3: Licensees must ensure procedures protect proprietary and client data and software, and that service providers maintain emergency and disaster recovery procedures with periodic testing.
• Principle 4: Licensees must require service providers to protect confidential firm and client/investor information from unauthorised disclosure.
• Principle 5: Contracts should set out termination procedures, including triggers (e.g. insolvency, poor performance), transition periods, and return/transfer of data and intellectual property.
• Principle 6: The Commission, the licensee, and its auditors must have access to service providers' books and records relating to outsourced activities, and the Commission must be able to obtain information promptly on request.
• Principle 7: Licensees should assess and manage concentration risk where a single service provider serves multiple licensees.
• Fund liaison: For open-ended collective investment schemes, the Designated Administrator should keep the Designated Trustee/Custodian informed of outsourcing proposals and obtain its acceptance of the arrangements.

Ultimate responsibility and accountability for outsourced functions always remains with the Guernsey Licensee, including its Board and Senior Management, who must retain sufficient expertise to oversee the delegate and ensure the mind and management of the operation stays within the Bailiwick. Licensees should review existing outsourcing arrangements against this guidance and take corrective action where they fall short.

Key obligations

• Licensees must conduct due diligence before selecting a third party service provider and maintain documented procedures to monitor the provider's ongoing performance and compliance.
• Licensees must have a legally binding written contract with each service provider covering matters proportionate to the materiality of the outsourced function, including subcontracting, confidentiality, IT security, liability, business continuity, and termination/exit provisions.
• Licensees must ensure procedures are in place to protect proprietary and client information and software, and that service providers maintain emergency procedures and disaster recovery plans with periodic testing of backup facilities.
• Licensees must take steps to ensure service providers protect confidential firm and client/investor information from unauthorised disclosure.
• Licensees must ensure the Commission, the licensee itself, and its auditors have access to and rights of inspection over service providers' books and records relating to outsourced activities.
• Licensees must consider and manage concentration risk where a service provider serves multiple licensees.
• Licensees must communicate with the Commission at an early stage about proposals to outsource functions or changes to existing outsourcing arrangements.
• Boards and Senior Management must retain sufficient expertise to oversee outsourced functions and keep outsourcing arrangements under regular review.
• Existing outsourcing arrangements must be reviewed against this guidance note and corrective action taken where they do not meet its requirements.
• Designated Administrators of open-ended collective investment schemes should keep the Designated Trustee/Custodian informed of outsourcing proposals and obtain the Trustee/Custodian's acceptance of arrangements.

Applies to

Entities licensed under the Protection of Investors (Bailiwick of Guernsey) Law, 2020, Designated Administrators, Investment Managers, Asset Managers, Designated Trustees/Custodians of open-ended collective investment schemes