Outsourcing Risk Guidance Note for Banks

Summary

This guidance note sets out the GFSC's expectations for how licensed banks manage risks arising from outsourcing arrangements. It is based on CEBS Guidelines on Outsourcing (2006) and covers definitions, the responsibilities of outsourcing institutions, contractual requirements, and the powers supervisory authorities expect to retain over outsourced activities.

• Senior management responsibility: Ultimate responsibility for risks from outsourcing always remains with the bank's senior management and cannot be delegated, even for outsourced core management functions such as risk strategy setting.
• Core deposit taking and lending activities: Deposit taking and licensable lending activities may only be outsourced to a provider that is equivalently authorised or otherwise legally permitted to carry out those activities.
• Material activity outsourcing: Banks must adequately and promptly inform the Commission before outsourcing material activities and notify it of material developments affecting the service provider's ability to perform.
• Non-material outsourcing: Non-material outsourcing is not restricted and does not require notifying the Commission, but risks must still be actively managed by senior management.
• Outsourcing policy: Banks should maintain a policy covering the full outsourcing lifecycle, including decision making, due diligence, contract drafting, monitoring, and contingency/exit planning.
• Contractual requirements: Outsourcing arrangements must be governed by a formal written contract specifying performance standards, confidentiality protections, audit and inspection rights for internal audit, external auditors and the Commission, notification of material changes, and termination rights required by the supervisory authority.
• Chain outsourcing: Banks must ensure sub-contractors comply with the same obligations owed by the outsourcing service provider, including obligations to the supervisory authority, and manage related risks.
• Ongoing risk management: Banks must continuously assess operational and concentration risk across all outsourcing arrangements and take remedial action where a provider's performance is inadequate.

Part 3 of the note addresses supervisory authorities directly, describing the access, inspection and enforcement rights the Commission expects to have over outsourcing service providers, and its focus on sector-wide concentration risk. The document does not impose specific dates but sets continuing expectations for how banks structure and oversee outsourcing relationships.

Key obligations

• Banks must not outsource deposit taking or licensable lending activities unless the service provider is equivalently authorised or legally permitted to perform them.
• Banks must adequately and in a timely manner inform the Commission before outsourcing material activities.
• Banks must inform the Commission of any material development affecting an outsourcing service provider's ability to fulfil its obligations.
• Banks must retain adequate core competence in house to be able to resume direct control over an outsourced activity if necessary.
• Banks must maintain a written outsourcing policy covering contingency planning and exit strategies for all outsourcing, including non-material and intra-group arrangements.
• All outsourcing arrangements must be governed by a formal written contract addressing defined performance standards, confidentiality, audit and inspection access for internal audit, external auditors and the supervisory authority, notification of material changes, and termination rights.
• Banks must ensure sub-contractors in chain outsourcing arrangements comply with the same obligations owed to the outsourcing institution and the supervisory authority, typically via prior consent clauses.
• Banks must continuously monitor and assess operational and concentration risk arising from outsourcing arrangements and take remedial action where performance is inadequate.
• Outsourcing contracts must allow the outsourcing institution to cancel the contract if required by the supervisory authority.

Applies to

licensed banks, outsourcing institutions, outsourcing service providers