Definition of outsourcing
In our view, the definition of outsourcing used in the draft Guidelines is ambiguous and too wide in scope. As currently phrased, it would include any service provided, including those that have no link with any of the core activities of the serviced institution. We would recommend the EBA to clarify that the guidelines only apply to those activities that are within the scope of financial services provision/licensed service activities.
Important and critical functions
We are concerned by the ambiguity of the term “important and critical function”. Does this imply that the outsourced function in question is necessarily both important and critical, or is it possible to be categorised as such when the function is only important or critical? Also, it is unclear if “important” and “critical” functions represent different levels of importance and, if yes, whether all outsourcers should be audited in the same manner.
We agree with the EBA’s view that institutions need to have business continuity and contingency arrangements in place to ensure that their material business activities can be performed on a continuous basis. The EBA provides that institutions should develop and implement exit plans that are comprehensive, documented and sufficiently tested. We would welcome more clarity on the “sufficient test” requirement. More specifically, we would like the EBA to confirm that this does not require institutions to have in place alternative providers, which would be a very costly and burdensome requirement.
We agree with the EBA on the importance of adequate documentation of the relevant outsourcing arrangements.
However, we are concerned about the requirement to make available the register of all existing outsourcing arrangements to the competent authority in a common data base format within each supervisory review and evaluation process. In our view, this is a too burdensome requirement, especially for smaller players, and for this reason, is also not required on national level. We believe that such regular reporting should be restricted to the critical and important outsourcing of significant institutions. Alternatively, we would recommend the ad hoc presentation of the information, rather than putting in place a register.