Are paragraphs 98 and 99 (section 13.4) of EBA/GL/2019/02 - Guidelines on outsourcing arrangements directed towards ‘outsourcing arrangements for critical and important functions’ only or ‘all outsourcing arrangements’?
Guideline 75 sets out a list of matters which are to be included in outsourcing agreements for critical and important functions. Paragraph q of that list (75(q)) provides that outsourcing agreements for critical and important functions should at least include the “termination rights, as specified in Section 13.4”. Section 13.4 (which comprises guidelines 98 and 99) does not explicitly refer to outsourcing arrangements for critical and important functions or state that it is intended to be directed towards 'all’ outsourcing agreements regardless of the criticality or importance of the function to which they relate. It refers only to ‘the outsourcing arrangement’.
Our view is that the EBA intends for guidelines 98 and 99 to be directed towards arrangements for critical and important functions only and not all outsourcing arrangements. The reference to ‘the outsourcing arrangement’ in guidelines 98 and 99 should be read as a reference to ‘the outsourcing arrangements for critical and important functions’ and not as a reference to ‘all outsourcing arrangements regardless of the criticality or importance of the function to which they relate’.
To extend the application of guidelines 98 and 99 to all outsourcing arrangements would (1) be out of line with the approach the EBA took in its Consultation Paper, EBA Draft Guidelines on Outsourcing (June 2018) ("Consultation Paper"); (2) be inconsistent with the general approach the EBA has taken towards risk management in the final guidelines and disproportionate to the risks presented by outsourcing arrangements that do not relate to critical or important functions; and (3) render guideline 75(q) of little practical effect.
The Consultation Paper listed contractual requirements applicable to all outsourcings in draft guideline 63, and separately listed those only applicable to critical or important in draft guideline 64. The Consultation Paper specified that the termination rights set out in guidelines 98 and 99 apply only to critical or important outsourcing (see draft guideline 64(g)).
The final guidelines however change this approach and contain only a list of matters to be included in the outsourcing agreement for critical or important functions (guideline 75). That list contains some matters taken from the ‘all outsourcing’ list set out in draft guideline 63 of the Consultation Paper.
Our view is it would be a material departure from the EBA’s approach in its Consultation Paper to apply guidelines 98 and 99 to all outsourcing arrangements, in particular without having referred to that possibility during the consultation period or clarified why it changed its position in the comments provided in its final report.
Further, the use of the terminology “as specified in” as it appears in guideline 75(q) indicates that the EBA intends for guidelines 98 and 99 to be directed towards outsourcing agreements for critical and important functions only. The words “as specified in” were also used in draft guideline 64(g) of the Consultation Paper. While guidelines 98 and 99 do not explicitly state that they apply only to outsourcing arrangements for critical or important functions, neither did the equivalent draft guidelines in the Consultation Paper (draft guidelines 81 and 82). While the application only to critical or important functions in the Consultation Paper was clearer (because it split out the list of matters to be included in all outsourcing agreements from the narrower list of matters for critical or important functions and only the latter incorporated the termination rights by reference), our view is that it now makes sense to read the reference to “as specified in” in guideline 75(q) in the context of the same terminology as it appeared in draft guideline 64(g) of the Consultation Paper – the intention being that the termination provisions referred to apply only to agreements which relate to the outsourcing of critical or important functions.
EBA’s general approach to risk
In another context the guidelines specify that a guideline is to apply 'regardless of the criticality or importance of the function' (see guideline 86). As no such statement has been made in respect of guidelines 98 and 99, our view is that this further indicates that the references in guidelines 98 and 99 to ‘the outsourcing arrangement’ should be read as references to an outsourcing arrangement which relates to a critical or important function.
Guideline 75(q) would be of little practical effect if financial institutions and payment institutions were required to observe guidelines 98 and 99 regardless of the criticality or importance of the function.
The structure of EBA/GL/2019/02 - Guidelines on outsourcing arrangements, reviewed after the public consultation based on the comments received, aims at differentiating in a better way the requirements between the outsourcing of critical and important outsourcing, to which a stricter framework applies, and other non-material outsourcing, where a more principle-based approach should be adopted.
EBA/GL/2019/02 define a range of criteria for the identification of critical or important functions, i.e. those activities whose outsourcing may have a stronger impact on the financial institution’s risk profile or on its internal control framework.
The Guidelines provide, inter alia, specific guidance on the relationship between the institutions and payment institutions and their service providers, including on their rights and obligations, also by indicating a set of aspects that should be encoded within the written outsourcing agreements.
More specifically, Section 13 of the Guidelines – dedicated to the contractual phase – first clarifies that for all outsourcing arrangements the rights and obligations of the parties should be clearly allocated and set out in a written outsourcing agreement (paragraph 74). Paragraph 75 of the Guidelines focuses on the specific requirements that should be set out explicitly in the outsourcing agreements concerning critical or important functions. Point (q) of paragraph 75 of the Guidelines specifies that the contract should at least include “termination rights, as specified in Section 13.4”. Section 13.4 of the Guidelines sets out the expected termination clauses including the obligations of the existing service provider aimed at facilitating the transfer of the outsourced function to another service provider, or its reinternalization, to be included in the written outsourcing agreements.
In line with the above-mentioned approach, Section 13.4 of the Guidelines should therefore be applied to the outsourcing arrangements of critical or important functions.
However, institutions and payment institutions may consider it appropriate to apply these requirements, or parts thereof, also to other outsourcing arrangements, on a risk-based approach (i.e., considering the nature of the outsourced function and the related operational and reputational risks, the potential impact on the continuous performance of its activities and the contractual period, also bearing in mind that functions may become critical or important over time). In addition, it is common practice that contracts, including for outsourcing arrangements that are not critical or important, can be terminated under certain conditions. However, for outsourcing arrangements that are not critical or important no further conditions have been specified in the guidelines.