EBA Guidelines on Outsourcing: Implementation and how to become compliant

Implementation and how to become compliant

EBA Guidelines on Outsourcing:

1

Ole Horsfeldt

Tue Goldschmieding

Morten Nybom Bethe

Partner

Partner

Partner

D +45 33 41 43 65 M +45 24 28 68 40 oho@gorrissenfederspiel.com

D +45 33 41 42 03 M +45 24 28 68 75 tgg@gorrissenfederspiel.com

D +45 33 41 41 14 M +45 40 31 89 42 mnb@gorrissenfederspiel.com

Introduction EBA as an institution

EBA Guidelines and Danish Implementation In recent years, businesses have had an increased focus on outsourcing of a variety of business activities in pursuit of cost reductions as well as increased flexibility and efficiency. This trend is especially seen within the financial sector as new financial technologies (fintech) are offered through outsourcing arrangements.

Part of the draft legislation will be an amendment to the current Danish Executive Order on Outsourcing implementing the requirements under the EBA Guidelines. The draft legislation states that the implementation will be as close as possible to the wording and structure of the EBA Guidelines.

To ensure that financial institutions are, among other things, sufficiently suited to handle the increase in the number of outsourcing arrangements and to ensure that functions are properly (sub-) outsourced, the Danish Ministry of Ministry of Industry, Business and Financial Affairs has published a draft amendment to the Danish Financial Business Act. The scope of the amendment is to implement the EBA Guidelines on Outsourcing in Danish law, and will according to the plan, come into force on July 2020.

Under the draft amendment, insurance undertakings will be subject to legislation separate to other financial institutions through an executive order, which will apply to both group 1 and group 2 insurance undertakings.

2

Definition of Outsourcing … and what to consider for institutions

The current Danish Executive Order on Outsourcing (in Danish “Outsourcingbekendtgørelsen”) only governs financial institutions’ outsourcing of material business processes.

With the Guidelines and the new draft proposal for the bill implementing them in Danish law, the definition of outsourcing and thus the applicability of the Guidelines and future Danish legislation has been expanded significantly. Moving forward, financial institutions must not only comply with the Guidelines when dealing with classic material outsourcing but when entering into any type of arrangement that falls under the new broader definition, which includes core business processes, outsourcing of IT and all types of cloud services, e.g. SaaS, PaaS and IaaS.

“Critical” and “important” outsourcing arrangements must comply with additional requirements under the Guidelines, e.g. ensuring that the service provider has sufficient reputation and expertise to meet its obligations and comply with an extended list of explicit requirements for the written outsourcing contract. The concepts of defining “critical” and “important” outsourcing can be seen as a counter-measure to the extended definition of outsourcing and thus the scope of the Guidelines’ applicability. By limiting some of the Guidelines’ requirements to outsourcing arrangements of lower criticality or importance, the Guidelines become more agile and more easily applicable to all types of outsourcing.

This new approach means that financial institutions must acknowledge and consult the Guidelines in their everyday contracting and sourcing. The change may result in a new approach towards compliance in outsourcing in all parts of the financial institution’s line of business.

Moving forward, financial institutions must therefore conduct an assessment of the criticality and importance of the outsourced business process to identify which of the requirements under the Guidelines are necessary to meet in order to ensure compliance.

This general rule is, however, supplemented by a list of exceptions that will not be considered outsourcing despite the extended scope of the definition.

3

Critical/important outsourcing

1 2

General rule “Outsourcing” means an arrangement of any form between an institution and a service provider by which that service provider performs a process, a service or an activity that would otherwise be undertaken by the institution itself.

Exceptions The following should not be considered outsourcing: a. a function that is legally required to be performed by a service provider, e.g. statutory audit; b. market information services (e.g. provision of data by Bloomberg, Moody’s, Standard & Poor’s, Fitch); c. global network infrastructures (e.g. Visa, MasterCard); d. clearing and settlement arrangements between clearinghouses, central counterparties and settlement institutions, and their members; e. global financial messaging infrastructures that are subject to oversight by relevant authorities; f. correspondent banking services; and

3

g. the acquisition of services that would otherwise not be undertaken by the institution or payment institution, e.g. cleaning, building maintenance, advice from lawyers or architects, purchase of goods and utilities.

Critical or important outsourcing All functions of institutions which are a necessity for carrying out core business activities must be regarded as critical or very important. There are several different factors to consider when assessing whether an outsourcing scheme relates to a function that is critical or very important.

The following are always considered critical or important functions: a. where a defect or failure in its performance would materially impair compliance with conditions of authorisations, financial performance or soundness or continuity of banking and payment services: b. when operational tasks of internal control functions are outsourced, unless non-performance from the service provider is assessed to not adversely impact the effectiveness of the internal control function. c. when functions of banking activities or payment services are outsourced to an extent that would require authorisation by a competent authority, as referred to in Section 12.1 in the Guidelines.

4

Timeline for being

compliance

Ongoing basi

30 September 2019 The revised Guidelines entered into force, thus, applying to all new, reviewed or amended arrangements on or after this date.

25 February 2019 EBA published their revised Guidelines.

5

Transitional prov ons where instit ons must review amend all existi outsourcing arra gements to ensu compliance.

is

visitutiand ing anure

July 2020 Following the amended act Implementation of amended Executive Orders on Outsourcing for insurance undertakings and other financial institutions.

The amendment to the Danish Act on Financial Business is expected to come into force.

31 December 2021 All outsourcing agreements, new and existing, must be compliant with the revised Guidelines.

If critical or important outsourcing arrangements are not compliant, the institution must inform their competent authority.

6

Requirements Internal governance requirements The Guidelines set out several requirements to financial institutions’ internal governance setup, including both new requirements as well as elaboration on existing requirements under the previous guidelines and national legislation on financial institutions’ outsourcing arrangements. The most important new governance-related requirements under the Guidelines is a list of specific overarching responsibilities that cannot be delegated from the institution’s management to an outsourcing supplier.

In relation to the above, financial institutions must assign the responsibilities for documentation, management, and control of outsourcing arrangements. This widereaching governance requirement includes a duty for financial institutions to appoint a senior staff member as accountable for outsourcing arrangements in order to ensure proper contract management of outsourcing arrangements and sufficient responsibility allocation within the organisation.

As another significant requirement under the revised Guidelines, financial institutions must allocate adequate and available resources to ensure proper contract management such as business conduct, contract and risk management and legal compliance. The EBA describes this requirement as a way to counter financial institutions becoming empty shell corporations outsourcing

7

every business process without actual staff or services being conducted in-house.

In addition, several audit related requirements as well as handling of conflict of interests, which also target intra-group outsourcing arrangements, are included under the revised Guidelines.

Below are listed examples of internal governance requirements under the Guidelines to be followed by financial institutions: ▪ Conflict of interest, including intra-group outsourcing arrangements, must be actively monitored and managed.

▪ Internal audits must include an independent review of outsourcing arrangements.

▪ Institutions must keep an up-to-date outsourcing policy and an outsourcing log of all outsourcing arrangements and contents hereof at all times.

▪ In addition to the Guidelines, institutions must take EBA Guidelines on Internal Governance into account.

Notice requirements Clear and open communication and collaboration between financial institutions and the supervisory authorities are necessary for ensuring sufficient supervision and transparency in the financial market as a whole. The revised Guidelines cater for this communications need through several notice requirements.

Most noticeable, financial institutions must give notice to and engage in dialogue with supervisory authorities when amending or entering into new critical or important outsourcing arrangements. This requirement is to be seen in connection with the need for providing adequate information on all outsourcing arrangements upon request from the relevant authorities. The content of such notices are not described in detail in the Guidelines, which shows the wish for an ongoing collaboration in good faith rather than implementing inflexible standardised reporting regimes between the supervisory authority and the financial institutions. The ongoing provision of information to supervisory authorities is linked to a new requirement for financial institutions to keep an updated log or database over all its outsourcing arrangements and the contents of such agreements.

The Guidelines includes several notice requirements: ▪ Notice must be provided to relevant authorities if existing critical or important outsourcing arrangements are non-compliant with the Guidelines on 31 December 2021, ▪ Upon request, provide information on all outsourcing arrangements for example by disclosing the institution’s outsourcing log, ▪ Upon request, provide adequate information for authorities to perform effective supervision, including copies of the outsourcing agreements, ▪ Institutions must inform and engage in dialogue with authorities relating to outsourcing of critical or important functions and changes in such arrangements.

8

Contract Market standards for the revised Guidelines The Guidelines aim to ensure that institutions can apply a single framework on outsourcing for all their banking, investment and payment activities and services.

Each outsourcing relationship, i.e. not only for critical or important functions, must be governed by a sound written outsourcing agreement that allocates the rights and obligations of the institution and supplier. The agreement must at least include the themes and terms described in the table to the left. Many of these are already common market practices but the most essential new requirements, aside from a highly detailed description of the already known areas subject to regulation, are reporting requirements and frequency, service delivery locations and an extended audit and inspection right for the customer and public authorities.

We greet the Guidelines welcome as many of the new contractual requirements touch upon areas, which in our opinion are highly important to regulate in order to

9

achieve a useful and practically manageable outsourcing agreement. However, at the same time, the introduction of extensive contractual requirements together with a need for compliance not only for new but also for all existing outsourcing arrangements will become a complex and comprehensive task for all financial institutions in the near future.

Given that these new requirements are based on what we believe will become mandatory legal requirements, we do not expect the implementation process into existing outsourcing contracts to be difficult. However, the commercial aspects relating to such implementation are not governed by the Guidelines and thus the need for new and stricter provisions may lead to renewed negotiations on price and risk allocation.

Clear service descriptions Financial obligations System and data security Data privacy protection Risk analysis and contingency plans Governing law and dispute resolution Sub-contractors and service locations Reporting obligations to authorities Termination, re-transfer and step-in Access, monitoring and audit rights 10

GF’s EBA Guidelines compliance offerings Benefits ▪ Efficient training of existing and new team members ▪ Access to best practice policies and procedures ▪ Consistent and cost efficient assessments ▪ Use of best practice compliant contract terms and conditions ▪ Easy accessible and concise document of compliance

11

Gorrissen Federspiel has establishing an offering aimed at financial institutions, and which will include the following features:

E-learning module on the rules and how to comply

Compliance documentation per contract ▪ Completed GF tracker tool per contract Assessment of current or future agreements ▪ Fixed price assessment of needs for updating per document or portfolio of documents ▪ Provision of compliant best practice terms and conditions in rider format ▪ Negotiation support leveraging our experience from dealings with suppliers across many engagements

Template policies, notifications, assessments, and registers ▪ Customised and completed to meet specific client requirements

Guidance library ▪ Guidance notes on commonly encountered issues

12

Axeltorv 2 1609 Copenhagen V Denmark T +45 33 41 41 41 Silkeborgvej 2 8000 Aarhus C Denmark T +45 86 20 75 00 www.gorrissenfederspiel.com