On June 22, 2018, the European Banking Authority launched a consultation on draft Guidelines on outsourcing arrangements. The proposed Guidelines are intended to update and replace the outsourcing guidelines issued in 2006 (by the EBA's predecessor, the Committee of European Banking Supervisors) that applied to outsourcing by credit institutions. The proposed Guidelines will have a wider scope, applying to all financial institutions that are within the scope of the EBA's mandate, namely credit institutions and investment firms subject to the Capital Requirements Directive, payment institutions and electronic money institutions. The proposed Guidelines also integrate the recommendation on outsourcing to cloud service providers that was published by the EBA in December 2017.
The proposed Guidelines set out a definition of outsourcing in line with delegated legislation under the revised Markets in Financial Instruments Directive. They cover: (i) proportionality and group application; (ii) the nature of outsourcing arrangements; (iii) the applicable governance framework; (iv) the outsourcing process; and (v) guidelines on outsourcing addressed to competent authorities. A separate Annex provides an illustrative template that could be used for complying with the requirement in the proposed Guidelines to maintain a register of all outsourcing arrangements at institution and group level where applicable.
The proposed Guidelines should be read in conjunction with the EBA guidelines on internal governance, the EBA guidelines on common procedures and methodologies for the supervisory review and evaluation process and the EBA guidelines on ICT risk assessment under the Supervisory Review and Evaluation Process. For payment institutions, the proposed Guidelines should be read in conjunction with the EBA guidelines on the information to be provided for the authorization of payment institutions under the revised Payment Services Directive, the EBA guidelines on security measures for operational and security risks under PSD2 and the EBA guidelines on major incident reporting under PSD2.
The EBA will hold a public hearing on the proposed Guidelines on September 4, 2018. Comments on the consultation are invited by September 24, 2018. The EBA will then finalize the draft Guidelines and the CEBS guidelines will be repealed once the new Guidelines take effect.
The consultation paper is available at:
http://www.eba.europa.eu/documents/10180/2260326/Consultation+Paper+on+draft+Guidelines+on+outsourcing
+arrangements+%28EBA-CP-2018-11%29.pdf, the Annex is available
at:
http://www.eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements,
the online response form is available at: http://bit.ly/2McnwGu, the
registration page for the public hearing is available at:
https://www.eba.europa.eu/meeting-registration/public-meetings/2018/public-hearing-on-a-cp-on-gl-on-outsourcing
and the Recommendation on outsourcing to cloud service providers is
available at:
https://www.eba.europa.eu/documents/10180/2170121/Final+draft+Recommendations+on+Cloud+Outsourcing+%28EBA-Rec-2017-03%29.pdf.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
