Poland: IT and a So-called "Bank Outsourcing"

What is a "bank outsourcing"?

An amendment of the Polish Banking Law (the Banking Law) came into force more than two years ago, regulating delegating by Polish banks to third parties operations constituting part of a bank’s activity.

Although known as a regulation on the "bank outsourcing", the regulation in question does not concern "outsourcing" in its common meaning as isolating tasks and functions not strictly connected with the main economic activity of the entity and use of services of specialized firms within such scope. Quite the opposite, Articles 6a – 6d of the Banking Law concerning the issue of the said so-called "bank outsourcing" define rules governing entrusting third entities with permanent or temporary:

• intermediation in core banking operations as listed in the Banking Law;
• factual operations connected with a banking activity.

Banking Law surrenders a performance of the "bank outsourcing" contracts to the supervision of the Commission for Banking Supervision (the KNB, from Komisja Nadzoru Bankowego) and limits substantially a freedom of contracting for that type of contract, requiring in particular the following:

• contract in writing with no exclusion or limitation of liability allowed,
• notification of the KNB at least 14 days prior to conclusion a "bank outsourcing" contract,
• preparation of operation plans ensuring continuous and uninterrupted activity within the scope covered by a contract in question,
• consent of KNB for an outsourcer from outside of the EU.

The statutory exclusion of any limitations of liability goes beyond guidelines of the Basel Committee¹ and of the European Committee of Banking Supervisors². One should note that the requirement for unlimited liability of an outsourcer applies also to existing contracts which should be amended accordingly or terminated. In case of failure to comply KNB may impose severe sanctions, in particular dismissal or suspension of members of the management board, financial penalty or withdrawal of a banking license.

Even before coming into force the commented provisions were subject to criticism due to the lack of precision. It is two years since the provisions are binding and those anxieties proved justified. An interpretation of a notion „factual operations connected with banking activity" and setting the criteria for classifying given activity as being governed under the special regime of Article 6a – 6d of the Banking law raises serious doubts. KNB has made some attempts to elucidate those criteria in official explanations addressed to the banks saying that a "bank outsourcing" are all activities having a direct functional relation with performance of banking operations understood as all operations that banks are allowed to conduct according to the Banking Law³. The KNB gives also following indices of identification of the "bank outsourcing": (1) at least a potential access by an outsourcer to data protected by the bank secrecy, (2) influence on an operational activity of the bank, (3) importance for ensuring continuity of a bank’s functioning. As one can see, official interpretations have a truly questionable value.

In most cases even application of the mentioned criteria does not result in a precise answer whether the "bank outsourcing" regime should be applied. Special doubts arise in relation to contracts concerning new technologies. It creates a particular trouble to banks due to constant increase of computerization of banks and development of new systems supporting internal and external business processes of banks. In the cited interpretation, KNB took a definite stand on the issue of commission operations in the scope of information technologies. According to that opinion of the KNB an IT contract should be considered as the "Bank outsourcing" if an outsourcer has access to information vulnerable from the point of view of the banking activity or his operations are important to ensure continuous and uninterrupted functioning of IT systems supporting directly banking operations. KNB enumerates also those operations concerning the use of new technologies in banking activity, which – in its view – are not subject to Articles 6a – 6d of the Banking law.

Any professional will easily find that the list contained in the commented explanation has been prepared without any deeper analysis of issues regarding contracts on IT systems used in banking activity and is partially accidental. That attempt to enumerate new technologies operations which do not need application of special rules caused more harm for the practice than benefits. The list is too vague to form a basis for a decision whether such special regime should be applied. It has to be noted that the enumeration is made from a "negative" approach (named are only particular contracts which do not fall under the "bank outsourcing" regime) while from the practical point of view the positive answer is sought (which contracts are governed). That is a reason why some banks have created specific "presumption" in favor of "outsourcing" on which basis almost all new technologies contracts are classified as outsourcing even when not related to operations directly and functionally connected with banking activity.

From a bank’s perspective notifying the KNB of the contract to be concluded with an outsourcer makes no special difficulties. However, suppliers should expect in such situations that banks will force them to accept full liability for non– or mis-performance of a contract, regardless of the fact whether a bank’s clients are exposed to any harm due to a particular default of the supplier. Negotiating liability clauses in IT contracts is difficult due to the fact that suppliers are reluctant to resign from standard limitations of liability while banks will not risk conflicts with the KNB. Particularly, conflicts with international suppliers are exposed to such conflicts. After implementation of a certain system in many branches of the same bank in other countries, it turns out that a supplier have to accept a removal of limitations of liability. Banks ground their position only on the mentioned interpretation of the KNB which does not even point out directly any contract as governed by the "bank outsourcing" regime.

It seems that although the "bank outsourcing" regulation in the Banking Law is far from perfect, most controversies result from an ultra-cautious approach of Polish banks. Such approach results in increased controversies about application of the regulation on the "bank outsourcing" and sometimes distorts intentions of the legislator and even of the KNB.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.