Outsourcing
Also called third-party outsourcing, outsourcing arrangement
Outsourcing is when a regulated firm uses a third party to perform a function, service or activity that the firm would otherwise carry out itself. The firm keeps full regulatory responsibility for the outsourced work. Regulators require firms to assess, contract, monitor and plan an exit for each arrangement, with stricter rules for critical or important functions.
How it works
A bank that moves its payments processing, call centre or cloud hosting to a provider signs an outsourcing agreement. Before signing, it decides whether the function is critical or important, runs due diligence on the provider and agrees contract terms on access, audit, data location and termination. The arrangement is logged in an outsourcing register and reviewed on a set cycle by the business owner and the risk function.
Supervisors treat outsourcing as a transfer of work, not of accountability. A provider failure becomes the firm's own incident, breach or customer harm. Rules in the UK, EU and US therefore focus on governance, concentration on a few large providers and the ability to leave a provider without disrupting services. The EU is widening the concept from outsourcing to all third-party arrangements.
The rules
Set governance, due diligence, contract, register and exit requirements for outsourcing, with extra controls for critical or important functions.
Banks, investment firms, payment and e-money institutionsFinal guidelines covering ICT and non-ICT third-party arrangements, focused on those supporting critical or important functions, with a two-year transitional period.
EU banks and other financial entities within the EBA's remitSets PRA expectations on materiality, due diligence, contracts, data security, business continuity and exit plans for outsourcing and third-party arrangements.
PRA-regulated banks, building societies and insurersPrinciples covering the third-party life cycle; they supersede the 2005 Joint Forum outsourcing paper for the banking sector.
Internationally active banks and their supervisorsCommon questions
Does outsourcing transfer regulatory responsibility?
No. Rules in the UK, EU and US state that the regulated firm remains fully responsible for any function it outsources. The firm's board and senior management stay accountable for the provider's performance and for compliance with regulatory obligations.
What is a critical or important function?
It is a function whose failure would materially impair a firm's regulatory compliance, financial performance or the continuity of its services. Outsourcing a critical or important function triggers stricter due diligence, contract terms, notification and exit planning requirements.
Is cloud computing a form of outsourcing?
Usually, yes. Using a cloud provider to host systems or data that a firm would otherwise run itself is generally treated as outsourcing. In the EU, ICT services including cloud now fall under DORA's third-party risk rules.
Do firms have to tell the regulator before outsourcing?
Rules require advance notification for material or critical arrangements in several regimes. The PRA expects notice of material outsourcing, and EU guidelines require firms to inform supervisors before outsourcing critical or important functions.
