Intra Group Outsourcing Agreement
Covered companies must also take into account the strict requirements of the guidelines with respect to the framework, the internal structure of the group, the approach to risk assessment and diligence, and the content of outsourcing contracts. Where an institution has not concluded, no more than December 31, 2021, a review of an outsourcing agreement for “critical or important functions,” the appropriate authority should be informed, along with an explanation of the steps the institution intends to take to conclude the review or terminate the agreement. We view the provision of cloud services for the provision of important business functions as a form of potential outsourcing of materials. Businesses can use cloud services if they follow our rules. The ACF will consider the requirements and guidelines set out in (2) to (4) when reviewing a company`s outsourcing agreements. We explain the impact on the operational resilience of outsourcing companies and others, and what we expect from them. The guidelines apply to all outsourcing agreements; However, expectations are adjusted so that more detailed requirements apply to outsourcing agreements, which relate to “critical or important functions.” As noted above, the guidelines take into account the principle of proportionality. During the consultation, some of them felt that it would be extremely difficult to obtain prior authorization for sub-outsourcing and sought clarification on whether the authorization was general in nature or whether the institution should agree to any subcontracting cases. The EBA analysis made it clear that prior authorization can be generalized. As explained in the 3.2.4G system, an entity cannot meet its regulatory obligations and must ensure that it ensures that outsourced functions are fulfilled.
This section provides additional guidance on the management of outsourcing contracts (and will, to some extent, be relevant to other forms of third-party dependency) with respect to operational risk. Outsourcing can affect a company`s risk relative to operational risks, as the personnel, processes and systems used in outsourced activities are significantly modified and control of them is limited. A company should not consider that, since a service provider is either a regulated business or an intragroup enterprise, an outsourcing agreement with that supplier as such necessarily results in a reduction in operational risk. The guidelines came into effect on September 30, 2019 for outsourcing agreements, including those that began, revised or amended on or after that date. There are also transitional provisions for cooperation agreements until 2021, an outsourcing register and revision of existing “critical or important” outsourcing agreements concluded before 30 September 2019.