Date-stamp loading

4. Guidelines on outsourcing (paras. 18-119)

Title I - Proportionality: group application and institutional protection schemes

1 Proportionality

18. Institutions, payment institutions and competent authorities should, when complying or supervising compliance with these guidelines, have regard to the principle of proportionality. The proportionality principle aims to ensure that governance arrangements, including those related to outsourcing, are consistent with the individual risk profile, the nature and business model of the institution or payment institution, and the scale and complexity of their activities so that the objectives of the regulatory requirements are effectively achieved.

19. When applying the requirements set out in these guidelines, institutions and payment institutions should take into account the complexity of the outsourced functions, the risks arising from the outsourcing arrangement, the criticality or importance of the outsourced function and the potential impact of the outsourcing on the continuity of the

Comparing proposed amendment...
Title I - Proportionality: group application and institutional protection schemes (paras. 18-25)
1 Proportionality (paras. 18-20)
2 Outsourcing by groups and institutions that are members of an institutional protection scheme (paras. 21-25)
Title II - Assessment of outsourcing arrangements (paras. 26-31)
3 Outsourcing (paras. 26-28)
4 Critical or important functions (paras. 29-31)
Title III - Governance framework (paras. 32-60)
5 Sound governance arrangements and third-party risk (paras. 32-34)
6 Sound governance arrangements and outsourcing (paras. 35-40)
7 Outsourcing policy (paras. 41-44)
8 Conflicts of interests (paras. 45-47)
9 Business continuity plans (paras. 48-49)
10 Internal audit function (paras. 50-51)
11 Documentation requirements (paras. 52-60)
Title IV - Outsourcing process (paras. 61-108)
12 Pre-outsourcing analysis (paras. 61-73)
12.1 Supervisory conditions for outsourcing (paras. 62-63)
12.2 Risk assessment of outsourcing arrangements (paras. 64-68)
12.3 Due diligence (paras. 69-73)
13 Contractual phase (paras. 74-99)
13.1 Sub-outsourcing of critical or important functions (paras. 76-80)
13.2 Security of data and systems (paras. 81-84)
13.3 Access, information and audit rights (paras. 85-97)
13.4 Termination rights (paras. 98-99)
14 Oversight of outsourced functions (paras. 100-105)
15 Exit strategies (paras. 106-108)
Title V - Guidelines on outsourcing addressed to competent authorities (paras. 109-119)