21. In accordance with Article 109(2) of Directive 2013/36/EU, these guidelines should also apply on a sub-consolidated and consolidated basis, taking into account the prudential scope of consolidation [Please refer to Article 4(1) points (47) and (48) of Regulation (EU) No 575/2013 regarding the scope of consolidation.]. For this purpose, the EU parent undertakings or the parent undertaking in a Member State should ensure that internal governance arrangements, processes and mechanisms in their subsidiaries, including payment institutions, are consistent, well integrated and adequate for the effective application of these guidelines at all relevant levels.
22. Institutions and payment institutions, in accordance with paragraph 21, and institutions that, as members of an institutional protection scheme, use centrally provided governance arrangements should comply with the following:
a. where those institutions or payment institutions have outsourcing arrangements with service providers
…