74. The rights and obligations of the institution, the payment institution and the service provider should be clearly allocated and set out in a written agreement.
75. The outsourcing agreement for critical or important functions should set out at least:
a. a clear description of the outsourced function to be provided;
b. the start date and end date, where applicable, of the agreement and the notice periods for the service provider and the institution or payment institution;
c. the governing law of the agreement;
d. the parties’ financial obligations;
e. whether the sub-outsourcing of a critical or important function, or material parts thereof, is permitted and, if so, the conditions specified in Section 13.1 that the sub-outsourcing is subject to;
f. the location(s) (i.e. regions or countries) where the critical or important function will be provided and/or where relevant data will be kept and processed, including the possible storage location, and the conditions to be met, includin
…