109. When establishing appropriate methods to monitor institutions’ and payment institutions’ compliance with the conditions for initial authorisation, competent authorities should aim to identify if outsourcing arrangements amount to a material change to the conditions and obligations of institutions’ and payment institutions’ initial authorisation.
110. Competent authorities should be satisfied that they can effectively supervise institutions and payment institutions, including that institutions or payment institutions have ensured within their outsourcing arrangement that service providers are obliged to grant audit and access rights to the competent authority and the institution, in line with Section 13.3.
111. The analysis of institutions’ outsourcing risks should be performed at least within the SREP or, with regard to payment institutions, as part of other supervisory processes, including ad-hoc requests, or during on-site inspections.
112. Further to the information r
…