The Bank of Lithuania prepared and submitted for alignment the draft rules for the outsourcing of functions of financial market participants (hereinafter – Draft Rules), which were prepared in accordance with the 25 February 2019 European Banking Authority Guidelines EBA/GL/2019/02 on outsourcing arrangements.
The Draft Rules set a requirement to have in place regularly reviewed and updated internal policy on the outsourcing approved by the supervisory board, or if the supervisory board is not formed – approved by the management board of the financial market participant, which must be. It should be noted that the Draft Rules establish requirements for the content of the policy on outsourcing, indicating that the policy must cover all the main stages of the process of outsourcing, establish principles, duties and responsibilities related to the outsourcing, etc.
The Draft Rules set out the requirements applicable to agreements for the outsourcing, specifying the mandatory conditions to be included in outsourcing agreements. It should be noted that financial market participants must ensure that the outsourcing agreements concluded before the Draft Rules enter into force must comply with the requirements set out in the Draft Rules not later than by January 1, 2022.
The document also sets out requirements for the monitoring and control of the performance of outsourcing, stating that financial market participants must monitor the level and quality of services provided by service providers on a continuous basis using a risk-based approach. The focus must be on ensuring the performance of important functions, service availability, integrity, data and information security. In the event of an essential change in the nature, scale or risks associated with the functions of the outsourced activity, financial market participants will need to reassess the significance of that function.
The Draft Rules also establish procedures for submitting information on the outsourcing agreement to the Bank of Lithuania and for evaluating this information. After the entry into force of the amendments set out in the Draft Rules, financial market participants for the Bank of Lithuania shall submit a draft outsourcing agreement and a notification regarding conclusion of outsourcing agreement, which shall provide general information on the outsourcing and specify the clauses of the agreement that implement each of the mandatory requirements set out in the Draft Rules for the outsourcing agreement.
In particular, financial market participants, before concluding an outsourcing agreement, must assess the potential impact of the outsourcing on the financial market participant’s operational risk, take into account the results of this impact assessment when deciding whether to outsource certain functions and take the necessary steps to avoid unjustified additional operational risk. The risk assessment must be carried out both before the outsourcing agreements are concluded and through continuous monitoring of the performance of the service provider of important functions – financial market participants must regularly update the risk assessment of outsourcing agreements and service providers and periodically report to the management body on the identified risks associated with the outsourcing.
It should be noted that the Draft Rules provide stricter requirements for outsourcing than currently established in the existing legislation. Many of the above-mentioned requirements set out in European Banking Authority Guidelines EBA/GL/2019/02 of 25 February 2019, on which financial market participants could rely as good practice, will become mandatory upon the entry into force of the Draft Rules. In this context, financial market participants are advised to have internal procedures in place to ensure compliance with the requirements set out in the Draft Rules.
Newsletter Subscription
Get in touch