CEBS GUIDELINES OUTSOURCING PDF
The Draft Guidelines, which review the existing CEBS Guidelines on Outsourcing published in (CEBS Guidelines), are the EBA’s. on outsourcing. by PLC Financial Services. Related Content. CEBS: Guidelines on outsourcing. by PLC Financial Services. Related Content. They review the existing Committee of European Banking Supervisors (CEBS) guidelines on outsourcing, which were published in
|Published (Last):||9 November 2017|
|PDF File Size:||3.30 Mb|
|ePub File Size:||12.46 Mb|
|Price:||Free* [*Free Regsitration Required]|
Discussion of Key Themes. The attendees at the Public Consultation raised a number of questions which have, no doubt, given the EBA considerable food for thought.
EBA Consults on Outsourcing Arrangements
This blog post identifies and explores the key themes of the day. Beyond the key themes identified below, the Public Consultation included discussions of the issues of internal audit, reporting and registration, and supervisory oversight. Many attendees at the Public Consultation noted that this scope was unduly onerous and would become administratively burdensome for firms to manage. Notably, the broadening of the addressees of the Draft Guidelines In-scope Entitiesto include payment institutions subject to the revised Payment Services Directive PSD2 and electronic money institutions subject to the e-money Directivewas not discussed in detail at the Public Consultation.
However, an attendee raised a question as to the applicability of the Draft Guidelines to industry utilities. The EBA confirmed they had not yet considered this point and advised that they would reflect and clarify the position in the final guidelines.
The Draft Guidelines state that intra-group arrangements, as well as third-party outsourcings, must comply with the Draft Guidelines.
At the Public Consultation, the EBA confirmed that intra-group arrangements should be subject to the same degree of cebbs and risk guuidelines as third-party arrangements, but noted that this scope was not new and was already a requirement pursuant to Article of Capital Requirements Directive CRD IV.
As many In-scope Outsourcinv set about moving key operations out of the UK and to other EU member states, intra-group outsourcing arrangements will become increasingly critical. In-scope Entities should therefore review the terms of their intra-group agreements and think about their current operational measures and controls to manage intra-group arrangements. The EBA also emphasised the need for a cooperation agreement between relevant competent authorities if the outsourcing service provider is located in a third country see paragraph 26 of the Draft Guidelines.
This raises the obvious question about the need for such an agreement between EU regulators and the FCA post-Brexit; unfortunately, the EBA advised that the status of any work regarding cooperation agreements fell outside of the remit of the Public Consultation. As a result, both cloud and FinTech featured heavily on the agenda at the Public Consultation. The Cloud Recommendations, published on 20 Decemberbecame effective as of 1 July These recommendations, addressed to credit institutions, investment firms, and competent authorities Cloud Recommendations Addresseesexamine the key considerations for a relevant institution that outsources services to a cloud environment.
The Cloud Recommendations were published ahead of the full revision of the CEBS Guidelines, due to guideilnes for timely guidance in this area. The Draft Guidelines aim to integrate the Cloud Recommendations, and the Cloud Recommendations will be repealed when the final outsourcing guidelines take effect.
Therefore, In-Scope Entities will need to consult only one set of guidelines for outsourcing both cloud and non-cloud. Interestingly the Draft Guidelines do not address the fact that integrating guidelines means that payment institutions and electronic money institutions will, from cbes effective date of the Draft Guidelines, be subject to the cloud considerations even though such institutions are not currently in scope of the Cloud Recommendations Addressees.
Certain competent authorities, such as BaFin in Germany, have already confirmed that they will postpone local implementation of the Cloud Recommendations until such time as the recommendations are integrated into the new outsourcing guidelines and, at that time, will comply with the guidekines timeline for such guidelines see The Recommendations Compliance Table.
This announcement by the FCA albeit made to very little fanfare was generally welcomed by both UK financial institutions and cloud providers as the announcement relieves them of the burden of complying with two sets of guidance which, though similar, included nuanced differences.
CEBS: Guidelines on outsourcing | Practical Law
Also notably, this FCA announcement was most likely a political nod to European regulators that UK febs services firms are expected to remain compliant with the leading European guidance on outsourcing to the cloud. Going forward, it will be interesting to see how the FCA responds to the introduction of the outsourcing guidelines and, as a result, repeal of the Cloud Recommendations which are scheduled to come into effect after the UK has left the EU. If a competent authority considers concentration risk to be too great, then it may order the cessation of such an arrangement.
This approach was challenged at the Public Consultation on the grounds it could lead to operational risk, in particular in connection with cloud outsourcing arrangements.
Responding to these concerns Bernd Rummel of the EBA noted that the guixelines authorities would be in regular dialogue with In-scope Entities and would not exercise such a right without consultation.
That said, the potential systemic risk implications of the use of cloud arrangements is an area of focus for banking regulators and should be monitored going forward. However, in light of the broad reach of the Draft Guidelines, In-Scope Entities leveraging third parties to enhance their FinTech offerings will need to take account of the Draft Guidelines once they take effect when engaging with FinTech providers.
This requires In-Scope Entities to balance the drive to be innovative and market-leading which appears to be encouraged by the EBA in the FinTech Roadmap with the need to implement robust contractual arrangements and operational processes to manage risk as required by the Draft Guidelines.
Notwithstanding, it seems unlikely that the EBA will make any concessions in the final guidelines for FinTech providers. In-Scope Entities, therefore, need to start thinking, ahead of the implementation date, about how best to reconcile the desire to engage with start-ups and innovation hubs within a reasonably rigid uotsourcing of rules and requirements for third-party contracting.
The Public Consultation consisted of industry bodies, bank representatives, cehs firms, service providers and industry utilities in deep discussion and questioning the EBA for two hours. It is fair to say that the EBA now has a considerable amount of homework. In the Draft Guidelines, the expected timeline for implementation of the new guidelines is ces June and the grace period for updating existing outsourcing arrangements in line with the new guidelines is 31 December This is a relatively short period of time considering not only the scope of the new guidelines, but also the breadth of change In-scope Entities face in the coming 12 months.
One attendee at the Public Consultation requested that the EBA extend the timeline for implementation, but whether the EBA will heed this or any of the recommendations made at the Public Consultation, remains to be seen.
In the meantime, In-scope Entities are advised to take account of the Draft Guidelines in their outsourcing plans and start preparing for the internal changes required if the Draft Guidelines change only minimally before coming into effect. Next Steps The Public Consultation consisted of industry bodies, bank representatives, law firms, service providers and industry utilities in deep discussion and guidepines the EBA for two hours.