Outsourcing Registers:  Requirements of Central Bank of Ireland

PUBLISHED: 31st August 2022

The Central Bank of Ireland recently published templates and related guidance notes for each of the following sectors to facilitate “recording all relevant outsourcing arrangements and for reporting purposes”:

• Banking - firms categorised as Less Significant Institutions;
• Payments Institutions and Electronic Money Institutions;
• (Re)Insurance Undertakings; and
• Markets Firms

These set out the Central Bank’s requirement that all Irish regulated financial service providers (RFSPs) maintain an outsourcing register.  This development reflects the Central Bank's increased scrutiny of outsourcing arrangements and its strategy of maintaining financial system resilience in light of the increased use by RFSPs of third-party service providers to perform key business functions.

Please see the guidance notes and templates here.

Background

On 17 December 2021, the Central Bank published its Cross Industry Guidance Paper on Outsourcing (the Outsourcing Guidance). The publication followed its consultation on a draft form of the Outsourcing Guidance (CP138) and was accompanied by a Feedback Statement summarising the CP138 feedback, which provides commentary on industry views and explains changes made to the Outsourcing Guidance.

The Outsourcing Guidance applies to all Irish RFSPs in relation to the management of outsourcing activities.  In summary, the Guidance:

1. sets out the Central Bank's expectations on governance and management of outsourcing risks;
2. outlines the Central Bank's expectations for outsourcing frameworks to manage associated risks; and
3. highlights the responsibilities of the board of directors and senior management when outsourcing.

In particular, the Outsourcing Guidance sets out the Central Bank's expectation for each RFSP to develop and maintain an outsourcing register to include prescribed information for all existing and future outsourcing arrangements.  The Central Bank will conduct an analysis and assessment based on the information contained within the completed registers.

Please see our previous briefing on the Guidance here.

Scope

All RFSPs whose PRISM Impact Rating is Medium Low or above (or its equivalent) are required to submit their completed reporting template to the Central Bank through the Online Reporting System (ONR).

All other RFSPs are recommended to complete and maintain an outsourcing register using their relevant industry template.  The Central Bank may request, on a case-by-case basis, RFSPs to submit their outsourcing registers to their supervisors as part of a subsequent collection of registers by the Central Bank.

Timing

All RFSPs whose PRISM Impact Rating is Medium Low or above (or its equivalent) will be required to submit their completed reporting template to the Central Bank through the ONR by close of business on 7 October 2022 (referencing arrangements in place as of 31 December 2021). 

The Central Bank will confirm the outsourcing register submission deadline for 2023 in due course and the submission deadline from 2024 onwards will be at the end of February of each year.

Templates

Outsourcing arrangements are to be reported on a contract-by-contract or written agreement basis on standard templates.  An overview of the requirements is provided below.

1. Cover: records the RFSP's details, including name, legal entity identifier (LEI), level of consolidation and reference date;
2. R01:  records details of all outsourcing arrangements, with additional information required for outsourcing of critical or important functions;
3. Entity Signing: records details on the entity signing the contract;
4. Supervised Entity: records details of the entity supervising the contract;
5. Service Provider:  records details of the third-party service provider carrying out the outsourcing arrangement;
6. Additional General Information: additional information to enable the Central Bank fulfil its regulatory responsibility, including the assessment of concentration risk. This can include information about the RFSP’s business continuity plans, exit strategies, as well as any other outsourcing arrangements in place; and
7. Umbrella Structure:   only applies to funds, records umbrella and sub-fund identification details and details of any outsourcing of final net asset value (NAV) release.

The guidance notes (at Appendix 2) provide information on the categories of outsourced functions and services.  It is a useful guidance tool for mapping purposes. Certain arrangements such as the provision of professional services (e.g., legal, annual audit and advisory services) should be excluded from submission of any register.

Next steps

RFSPs need to ensure that they are compliant with the Outsourcing Guidance and promptly complete the relevant template register and, if in scope, make the necessary ONR filing by the 7 October 2022 deadline.

For further information, please contact a member of our Financial Services Team.