On 19 November 2018, the Central Bank of Ireland (the "Central Bank") published a discussion paper entitled "Outsourcing – Findings and Issues for Discussion" (the "Discussion Paper") containing a summary of key issues and risks identified by the Central Bank requiring prompt attention by industry. The closing date for submission of responses to questions posed in the Discussion Paper is 18 January 2019.
The findings in the Discussion Paper are underpinned by both the Central Bank's supervisory engagements with industry along with responses received from a recent cross-sectoral outsourcing survey (completed by 18 banks, 82 asset management sector firms, 83 insurers and 2 payment institutions).
In its announcement of the publication of the Discussion Paper, the Central Bank noted it has observed:
- a significant increase in reliance on outsourcing of activities (both on an intragroup and third party basis) by regulated financial service providers;
- serious deficiencies in board awareness and understanding of the extent of reliance on outsourcing; and
- major weaknesses in relation to risk management controls and processes, and business continuity planning around outsourcing.
The Central Bank expects all regulated financial service providers to review their current practices against the Discussion Paper.
Format of the Discussion Paper
The Discussion Paper is split into two sections. Part A deals with the Central Bank's minimum supervisory expectations around the management of outsourcing risks and sets out the Central Bank's findings in relation to current practices in the Irish market, while highlighting particular weaknesses that should be promptly addressed.
The Central Bank has noted that its focus on this area has been borne out of increasing concerns in relation to outsourcing practices and a recognition by the Central Bank of a widespread failure of industry to implement governance, risk management and business continuity practices to the standards expected by the Central Bank.
Part B examines some of the keys risks and evolving trends associated with outsourcing while also identifying ways firms might mitigate these risks.
The Discussion Paper also provides a summary of the issues to be addressed by regulated firms engaging in outsourcing while inviting input and discussion from industry on these points.
The Central Bank has also noted that it will hold an outsourcing industry conference in the first quarter of 2019 and that feedback received on foot of the publication of the Discussion Paper will "inform ongoing discussions around outsourcing trends, key issues and the appropriate regulatory response" at this conference.
Key Findings and Next Steps
The Discussion Paper contains a range of detailed and granular findings, statistics and recommendations which should be closely read by all regulated firms engaged in outsourcing.
In a statement accompanying the launch of the Discussion Paper, the Central Bank's Director of Policy and Risk, Gerry Cross, expressly confirmed that the Central Bank expects firms to analyse the content of the Discussion Paper and address any issues relevant to their outsourcing practices.
Importantly, Mr. Cross also stated that firms can expect Central Bank supervisors to seek evidence of updates by firms to their risk management frameworks demonstrating consideration of the Discussion Paper and that any relevant findings have been implemented accordingly.
We have of summarised at a high level in the table below the Central Bank's findings in terms of both its current supervisory expectations and the key risks and trends associated with outsourcing.
The Discussion Paper also references Brexit noting that the evolving landscape of migrating firms "is likely to involve a substantial level of intragroup outsourcing as firms seeking to become authorised in Ireland look to outsource to existing group entities located in the UK", and notes that the unique risks of this type of outsourcing should be expressly considered.
In addition, the Discussion Paper usefully contains a reference list of applicable legislation/guidance regulated firms should also consider when assessing their legal and regulatory obligations in relation to outsourcing. The Central Bank also points to the ongoing work of the European Supervisory Authorities in producing outsourcing guidance, noting in particular that the EBA Draft Outsourcing Guidelines 2018 are (though still in draft, and not applicable to all sectors) a source of useful information.
Firms regulated by the Central Bank and engaging in outsourcing practices should promptly carry out and document an exercise in assessing whether their current outsourcing practices require updating or enhancement in order to meet the standards of the Central Bank as outlined in the Discussion Paper.
It is expected the Central Bank may prioritise inspections of regulated firms' outsourcing practices in 2019 following completion of this engagement with industry stakeholders. It is also noteworthy that the Central Bank has previously imposed substantial fines under its administrative sanctions procedure for breaches of outsourcing and IT governance requirements.