The Bermuda Monetary Authority (BMA) has released Guidance Notes for Relevant Legal Entities, including banks, corporate service providers, trust companies, investment businesses and fund administrators, which require them to demonstrate good risk management and to notify the BMA of any new material outsourcing arrangements. The guidelines come into force on 1 May 2020. Until that time there is a transition period during which entities should provide attestation for pre-existing arrangements, and seek prior approval or provide attestation for new outsourcing arrangements.
Over the last three years there has been an increase in the use of outsourcing by entities such as investment businesses, fund administrators, banks, deposit companies, corporate service providers, trust companies, money service businesses, and credit unions licensed by the BMA. The BMA has issued updated Guidance Notes for these "Relevant Legal Entities" (RLEs) to ensure risks from outsourcing are appropriately managed.
While the Guidance Notes are applicable to all outsourcing arrangements, they are specifically concerned with 'material' outsourcing i.e. those arrangements where failure in performance would materially impact the RLE's business operations, reputation or financial performance, ability to manage risk, or compliance with applicable laws. RLE management will also have to consider whether the provision of innovative technology (including cloud services, artificial intelligence and distributed ledger technologies) by third-parties constitutes outsourcing, and if so whether it is material outsourcing.
Provision of or use of services which do not form part of the services and activities provided by the RLE itself, are not regarded as outsourcing. This may include external training of staff, external security and management of the RLE's premises, and the provision of external legal advice to the RLE.
The new Guidance Notes cover the BMA's general expectations regarding the policies and procedures that the management of RLEs must have in place to manage the risks. These policies should include criteria for determining what constitutes material outsourcing, the risk appetite for outsourcing activities, due diligence to be undertaken in selecting a service provider and ongoing management and monitoring of arrangements.
In respect of existing outsourcing arrangements, each RLE should submit to the BMA, by 30 April 2020, an attestation that the RLE's existing outsourcing arrangements are in compliance with the Guidance Notes. The attestation should be executed by the CEO of the RLE or a board nominated senior executive where an RLE does not have a CEO. This attestation will subsequently be verified by the BMA as part of its ongoing supervision, at which time supporting documentation will be required.
In the transition period between 4 January 2020 and 1 May 2020, an RLE has two options in respect of proposed new outsourcing arrangements. The first is the attestation route as described above for existing outsourcing arrangements with such attestation being submitted by no later than 30 April 2020. This attestation will subsequently be verified by the BMA as part of its ongoing supervision, at which time supporting documentation will be required. The second option is for the RLE to submit a prior notification setting out the required information and demonstrating compliance with the Guidance Notes. The prior notification should contain:
- the name, address and regulatory status of the service provider
- whether the service provider is related to the RLE
- details about any other material outsourcing the service provider provides to the RLE
- a summary of the activity to be outsourced and why it is considered material
- the reasons for outsourcing
- confirmation that senior management has undertaken a risk assessment and due diligence
- explanation on how the RLE proposes to monitor the outsourcing arrangement
- confirmation that a written agreement is in place which meets the Guidance Notes requirements
From 1 May 2020, when an RLE wishes to enter into a new material outsourcing arrangement, it must submit a prior notification to the BMA, including the relevant information as set out above. If applicable, RLEs should also note areas where they believe the outsourcing arrangement might diverge or not be in full compliance with the guidance, so the BMA can immediately review.
The BMA has a twenty working day notification period in which it may object. During the notification period, the BMA may request further information or clarification on aspects of the proposed arrangement, may provide a no objection confirmation, or may remain silent, following which silence can be taken to constitute no objection. RLEs should ensure they have provided enough time from their notification to the desired start date of the outsourcing arrangement.
How can we help?
RLEs should ensure that they are prepared for implementation of the Guidance Notes on 1 May 2020. This may require revision of internal risk management policies or practices related to outsourcing, review of existing outsourcing agreements, as well as review of arrangements for ongoing monitoring.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.