Source document: https://docs-lawep.s3.us-east-2.amazonaws.com/1696585756823.pdf (Vanuatu)
RESERVE BANK OF VANUATU DOMESTIC BANKS PRUDENTIAL GUIDELINE NO 11 OUTSOURCING 1.

It is becoming more common for banks and other financial service providers to outsource1 business activities to external service providers.

While outsourcing may result in day-to-day managerial responsibility moving to the service provider, accountability for the business activity remains with the bank.
It is important for banks to recognise that outsourcing a business activity does not transfer all of the risks associated with that activity to the service provider.

2.

This guideline sets out some best practice guidelines for managing outsourcing arrangements.

The Reserve Bank of Vanuatu believes that these should be applied to all material outsourcing arrangements, and recommends that they be utilised in all outsourcing arrangements.
1 For the purpose of this guideline, outsourcing involves a bank entering into an agreement with another party (including a related company) to perform a business activity which currently is, or could be, undertaken by the bank itself.

Examples include outsourcing IT systems management and operation, document processing, loan administration, back office administration, custody and investment management.

December 2004 1 3.
December 2004 1 3.

This Guideline is only applicable in those situations where the outsourcing arrangement involves business activities that are “material” in nature.

However, in the normal course, the Reserve Bank of Vanuatu would expect banks to apply the practices set out in the Guideline to all outsourcing arrangements including those where the service provider is located outside Vanuatu or the functions are performed outside Vanuatu.

4.
4.

The assessment of what constitutes a material business activity is often a subjective one and depends on the circumstances faced by individual banks.

Generally, a material business activity is defined as one that has the potential, if disrupted, to impact significantly on the bank’s business operations, reputation or profitability.
Factors to be considered when making this assessment would include: (a) the financial and reputational impact of a failure of the service provider to perform over a given period of time (depending on the importance of the business activity, this may be measured in hours); (b) the cost of the outsourcing arrangement as a share of total costs; (c) the degree of difficulty, including the time taken, in finding an alternative service provider or bringing the business activity “in-house”; and (d) the ability of the bank to meet regulatory requirements if there were problems with the service provider.
5.

As a guide, a material business activity may include a significant part of the bank’s information technology function, investment management, internal audit, loan processing, custodial or administration arrangements.

It is not envisaged that a material business activity would include contractor type relationships, where there are numerous providers in the marketplace, the contract is relatively short term and the cost and inconvenience of switching between providers is low.
Examples include utility services (such as mail and telephone services), legal services, printing services and software licensing arrangements.

6.

Banks should consult with the Reserve Bank of Vanuatu where they are uncertain as to whether a business activity that is to be outsourced would be regarded as material for the purposes of this guideline.

7.
7.

Banks must notify the Reserve Bank of Vanuatu as soon as possible after entering into any agreements to outsource a material business activity (and in any event no later than 30 days after execution).

The bank should outline to the Reserve Bank of Vanuatu the key risks involved in the outsourcing arrangement and the risk mitigation strategies put in place to address these risks.
The Reserve Bank of Vanuatu may request additional material where it considers it necessary to do so in order to understand and assess the impact December 2004 2 of the outsourcing arrangement on the bank’s risk profile.

In the normal course, however, the Reserve Bank of Vanuatu would seek to obtain all the necessary information directly from the bank.

8.
8.

At the time this Guideline comes into effect, banks should notify the Reserve Bank of Vanuatu of all existing outsourcing agreements involving material business activities.

However, these agreements do not need to be covered by the requirements of this Guideline until such time as the agreement is due for renewal.

Banks should contact the Reserve Bank of Vanuatu to agree an acceptable timeframe for providing this information.
Banks should consult with the Reserve Bank of Vanuatu where they are uncertain as to transition arrangements.

Board and Management Responsibility 9.

It is the responsibility of the Board and senior management to ensure that adequate risk mitigation practices are in place for the effective oversight and management of outsourcing arrangements.

10.
10.

The Board, or responsible Committee, should: (a) review and approve risk management policies for outsourcing; (b) regularly review compliance with the outsourcing policy; (c) approve all outsourcing arrangements of material business activities; (d) regularly review reports on outsourcing arrangements; and (e) ensure that the audit function covers any outsourcing arrangements and that auditors report on compliance with policy.

11.
Senior management of the bank should: (a) develop a risk management framework for outsourcing arrangements that reflects the Board approved policy; (b) establish and implement an oversight process that ensures that outsourcing arrangements, and outsourcing of material business activities in particular, are reported to the Board prior to implementation; (c) ensure that, for each outsourcing arrangement, there is a formal evaluation of the service provider, that a contract with appropriate service level agreements (SLAs) is in place, and that confidentiality provisions and security needs are adequately addressed; December 2004 3 (d) ensure that appropriate reporting regimes are in place, including to the Board and the Reserve Bank of Vanuatu, to enable effective management and control of outsourcing arrangements and to identify potential problems at an early stage; and (e) ensure that the audit function regularly reviews performance under the outsourcing arrangements.
12.

For branch offices operating in Vanuatu, responsibility for these functions lies with the Responsible Officer or an appropriately delegated Committee.

Policy 13.
Policy 13.

The Board approved outsourcing policy should address all risks associated with outsourcing, including managing and monitoring the outsourcing arrangement, selecting a qualified service provider, structuring the outsourcing agreement (including contracts and SLAs), and establishing appropriate business continuity plans, including exit strategies.

Risk Mitigation Strategies for Managing Outsourcing Arrangements 14.
When outsourcing material business activities, the bank should consider establishing an outsourcing team comprised of individuals from both the business area proposing the outsourcing arrangement and other individuals with the necessary skills to assess the risks involved in outsourcing.

This would include specialists in the relevant risk areas (and may involve using external experts).
This team should ensure that the Board-approved policy on outsourcing is being followed at all times - including the tender and due diligence processes, evaluating the outsourcing options, and making recommendations to senior management and the Board.

Business Case 15.

A detailed Business Case should be prepared, outlining the potential costs, benefits and risks associated with the proposed outsourcing arrangement.
As part of this process, the Board should be making an “in-principle” decision to continue the outsourcing process and to call for tenders.

The tender document should clearly outline the requirements of the bank for the proposed outsourcing arrangement.

December 2004 4 Due Diligence 16.

The due diligence process should always be undertaken prior to any final decision being made as to whether to outsource a material business activity.
This should address all material factors that would impact on the potential service provider’s ability to perform the business activity.

The due diligence process should, as a minimum, assess the financial ability, technical ability and capacity of the service provider to deliver the required services.

The evaluation process would include an assessment of the service provider’s control framework, covering performance standards, policies, procedures, compliance, reporting and monitoring processes.
The due diligence should also address other issues, such as a potential conflict of interest where the service provider is related to the bank or has arrangements with competitors.

Business Continuity Planning 17.

Where a material business activity is outsourced, the bank should ensure that its Business Continuity Plan outlines the procedures to be followed in the event that the service provider is unable to fulfill its obligations under the outsourcing agreement for any reason.

Final Approval 18.
Final Approval 18.

Decisions to outsource material business activities should be approved or endorsed by the Board or responsible Committee.

Contractual Agreements 19.

All material outsourcing arrangements should be undertaken using a written, legally binding agreement.

The agreement must document all components of the outsourcing arrangement between the parties.

The bank should obtain legal advice in assessing the contract.

20.
20.

The agreement should be for a specified period and contain both start and finish dates.

There should also be a clause allowing for periodic review of the agreement within the term of the contract and renegotiation if appropriate.

21.

The contract should specify the content, frequency and format of the service being provided.

It should state time lines for receipt and delivery of work, including specifying priorities.
It should contain performance benchmarks, including default benchmarks which, if not met, would result in penalties being applied or, December 2004 5 in the extreme, termination of the agreement.

Where possible, the agreed service levels should be specified in SLAs.

22.

The contract should specifically cover any sub-contracting or outsourcing by the service provider, including any specific rules or limitations to such arrangements.
In particular, the same standards that apply to the service provider in respect of security and confidentiality of information should apply to sub-contractors or outsourcing arrangements by the primary service provider.

23.

The contract should be sufficiently flexible to accommodate changes to existing processes and to envisage new processes in the future.

24.

The contract should clearly set out the procedures in place to allow the bank to effectively monitor the performance of the service provider.
This would include the extent to which the bank’s internal or external auditor can obtain sufficient information (including through on-site inspections or the appointment of an external party) to satisfy themselves of the adequacy of risk management systems.

25.

The contract should include clauses enabling the Reserve Bank of Vanuatu to request any information it considers necessary to satisfy itself as to the adequacy of the risk management systems used by the service provider.
This should include arrangements for the Reserve Bank of Vanuatu to meet directly with the service provider.

26.

The contract must include details covering business continuity plans (BCP), to ensure that acceptable service levels are maintained in the event of problems occurring with the service provider.

This should address problems arising internally within the service provider (such as a systems breakdown) or through external events (such as a power failure).
The agreement should include an agreed period for normal service levels to be restored.

The BCP should address the back up of both data and software.

The contract should also ensure that this requirement applies to any subcontracting or outsourcing by the service provider.

27.

The contract should also cover arrangements for dealing with financial or capacity problems experienced by the service provider, including arrangements in the event that the service provider becomes insolvent.
For example, this could address issues such as arrangements for the bank to take over the ownership of, or have access rights to, the software and computer hardware used by the service provider in the event of insolvency.

28.

With respect to default arrangements, the contract should clearly specify what constitutes a default event, identify how these are to be rectified and specify any indemnity provisions.

December 2004 6 29.
December 2004 6 29.

The circumstances that would lead to a termination of the outsourcing arrangement should be clearly specified in the contract.

It should set out possible reasons for terminating the arrangement and procedures to be followed in the event of termination, including notice periods, the rights and responsibilities of the respective parties and transition arrangements.

The latter would address access to, and ownership of, documents, records, software and hardware.
Termination clauses should also specify the time period over which the business activity continues to be undertaken by the service provider and its role in transitional arrangements should the activity be brought back in-house within the bank or outsourced to another service provider.

30.

The contract should set out explicit pricing arrangements, covering issues such as frequency of payment, invoicing and payment procedures.

31.
31.

Formal dispute resolution mechanisms should be incorporated into the contract.

These mechanisms would define procedures for managing disputes.

They would enable the continued operation of the outsourced activity while specific issues are being dealt with, including conciliation and arbitration arrangements.

32.

The contract should specify the extent of liability for each party and, in particular, whether liability for negligence is limited.
It should specify any indemnities and provide details of any insurance arrangements.

Management and Control of the Outsourcing Relationship 33.

Any bank that undertakes a material outsourcing arrangement should put in place procedures to monitor and control outsourcing risk in accordance with the Board approved policy.

The actual reporting framework, to both the Board and senior management, should reflect the size and nature of the arrangements.
Importantly, accountability for managing the outsourcing arrangement should be specifically assigned to an individual or team/committee.

This ensures that there is likely to be continued focus on the outsourcing arrangement.

34.

The Board (or responsible Committee) and senior management should receive regular reports on outsourcing activities.

Any material problems with outsourcing should be brought to the attention of these parties.

35.
35.

This monitoring process could involve the use of internal (or, where considered relevant, external) audit to ensure compliance with outsourcing policies and procedures.

The audit function can be used to: (a) ensure compliance with risk management policies and procedures; (b) ensure appropriate internal controls are in place; and December 2004 7 (c) ensure that reporting is adequate, accurate and timely.

36.
36.

The bank should ensure that records held by the service provider are adequate for audit trail purposes and that those records held by the service provider are readily available at all times to the bank and, where the Reserve Bank of Vanuatu considers it necessary, to the Reserve Bank of Vanuatu.

External Audit 37.
External Audit 37.

Where considered appropriate, the Reserve Bank of Vanuatu may, after consultation with the bank, request a bank’s external auditor or an appropriate external expert to provide an assessment of the risk management processes in place with respect to the outsourcing arrangement.

This could cover areas such as IT systems, data security, internal control frameworks and business continuity plans.
Such reports will be paid for by the bank and would be made available to the Reserve Bank of Vanuatu.

December 2004 8