Retail Payment Activities Regulations — 5
rs (3) If a payment service provider receives services related to a payment function from one or more third-party service providers, the risk management and incident response framework must (a) address the means by which the payment service provider will — no less than once a year in respect of each of its third-party service providers and before entering into, renewing, extending or substantially amending a contract with a third-party service provider for the provision of a service related to a payment function — assess (i) the third-party service provider’s ability to protect data and information that they obtain from the payment service provider or in the course of performing services for it, (ii) the security of the third-party service provider’s connections to and from the payment service provider’s systems, (iii) the manner in which the third-party service provider will consult or inform the payment service provider prior to making changes to the services that they provide, the manner in which they provide them or their practices for managing operational risk, (iv) the manner in which the third-party service provider’s performance may be monitored, including the time and manner in which the third-party service provider will inform the payment service provider of any detected breach of the payment service provider’s or the third-party service provider’s data, information or systems and of any other deterioration, reduction or breakdown in the services provided to the payment service provider, and (v) the third-party service provider’s risk management practices in relation to the services that they provide to the payment service provider; (b) require the payment service provider to keep a record of the dates, scope and findings of the assessments referred to in paragraph (a); and (c) clearly allocate responsibilities between the payment service provider and the third-party service provider, including in relation to the ownership, integrity, confidentiality and availability of data and information. Agents and mandataries (4) If a payment service provider intends to have agents or mandataries perform retail payment activities, the risk management and incident response framework must (a) set out criteria in relation to the management of operational risk that those agents or mandataries must satisfy; (b) prohibit the payment service provider from having an agent or mandatary perform retail payment activities on its behalf if the agent or mandatary does not satisfy those criteria; (c) address the means by which the payment service provider must, at least once a year, assess the extent to which its agents and mandataries satisfy those criteria and the agents’ and mandataries’ practices for managing operational risk; (d) require the payment service provider to keep a record of the date and findings of each assessment referred to in paragraph (c); and (e) clearly allocate responsibilities between the payment service provider and its agents and mandataries, including in relation to the ownership, integrity, confidentiality and availability of data and information. Third party roles and responsibilities (5) If the risk management and incident response framework allocates, under paragraph (1)(d), any roles or responsibilities to a third party, including a third-party service provider or an agent or mandatary, the framework must set out systems, policies, procedures, processes, controls or other means for overseeing the third party’s fulfillment of those roles and responsibilities. Approval (6) The risk management and incident response framework must be approved (a) by the senior officer referred to in subparagraph (1)(d)(ii), if any, at least once a year and following each material change that is made to the framework; and (b) by the payment service provider’s board of directors, if any, at least once a year.