December 29, 2020
Financial Stability Board
Bank for International Settlements
Centralbahnplatz 2, CH-4002 Basel, Switzerland
Japanese Bankers Association

JBA Comments on the FSB Discussion Paper “Regulatory and Supervisory Issues
Relating to Outsourcing and Third-Party Relationships”
Dear Sir / Madam:
The Japanese Bankers Association1 (JBA) appreciates the opportunity to provide comments on the Financial
Stability Board’s Discussion Paper “Regulatory and Supervisory Issues Relating to Outsourcing and ThirdParty Relationships” (Discussion Paper) dated November 9, 2020.

General Comments
The JBA acknowledges and understands that the circumstances surrounding outsourcing and other third-party
relationships in providing financial services have changed in the past few decades and that the COVID-19
pandemic highlighted the need for financial institutions (FIs) to conduct reviews and make adjustments tooutsourcing arrangements and third-party management processes in light of the reliance on third-party service
providers by FIs.
The JBA would like to provide overarching comments to address challenges in outsourcing and third-party
management:-International harmonization in regulatory approaches will be necessary, as regulatory frameworks on
outsourcing have been already published by several international and national regulatory bodies2. The JBA
believes that regulatory fragmentation could lead to unintended consequences. Therefore, the JBA believes
that harmonized high-level principles on outsourcing and third-party management will be necessary in amanner which is consistent with existing regulatory approaches in outsourcing and third-party management,
as well as operational resilience3 and cybersecurity4.

-The JBA agrees to the importance of close dialogue and further discussion among supervisory authorities,FIs and third-party providers to address challenges identified in the Discussion Paper, particularly in a
multi-jurisdictional context.

1The Japanese Bankers Association is the leading trade association for banks, bank holding companies and bankers associations inJapan. As of December 29, 2020, the JBA has 116 Full Members (banks), 3 Bank Holding Company Members (bank holdingcompanies), 72 Associate Members (banks & bank holding companies), 58 Special Members (regionally-based bankers associations)and one Sub-Associate Member for a total of 250 members.
2 For example:Basel Committee on Banking Supervision, “Outsourcing in Financial Services”, 15 February 2005,
https://www.bis.org/publ/joint12.htm
International Organization of Securities Commissions, Consultation Report on “Principles on Outsourcing”, 28 May 2020,
https://www.iosco.org/library/pubdocs/pdf/IOSCOPD654.pdf
European Banking Authority, Final Report on “EBA Guidelines on outsourcing arrangements”, 25 February 2019,https://eba.europa.eu/sites/default/documents/files/documents/10180/2551996/38c80601-f5d7-4855-8ba3702423665479/EBA%20revised%20Guidelines%20on%20outsourcing%20arrangements.pdf
3 For example:
Basel Committee on Banking Supervision, Consultative Document on “Principles for operational resilience”, 6 August 2020,
https://www.bis.org/bcbs/publ/d509.pdf
4 For example:
Financial Stability Board, Final Report on “Effective Practices for Cyber Incident Response and Recovery”, 19 October 2020,
https://www.fsb.org/wp-content/uploads/P191020-1.pdf

1Specific Comments, answers to the questions from FSB
Q1. What do you consider the key challenges in identifying, managing and mitigating the risks
relating to outsourcing and third-party relationships, including risks in sub-contractors andthe broader supply chain?
The JBA believes FIs are facing difficulties to meet the supervisory expectations in outsourcing and third-party
management since third-party service providers are often not directly regulated by the supervisory authorities.
If supervisory authorities expect higher level of control over third-party management, the JBA appreciates
further support from authorities to promote strengthening of outsourcing and third-party management.
The JBA also believes that both supervisory authorities and FIs have been aware of the possibility of systemicrisk arising from concentration in the provision of some outsourced and third-party services to FIs. The JBA
agrees to the Section 3.3 of the Discussion Paper emphasizing the importance of enhanced dialogue on this issue.
However, due to the limitations in the capacity of FIs to know which FIs are being given the services from thirdparties, each FI is not in a position to make appropriate judgement in a timely manner. The JBA believes thatsupervisory authorities are in a better position for collecting information and measuring concentration risk andshould closely consult with FIs in order to address the systemic risk due to concentration.
Q2. What are possible ways to address these challenges and mitigate related risks? Are there
any concerns with potential approaches that might increase risks, complexity or costs?
Considering the increase and complexity of outsourcing by FIs, the JBA believes that financial regulatory
authorities should take a risk-based approach, where higher level of control is required for their outsourcing andthird-party services which are identified as high risk. To apply uniform and inflexible approaches to all FIs may
impair effective outsourcing and third-party risk management and may lead to significant risk due to limited
resources and capabilities of FIs.
Q3. What are possible ways in which financial institutions, third-party service providers andsupervisory authorities could collaborate to address these challenges on a cross-borderbasis?
The JBA agrees to the Section 3.2 of the Discussion Paper stating that further analysis and discussion would be
beneficial regarding challenges in cross-border outsourcing and third-party management. However, the JBA
believes that given the current business practices, it is challenging for FIs to include in written agreements (i)assurance or statements by a third party that any cross-border elements in these arrangements will not prevent
them from meeting applicable jurisdictions’ legal or regulatory obligations and (ii) clauses granting access, audit
and information by supervisory authorities particularly in a cross-border context. Therefore, the JBA believes it
is ideal to have one harmonized high-level principle on risk management of outsourcing and third-party
relationships particularly in a cross-border context.
Q4. What lessons have been learned from the COVID-19 pandemic regarding managing andmitigating risks relating to outsourcing and third-party relationships, including risks arising in
sub-contractors and the broader supply chain?
Considering the COVID-19 situation which impacts the whole global economy and society, it is unavoidable toface unpredictable incidents or disruptions even with well-prepared scenarios and testing. Therefore, it is more
important to have a close and continuous dialogue among supervisory authorities, FIs and third parties on how
to address the issues, even though third parties are not regulated by financial regulatory authorities.
We also reaffirmed the importance of information security management on outsourcing when we permit remote
working by the service providers as a COVID-19 response. It is necessary for FIs to confirm their service
providers meet their expectations and regulatory requirements on information security even in remote-working
environments.
(End)2