EN ECB-PUBLIC  
 
OPINION OF THE EUROPEAN CENTRAL BANK 
of 26 February 2021  
on the supervision of outsourci ng arrangements entered into by credit institutions 
(CON/2021/8) 
 
Introduction and legal basis 
On 13 January 2021 the European Central Bank (ECB) received a r equest from the German Ministry of 
Finance for an opinion on the Law on strengthening the integrit y of the financial market (hereinafter the 
‘draft law’). 
The ECB’s competence to deliver an opinion is based on Articles  127(4) and 282(5) of the Treaty on the 
Functioning of the European Union and Article 2(1) of Council D ecision 98/415/EC1, as the draft law 
relates to the specific tasks conferred upon the ECB concerning  the prudential supervision of credit 
institutions pursuant to Article 127(6) of the Treaty. In accor dance with the first sentence of Article 17.5 of 
the Rules of Procedure of the European Central Bank, the Govern ing Council has adopted this opinion. 
 
1. Purpose of the draft law 
The draft law’s main purpose is it to foster public confidence in the German financial market. To 
that end, the draft law aims to prevent manipulation of the bal ance sheets of capital market 
companies by strengthening balance sheet controls and by furthe r regulating the auditing of 
financial statements. Moreover, the draft law aims at improving  the supervisory structures and the 
powers of the Bundesanstalt für Finanzdienstleistungsaufsicht  (BaFin, Federal Financial 
Supervisory Authority) regarding the examination of outsourcing  arrangements on the part of 
financial services companies. The consultation letter specifica lly requested an ECB opinion on 
Article 5 of the draft law, which introduces changes to the Law  on banking2, and on Article 8 of the 
draft law, which introduces changes to the Law on capital inves tment3. Both articles concern the 
supervision of outsourcing arrangements by BaFin.  
1.1 Definition of external service provider 
The draft law introduces a wide definition of what is regarded as an ‘external service provider’4. The 
term includes any company to which a credit institution has out sourced activities or processes to 
execute its ordinary services. The definition also covers outso urcing chains by including the 
                                                 
1  Council Decision 98/415/EC of 29 June 1998 on the consultation  of the European Central Bank by national 
authorities regarding draft legislative provisions (OJ L 189, 3 .7.1998, p. 42). 
2  Kreditwesengesetz – KWG in der Fassung der Bekanntmachung vom 9 . September 1998 (BGBl. I S. 2776), das 
zuletzt durch Artikel 4 des Gesetzes vom 9. Dezember 2020 (BGBl . I S. 2773) geändert worden ist.  
3  Kapitalanlagegesetzbuch vom 4. Juli 2013 (BGBl. I S. 1981), das  zuletzt durch Artikel 9 Absatz 9 des Gesetzes vom 
9. Dezember 2020 (BGBl. I S. 2773) geändert worden ist.  
4  Article 5(1) of the draft law. 
ECB-PUBLIC  
2 material subcontractors that the company engages with in order to execute the ordinary services of 
the credit institution. Whether the company is itself subject t o supervision is irrelevant for the 
classification as an ‘external service provider’.  
1.2 Notification obligation and outsourcing register 
A credit institution must notify the supervisory authority and the Deutsche Bundesbank of its 
intention to enter into a mate rial outsourcing arrangement and the implementation of such an 
arrangement, including any material modification to the arrange ment as well as any serious 
incident that has occurred as part of the outsourcing5. As part of its risk management, a credit 
institution must keep an outsourcing register that lists all ma terial and non-material outsourcing 
arrangements6. 
1.3 Appointment of an authorised agent in Germany 
A credit institution must contractually ensure that its externa l service providers in a material 
outsourcing arrangement which are established in third countrie s appoint an authorised agent in 
Germany to whom BaFin can serve documents and notifications7. 
1.4 Direct access to external service providers  
BaFin may issue orders directly to external service providers t o which material activities and 
processes have been outsourced in order to prevent or stop brea ches of supervisory law or to 
prevent or overcome deficiencies at a credit institution that c ould endanger the safety of the assets 
entrusted to the credit institution or impair the proper perfor mance of its banking business or 
financial services8. BaFin’s existing right to request information and documents f rom credit 
institutions, members of their governing bodies and their emplo yees is extended to external service 
providers insofar as such requests relate to outsourced activit ies and processes. Whether the 
outsourcing arrangements are material or non-material is irrele vant9. The right of BaFin to conduct 
an inspection of a credit institution is also extended to exter nal service providers10. In the same 
vein, BaFin’s existing power to order risk-reduction measures i n order to remedy organisational 
deficiencies is extended to include external service providers insofar as the credit institution has 
outsourced material activities and processes11. 
1.5 Request to replace auditor  
The timeline within which BaFin can request the replacement of an auditor appointed by the credit 
institution is extended to two months12. 
1.6 Immediate enforceability and fines  
In line with the existing framework, BaFin is entitled to impos e administrative fines in cases where 
credit institutions fail to comply with reporting requirements or where external service providers fail 
                                                 
5  Article 5(3)(b) of the draft law. 
6  Article 5(4)(a) of the draft law. 
7  Article 5(4)(b) of the draft law. 
8  Article 5(4)(c) of the draft law. 
9  Article 5(7)(a) of the draft law.  
10  Article 5(7)(b) of the draft law. 
11  Article 5(8) of the draft law. 
12  Article 5(6)(a) of the draft law.  
ECB-PUBLIC  
3 to comply with orders issued by BaFin13. Complaints against measures ordered by BaFin to 
prevent or stop breaches of supervisory law or to prevent or ov ercome deficiencies at a credit 
institution shall have no suspensive effect, i.e. are immediate ly enforceable14.  
 2. Observations  
2.1 This opinion is confined to Article 5 of the draft law, whi ch introduces changes to the Law on 
banking concerning BaFin’s supervision of outsourcing arrangeme nts entered into by credit 
institutions.  
2.2 The ECB notes that the draft law introduces some of the pro cesses and practices foreseen in the 
EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) (he reinafter, the ‘EBA 
Guidelines’)
15 into the German legislative framework. These processes and pra ctices include the 
obligation on credit institutions to notify the supervisory aut hority of its intention to enter into 
material outsourcing arrangements and the implementation of suc h arrangements, and the 
obligation to maintain a register of all material and non-mater ial outsourcing arrangements. The 
ECB considers these measures as appropriate tools to ensure tha t the competent authority 
receives information useful to determine if the outsourcing arr angements involve a material change 
to the conditions and obligatio ns of a credit institution’s ini tial authorisation in good time, and also to 
assess whether the outsourcing arrangement hinders its capacity  to effectively supervise 
institutions. The extended notification requirements, such as t he need to notify the supervising 
authority of serious incidents occurring as part of an existing  material outsourcing arrangement that 
could materially influence the business activities of the credi t institution, should allow the supervisor 
to be aware of potential problems early, and increases the abil ity of the competent authorities to 
react in a timely manner to the risks derived from such inciden ts. The ECB understands that the 
inclusion of these requirements in the German legislative frame work is without prejudice to the 
provisions of the EBA Guidelines, which must also be considered  by competent authorities when 
interpreting the requirements of the Law on banking. This is pa rticularly relevant for the definition of 
‘external service provider’, which has to be understood in acco rdance with the definition of ‘service 
provider’ as outlined in the EBA Guidelines. 
2.3 The ECB observes that some aspects of the draft law go beyo nd the scope of the EBA Guidelines, 
such as the obligation on credit institutions to ensure contrac tually that that the external service 
provider appoints an authorised agent in Germany to whom BaFin may serve documents and 
notifications. Some of these requirements, such as the new powe r granted to BaFin to issue orders 
directly to external service providers to which material activi ties and processes have been 
outsourced, combined with the power to impose sanctions if such  orders are not complied with, go 
beyond the traditional construct of Directive 2013/36/EU of the  European Parliament and of the 
Council16, where the role of the competent authorities is articulated ex clusively vis-à-vis the credit 
                                                 
13  Article 5(10) of the draft law. 
14  Article 5(9) of the draft law. 
15  Available on the EBA website. 
16  Directive 2013/36/EU of the European Parliament and of the Coun cil of 26 June 2013 on access to the activity of 
credit institutions and the prudential supervision of credit in stitutions and investment firms, amending Directive 
2002/87/EC and repealing Directives 2006/48/EC and 2006/49/EC ( OJ L 176, 27.6.2013, p. 338). 
ECB-PUBLIC  
4 institution, which is the addressee of potential decisions or s upervisory measures aimed at 
reducing the risk posed by a particular outsourcing arrangement . 
2.4 The ECB notes, in general terms, that enhancing the digital  operational resilience of credit 
institutions by extending supervisory powers directly to extern al service providers is a topical issue 
which needs to be addressed. In this regard, the proposed Regul ation on digital operational 
resilience for the EU financial services sector (hereinafter th e ‘DORA proposal’)17 d e s e r v e s  
particular attention. Specifically, attention should be paid to  the provisions setting out (a) the 
requirements in relation to the contractual arrangements conclu ded, inter alia, between credit 
institutions and information and communication technology (ICT)  third-party service providers18 and 
(b) the oversight framework for critical ICT third-party servic e providers when providing services, 
inter alia, to credit institutions19. It is understood that the German legislator will review the d raft law 
once the DORA proposal is adopted in order to ensure full consi stency with Union legislation20. 
However, once Union legislation is adopted, the draft law will require additional adaptation, not just 
by the legislator but also on the part of credit institutions a nd their external service providers. Given 
the fact that the new obligations are mainly established regard ing the particular outsourced service 
and not regarding service providers per se, it is particularly noted that while the draft law confers 
the power to issue orders directly to external service provider s on BaFin, this should not replace 
the duty of credit institutions to have in place, appropriate a rrangements, policies and practices to 
identify and manage the operational risks connected to the outs ourcing of these activities.  
2.5 The ECB understands that the new powers for the supervision  of external service providers are 
granted to BaFin without prejudice to the supervisory responsib ilities established under Regulation 
(EU) No 1024/201321, which assigns to the ECB, responsibilities as competent autho rity for the 
supervision of significant credit institutions, including the s upervision of the outsourcing 
arrangements entered into by credi t institutions with third par ties. 
 This opinion will be published on EUR-Lex.  
 
Done at Frankfurt am Main, 26 February 2021.  
[signed] 
 
The President of the ECB 
Christine LAGARDE 
                                                 
17  Proposal for a Regulation of the European Parliament and of the  Council on digital operational resilience for the 
financial sector and amending Regulations (EC) No 1060/2009, (E U) No 648/2012, (EU) No 600/2014 and (EU) 
No 909/2014; COM/2020/595 final. 
18  See Chapter V, Section I of the DORA proposal. 
19  See Chapter V, Section II of the DORA proposal. 
20  See paragraph 2.3 of Opinion CON/2020/3. All ECB opinions are p ublished on EUR-Lex.  
21  Council Regulation (EU) No 1024/2013 of 15 October 2013 conferr ing specific tasks on the European Central Bank 
concerning policies relating to the prudential supervision of c redit institutions (OJ L 287, 29.10.2013, p. 63).