Source: http://www.prarulebook.co.uk/rulebook/Content/Part/214147/18-06-2019
Timestamp: 2019-08-26 10:34:26
Document Index: 284902723

Matched Legal Cases: ['Art. 13', 'Art. 13', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 14', 'Art. 14']

Outsourcing - Prudential Regulation Authority
1.1 Unless otherwise stated, this Part applies to a CRR firm:
Unless otherwise stated, this Part applies to a CRR firm:
Articles 30, 31 Outsourcing Requirements
means requirements and obligations as set out in Articles 30 and 31(Outsourcing) of the MODR.
means control as defined in Article 1 of the Seventh Council Directive 83/349/EEC (The Seventh Company Law Directive).
means an activity listed in Annex 1 to the CRD.
relevant services and activities
means regulated activities, listed activities or ancillary services.
(1) when relying on a third party for the performance of operational functions which are critical for the performance of relevant services and activities on a continuous and satisfactory basis, ensure that it takes reasonable steps to avoid undue additional operational risk; and
(2) not undertake the outsourcing of important operational functions in such a way as to impair materially:
(b) the ability of the PRA to monitor the firm’s compliance with all obligations under the regulatory system and, if different, of a competent authority to monitor the firm’s compliance with all obligations under MiFID II.
[Note: Article 16(5) first paragraph of MiFID II]
A MiFID investment firm must extend the arrangements and meet the requirements of the Articles 30, 31 Outsourcing Requirements, so they apply with respect to other matters on the following basis:
(1) references to “authorisation” under MiFID II are references to authorisation under section 31(2) of the Act;
(2) references to “obligations under MiFID II are references to a firm’s obligations under the regulatory system;
(3) references to “investment services and activities” are references to relevant services and activities;
(4) references to “client” includes anyone who is a client; and
(5) references to “competent authority” are references to the PRA or the FCA acting other than in the capacity of a competent authority for the purposes of MiFID II or CRR.
A firm that is not a MiFID investment firm must comply with the Articles 30, 31 Outsourcing Requirements on the basis set out in 2.1A and as if references to “investment firm“ refer to a firm.
For the purposes of this Part an operational function is regarded as critical or important if a defect or failure in its performance would materially impair the continuing compliance of a firm with the conditions and obligations of its authorisation or its other obligations under the regulatory system, or its financial performance, or the soundness or the continuity of its relevant services and activities.
[Note: Art. 13(1) of the MiFID implementing Directive]
Without prejudice to the status of any other function, the following functions will not be considered as critical or important for the purposes of this Part:
(1) the provision to the firm of advisory services, and other services which do not form part of the relevant services and activities of the firm, including the provision of legal advice to the firm, the training of personnel of the firm, billing services and the security of the firm’s premises and personnel; and
[Note: Art. 13(2) of the MiFID implementing Directive]
(4) none of the other conditions subject to which the firm’s authorisation was granted must be removed or modified.
[Note: Art. 14(1) of the MiFID implementing Directive]
A firm must exercise due skill and care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any relevant services and activities.
[Note: Art. 14(2) first paragraph of the MiFID implementing Directive]
A firm must in particular take the necessary steps to ensure that the following conditions are satisfied:
(2) the service provider must carry out the outsourced services effectively, and to this end the firm must establish methods for assessing the standard of performance of the service provider;
(5) the firm must retain the necessary expertise to supervise the outsourced functions effectively and to manage the risks associated with the outsourcing, and must supervise those functions and manage those risks;
(6) the service provider must disclose to the firm any development that may have a material impact on its ability to carry out the outsourced functions effectively and in compliance with applicable laws and regulatory requirements;
(7) the firm must be able to terminate the arrangement for the outsourcing where necessary without detriment to the continuity and quality of its provision of services to clients;
(8) the service provider must co-operate with the PRA and any other relevant competent authority in connection with the outsourced activities;
(9) the firm, its auditors, the PRA and any other relevant competent authority must have effective access to data related to the outsourced activities, as well as to the business premises of the service provider; and the PRA and any other relevant competent authority must be able to exercise those rights of access;
(10) the service provider must protect any confidential information relating to the firm and its clients;
(11) the firm and the service provider must establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities where that is necessary having regard to the function, service or activity that has been outsourced.
[Note: Art. 14(2) second paragraph of the MiFID implementing Directive]
A firm must ensure that the respective rights and obligations of the firm and of the service provider are clearly allocated and set out in a written agreement.
[Note: Art. 14(3) of the MiFID implementing Directive]
If a firm and the service provider are members of the same group, the firm may, for the purpose of complying with 2.5 to 2.9, take into account the extent to which the firm controls the service provider or has the ability to influence its actions.
[Note: Art. 14(4) of the MiFID implementing Directive]
A firm must make available on request to the PRA and any other relevant competent authority all information necessary to enable the PRA and any other relevant competent authority to supervise the compliance of the performance of the outsourced activities with the requirements of the regulatory system.
[Note: Art. 14(5) of the MiFID implementing Directive]