Document ID: chunk:federal_register_of_legislation:F2023L01242:body:0:p9
Version: federal_register_of_legislation:F2023L01242
Segment Type: other
Provision Reference: 
Character Range: 23677–26942

to managing the risks associated with any fourth parties that material service providers rely on to deliver a critical operation to the APRA-regulated entity.[14]

Material service providers
49.         An APRA-regulated entity must identify and maintain a register of its material service providers and manage the material risks associated with using these providers. Material service providers are those on which the entity relies to undertake a critical operation or that expose it to material operational risk.[15] Material arrangements are those on which the entity relies to undertake a critical operation or that expose it to material operational risk.
50.         An APRA-regulated entity must, at a minimum, classify a provider of the following services as a material service provider, unless it can justify otherwise:
       (a)          for an ADI: credit assessment, funding and liquidity management and mortgage brokerage;
       (b)          for an insurer (general, life, private health): underwriting, claims management, insurance brokerage and reinsurance;
       (c)          for an RSE licensee: fund administration, custodial services, investment management and arrangements with promoters and financial planners; and
       (d)          for all APRA-regulated entities: risk management, core technology services and internal audit.
51.         An APRA-regulated entity must submit its register of material service providers to APRA on an annual basis.
52.         APRA may require an APRA-regulated entity, or a class of APRA-regulated entities, to classify a service provider, type of service provider or service provider arrangement as material.

Service provider agreements
53.         Before entering into or materially modifying a material arrangement, an APRA-regulated entity must:
       (a)          undertake appropriate due diligence, including an appropriate selection process and an assessment of the ability of the service provider to provide the service on an ongoing basis; and
       (b)          assess the financial and non-financial risks from reliance on the service provider, including risks associated with geographic location or concentration of the service provider(s) or parties the service provider relies on in providing the service.
54.         For all material arrangements, an APRA-regulated entity must maintain a formal legally binding agreement (formal agreement). The formal agreement must, at a minimum:
(a)          specify the services covered by the agreement and associated service levels;
(b)          set out the rights, responsibilities and expectations of each party to the agreement, including in relation to the ownership of assets, ownership and control of data, dispute resolution, audit access, liability and indemnity;
(c)          include provisions to ensure the ability of the entity to meet its legal and compliance obligations;
(d)          require notification by the service provider of its use of other material service providers that it materially relies upon in providing the service to the APRA-regulated entity through sub-contracting or other arrangements;
(e)          require the liability for any failure on the part of any sub-contractor to be the responsibility of the service