Document ID: chunk:federal_register_of_legislation:F2016L01436:body:0:p8
Version: federal_register_of_legislation:F2016L01436
Segment Type: other
Provision Reference: 
Character Range: 20017–23076

its head office, the requirements of subparagraph 27(d) and paragraph 28 do not apply.
33.         Where:
(a)          an APRA-regulated institution invokes the institution's Business Continuity Plan[10] as a result of an unexpected event; or
(b)          there is a sudden financial or operational failure of an existing service provider,
and, as a result, enters into a new outsourcing agreement, the APRA-regulated institution must comply with paragraphs 26 to 31 inclusive, 37, 38, and 39 only to the extent that is reasonably possible having regard to the nature of the extreme event or sudden failure. The APRA-regulated institution must notify APRA as soon as practicable of any such outsourcing arrangement.

APRA access to service providers
34.         An outsourcing agreement must include a clause that allows APRA access to documentation and information related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the APRA-regulated institution; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA's requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the APRA-regulated institution of its intention to do so.
35.         Where an APRA-regulated institution enters into an outsourcing arrangement with a related body corporate, the APRA-regulated institution must ensure that access by APRA to the related body corporate is not impeded.
36.         An APRA-regulated institution must take all reasonable steps to ensure that a service provider will not disclose or advertise that APRA has conducted an on-site visit, except as necessary to coordinate with other institutions regulated by APRA that are existing clients of the service provider.

Notification requirement
37.         An APRA-regulated institution must notify APRA as soon as possible after entering into an outsourcing agreement, and in any event no later than 20 business days after execution of the outsourcing agreement. This notification requirement applies to all outsourcing of material business activities.
38.         When an APRA-regulated institution notifies APRA of a new outsourcing agreement, it must also provide a summary to APRA of the key risks involved in the outsourcing arrangement and the risk mitigation strategies put in place to address these risks. APRA may request additional material where it considers it necessary in order to assess the impact of the outsourcing arrangement on the institution's risk profile.

Offshoring arrangements – requirement for consultation
39.         An APRA-regulated institution must consult with APRA prior to entering into any offshoring agreement involving a material business activity so that APRA may satisfy itself that the impact of the offshoring arrangement has been adequately