12 March, 2019
On 7 February 2019, proposals to implement requirements for banks and merchant banks in respect of material outsourcing arrangements were introduced by the Monetary Authority of Singapore (“MAS”). These requirements will be implemented by way of MAS Notices directed at banks and merchant banks. MAS also intends for similar requirements to apply in relation to other financial sectors and will consult on this in due course.
This update outlines the key elements in MAS’s public consultation on its proposed revisions to the regime governing banks’ and merchant banks’ outsourcing arrangements.
Introduction
In September 2014, MAS consulted on an Outsourcing Notice that sets out minimum standards for financial institutions’ (“FIs”) management of outsourcing arrangements. The proposed requirements were in line with MAS’s expectation that an FI is to manage outsourcing arrangements as if the services were conducted by the FI.
After receiving public feedback, MAS will instead adopt a more targeted approach by issuing requirements specific to each class of FIs within MAS’s regulatory purview, the first being banks and merchant banks.
While MAS Notice 634 and MAS Notice 1108 currently impose requirements on banks and merchant banks respectively, in relation to outsourcing arrangements, where any outsourced function is to be performed outside Singapore, MAS intends to enhance the regime governing these FIs’ outsourcing arrangements by, among other things, issuing an Outsourcing Notice each for banks and merchant banks for material outsourcing arrangements (“Proposed Outsourcing Notices”).
Broadly, the Proposed Outsourcing Notices will set out legally binding requirements for banks and merchant banks in relation to their material outsourcing arrangements in the areas of:
(a) management of such arrangements;
(b) assessment of service providers;
(c) access to information by MAS and the bank or merchant bank;
(d) protection of customer information;
(e) audit; and
(f) termination of such arrangements.
Powers to strengthen MAS’s oversight of outsourcing arrangements of banks and merchant banks
MAS’s powers to direct banks to comply with requirements in respect of outsourcing arrangements will be enhanced by way of amendments to the Banking Act. Examples include directing a bank to:
(a) include in its outsourcing agreement, terms relating to the protection of confidentiality of customer information, the right of MAS to inspect or audit the service provider and its sub-contractors, and termination of the outsourcing agreement under specified circumstances;
(b) conduct due diligence checks on the service provider before the bank enters into an outsourcing arrangement with the service provider;
(c) establish and maintain measures to minimise disruption to the operations of the bank in the event that the service provider is unable to provide the service to the bank;
(d) provide such record, document, information or report to MAS concerning the outsourcing arrangement; and
(e) terminate the outsourcing agreement under specified circumstances.
Similar provisions are proposed to apply to merchant banks as well.
Outsourcing arrangements involving disclosure of customer information to service providers
Banks and merchant banks have the legal duty to keep all customer information confidential. If they wish to disclose customer information to service providers in respect of an outsourced function that is to be performed outside Singapore, they must currently comply with requirements under MAS Notice 634 (for banks) and MAS Notice 1108 (for merchant banks), pursuant to an exception provided for under banking legislation (“Exception”).
Instead of complying with MAS Notice 634 and MAS Notice 1108, the proposals mandate that banks and merchant banks will have to comply with the respective Proposed Outsourcing Notices, before they can rely on the Exception to disclose customer information to their service provider. In this regard, the Proposed Outsourcing Notices will incorporate existing requirements under MAS Notice 634 and MAS Notice 1108 (including the requirement to notify MAS of all outsourcing arrangements involving the disclosure of customer information in connection with the performance of an outsourced function outside Singapore), and impose minimum requirements relating to management of material outsourcing arrangements, assessment of service providers, and additional requirements on audit. To avoid any overlap, MAS Notice 634 and MAS Notice 1108 will be repealed in conjunction with the issuance of the Proposed Outsourcing Notices.
However, MAS intends for the application of the Proposed Outsourcing Notices to be broader and apply to all outsourcing arrangements involving the disclosure of customer information, regardless of where the outsourced function is to be performed. As such, all outsourcing arrangements involving the disclosure of customer information, even where written customer consent has been obtained, will be considered material outsourcing arrangements and be subject to the requirements in the Proposed Outsourcing Notices.
This reflects MAS’s intent for banks and merchants banks to pay due care to any outsourcing arrangement that involves the disclosure of customer information, whether such disclosure is in connection with the performance of an outsourced function within or outside Singapore.
Transition period
MAS recommends that the Proposed Outsourcing Notices take effect 12 months from the date of issuance so as to provide a transition period for banks and merchant banks to make the necessary arrangements to comply with the Proposed Outsourcing Notices.
Consultation Period
The consultation closed on 8 March 2019.
