.jpg)
20 January, 2017
In July 2016, the Monetary Authority of Singapore (MAS) issued updated Guidelines on Outsourcing (Outsourcing Guidelines), setting out MAS’ expectations of financial institutions in relation to outsourcing of business activities to a service provider, including both external third party outsourcing arrangements and intra-group outsourcings. More information on the Outsourcing Guidelines is set out in our previous article here.
As we commence a new year, it is timely that financial institutions consider the practical steps that should be taken to ensure compliance with the updated Outsourcing Guidelines.
Remediation of existing outsourcing arrangements
The Outsourcing Guidelines apply to all outsourcing arrangements, existing and future. In MAS’ ‘Response to Feedback Received on Public Consultation on Guidelines on Outsourcing’, issued at the same time as the Outsourcing Guidelines, it indicated that financial institutions are required to conduct a self-assessment of all existing outsourcing arrangements against the Outsourcing Guidelines and that any deficiencies identified as part of the self-assessment should be rectified within twelve months of the issuance of the Outsourcing Guidelines (i.e. by 27 July 2017).
Financial institutions should now have completed self-assessments of existing outsourcing arrangements (including intra-group arrangements), and have in place a plan to remediate any deficiencies identified to ensure compliance with the Outsourcing Guidelines. In practice, most financial institutions are reviewing contracts and carrying out a remediation programme ahead of 27 July this year.
Outsourcing Register
Under the updated Outsourcing Guidelines, a financial institution is no longer required to notify MAS when it is planning or has entered into a material outsourcing.
Instead, MAS now expects financial institutions to maintain a register of all material outsourcing arrangements in a prescribed form. The register is to be submitted to MAS at least annually or upon request. The register is to be updated promptly and forms part of the oversight and governance review undertaken by the board and senior management of each institution.
While the requirement to notify MAS before making any material outsourcing commitment has been removed, financial institutions are still expected to exercise appropriate due diligence on outsourcing arrangements and should be ready to demonstrate to MAS their observance of the Outsourcing Guidelines.
Role of the board and senior management
MAS recognises in the Outsourcing Guidelines that the board and senior management of a financial institution play important roles in ensuring a sound risk management culture and environment.
As well as the responsibilities of the board (or a committee delegated by it) set out in the original guidelines, MAS also expects the board to be responsible for setting a suitable risk appetite to define the nature and extent of risks that the institution is willing and able to assume from its outsourcing arrangements. The board is also responsible for ensuring that senior management establishes appropriate governance structures and processes for sound and prudent risk management, such as a management body that reviews controls for consistency and alignment with a comprehensive institution-wide view of risk.
Similarly, senior management is also expected to monitor and maintain effective control of all risks from its material outsourcing arrangements on an institution-wide basis.
Notice on Outsourcing
MAS has indicated that it continues to work on the Notice on Outsourcing and we expect this to be issued early this year. The Notice on Outsourcing will be legally binding on financial institutions and may specify whether any contravention will constitute a criminal offence.
Other measures
In addition to the practical steps financial institutions can be taking to ensure compliance with the Outsourcing Guidelines, financial institutions should continue to ensure that appropriate measures and procedures are in place to manage the risks associated with outsourcing commensurate with the nature of the risks in, and materiality of, the outsourcing arrangements in place.
For further information, please contact:
Mark Robinson, Partner, Herbert Smith Freehills
mark.robinson@hsf.com
