On 25 February 2019, the European Banking Authority ("EBA") published its revised Guidelines on outsourcing arrangements ("EBA Outsourcing Guidelines") on its website. The EBA Outsourcing Guidelines entered into force on 30 September 2019 and replace and repeal the Committee of European Banking Supervisors guidelines of 14 December 2006 on outsourcing and the EBA Recommendations of 20 December 2017 on outsourcing to cloud service providers.
The EBA Outsourcing Guidelines apply to credit institutions, certain categories of investment firms, payment institutions and electronic money institutions. The guidelines set out specific provisions for the governance frameworks of such financial institutions with regard to their outsourcing arrangements and related supervisory expectations and processes.
Among others, the guidelines clarify that the management body of each financial institution remains responsible for that institution and its activities at all times, also in case of outsourcing. Further guidance is provided on which arrangements with third parties are to be considered as outsourcing, whereby a distinction is drawn between requirements on critical and important outsourcing arrangements and other outsourcing arrangements. The guidelines also provide further clarity on the required content for outsourcing policies, how to deal with conflicts of interest, business continuity plans, audit requirements, the outsourcing process generally, sub-outsourcing, access and audit rights, termination rights, minimum contract requirements, outsourcing to third countries, etc.
National supervisory authorities should comply with the EBA Outsourcing Guidelines by incorporating them into their regulatory practices. As a result, the National Bank of Belgium ("NBB") issued a circular on 19 July 20191 ("NBB Outsourcing Circular"), which integrates the EBA Outsourcing Guidelines in the NBB’s regulatory practice. In this circular, the NBB also provides further guidance on the reporting obligations that need to be complied with by Belgian financial institutions when outsourcing certain activities to third parties.
Entry into force on 30 September 2019 with a grandfathering period
The NBB Outsourcing Circular entered into force on 30 September 2019 for all new outsourcing arrangements and for all arrangements amended or novated after that date.
For existing outsourcing arrangements, a grandfathering period applies until 31 December 2021, meaning that the old guidance of the NBB will continue to apply to such arrangements until they are amended or novated:
- Circular PPB 2004/5 of 22 June 2004 regarding proper management practices relating to outsourcing by credit institutions and investment firms;
- Circular NBB_2018_20 of the NBB of 19 June 2018 on the EBA recommendations on the outsourcing to cloud service providers;
- Communication NBB_2012_11 of the NBB of 9 October 2012 on the prudential expectations towards cloud computing; and
- Communication of the CBFA of 6 November 2007 on its policy regarding the outsourcing of asset management services of assets of non-professional clients to a service provider in a State that is not a member of the European Economic Area.
As of 31 December 2021, these old circulars and communications are definitively repealed and replaced by the NBB Outsourcing Circular, which cross-refers to the EBA Outsourcing Guidelines.
Scope of application of the NBB Outsourcing Circular
The NBB Outsourcing Circular applies to Belgian credit institutions, stockbroking firms, payment institutions (with the exception of account information service providers) and electronic money institutions.
For credit institutions, a distinction is made between (i) less significant institutions ("LSIs") that are supervised by the NBB, and (ii) significant institutions ("Significant Institutions") that are under direct supervision of the European Central Bank ("ECB").
Whereas LSIs are always required to comply with the reporting requirements under the NBB Outsourcing Circular (as set out below in section 4), Significant Institutions are only recommended to do so to the extent the ECB does not publish specific guidelines itself in this respect.
The NBB further clarifies that Belgian branches of credit institutions and investment firms governed by the law of a non-EEA Member State are in-scope as well. Accordingly, such non-EEA branches will also need to comply with the EBA Outsourcing Guidelines and the NBB reporting obligations, also in case of intra-group outsourcing.
Lastly, the NBB clarifies that outsourcing within the same legal entity, referred to as “intra-entity outsourcing”, is not in-scope of the circular and the reporting requirements. According to the NBB, this includes the situation whereby a branch office makes use of the outsourcing arrangements concluded by its head office or by another branch office of the same legal entity.
Reporting requirements under the NBB Outsourcing Circular
The EBA Outsourcing Guidelines impose a number of outsourcing reporting obligations on the financial institutions that fall within its scope.
In the NBB Outsourcing Circular, the NBB further clarifies these reporting obligations and sets out its practical expectations with regard to such reporting obligations. A distinction is made between the following four trigger events:
1. Reporting of the entire outsourcing register or parts thereof upon request of the supervisory authority:
Financial institutions that fall within the scope of the NBB Outsourcing Circular should, upon request, make available to the competent authority the register of all existing outsourcing arrangements.
According to the NBB Outsourcing Circular, institutions can expect to have their outsourcing register requested at the following occasions:
- in the first half of 2022, following the migration deadline of 31 December 2021, when all outsourcing documentation as requested under §16 of the EBA Outsourcing Guidelines must be completed;
- at least every 3 years, for LSIs and non-EEA branches, together with and within the framework of the supervisory review and evaluation procedure (the "SREP" procedure);
- when the supervisory authority explicitly requests this in connection with the outsourcing of a critical or important function or if an outsourced function has become critical or important (cfr. §58 of the EBA Outsourcing Guidelines).
2. Informing the supervisory authority on planned outsourcing of critical or important functions:
Prior to outsourcing a function, the institution must verify whether the function is critical or important. If so, it must notify the supervisory authority in a timely and appropriate manner.
The NBB considers a two-month period as an indication of sufficiently timely. Institutions are nevertheless advised to inform the supervisory authority as soon as possible of their outsourcing plans, even if not all information on them is available yet.
The notification must include at least all elements mentioned in §54 of the EBA Outsourcing Guidelines. This includes, among others, a reference number for each outsourcing arrangement, the start date, contract renewal date, end date of the arrangement, a brief description of the outsourced function, a category that reflects the nature of the function, the name of the service provider, etc.
Institutions are recommended to use the NBB’s template reporting forms that are annexed to the NBB Outsourcing Circular (Annex 3), together with all other relevant documents that may be useful to assess the risk of the outsourcing arrangement. The outsourcing agreement does not have to be added to the information dossier, unless requested by the supervisor.
3. Informing the supervisory authority when an outsourced function becomes critical or important:
A function that was initially not critical and important can become critical or important over time. If such a situation occurs, the financial institution must inform the supervisory authority thereof as well.
The NBB clarifies that a function can become critical or important for several reasons. This includes for example the situation whereby an outsourcing arrangement is being amended, or where there is an unexpected increase of scope or magnitude of an existing outsourcing arrangement.
Institutions are recommended to use the NBB’s template reporting forms that are annexed to the NBB Outsourcing Circular (Annex 3), together with all other relevant documents that may be useful to assess the risk of the outsourcing arrangement.
4. Informing the supervisory authority in the event of material changes to and/or critical incidents concerning outsourced critical or important functions:
Lastly, institutions must inform the supervisory authority in a timely manner in the event of material changes to and/or critical incidents concerning outsourced critical or important functions.
In both cases, the NBB considers it useful to add the information as described in §§54 and 55 of the EBA Outsourcing Guidelines to the notification, which prescribe the content requirements for the outsourcing register that institutions must maintain for existing outsourcing arrangements.
For this notification, the NBB’s template reporting form can be used as well (Annex 3).
1 Circular of the National Bank of Belgium of 19 July 2019 on Guidelines of the European Banking Authority (EBA) of 25 February 2019 on outsourcing (EBA/GL/2019/02).