Outsourcing
Relying on a third party to carry out an activity the firm would otherwise do itself, while keeping regulatory responsibility for it.
Regulators allow outsourcing but not the outsourcing of responsibility. Material outsourcing usually needs due diligence, a written agreement with audit and access rights, an exit plan and, in many regimes, notice to the regulator before it starts.
Cloud services, intra-group arrangements and AI vendors are increasingly treated as outsourcing.
Where the rules use it.
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- CSSF Circular 22/806 — Outsourcing arrangementsThe single outsourcing framework, now applying to DORA entities for business process outsourcing only.Luxembourg · 5 controls
- Central Bank of Ireland — Operational Resilience & Outsourcing GuidanceThe cross-industry guidance on operational resilience and on outsourcing.Ireland · 4 controls
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls