On March 11, 2009, the Office of the Superintendent of Financial Institutions Canada (OSFI) released the first revision to its Guideline B-10, Outsourcing of Business Activities, Functions and Processes, since December 2003. As summarized in the OSFI letter that accompanies it, the Guideline - which sets out OSFI's expectations with respect to outsourcing by federally-regulated entities (FREs) - is being revised in 7 significant respects:
- Section 2 of the Guideline now provides that outsourcing arrangements obtained by the FRE "as the result of an acquisition" are expected to comply with the Guideline at the first opportunity, e.g. when the relevant contract, agreement or statement of work is substantially amended, renewed or extended.
- Section 6 of the Guideline now clarifies the proper approach to assessing the materiality of a series of related outsourcing arrangements from a risk-management perspective. The FRE must consider the potential influence of multiple outsourcing arrangements with a single service provider, which although possibly individually immaterial, could have an important aggregate influence on the FRE.
- In Section 7.2.1(g) of the Guideline, OSFI clarifies the expectation that the FRE should contractually ensure that the service provider "regularly tests its business recovery system as it pertains to the outsourced activity, notifies the FRE of the test results, and addresses any material deficiencies." The FRE should be prepared to provide a summary of such test results to OSFI on reasonable notice.
- Pursuant to Section 7.2.1(h) of the Guideline, the FRE will now receive reasonable advance notice in the event that OSFI chooses to exercise its supervisory review/audit rights over the service provider under Section 7. OSFI will now also share any findings with the FRE, if appropriate.
- The Guideline now incorporates a standardized template (Annex 4) for the "centralized list" of material outsourcing arrangements that is required under Section 7.3.1. The FRE can use the template to summarize its material outsourcing arrangements.
- At Section 7.3.3 of the Guideline, OSFI's expectations that the FRE's annual review of the service provider's ability to continue to deliver the service, in the manner expected, are clarified to indicate that the review should be commensurate with the level of risk involved, and should include an assessment of the service provider's circumstances, including the use and performance of significant subcontractors.
- A number of additional changes have been made to ensure that the wording of the Guideline reflects the recent repeal of the requirement that OSFI's approval be obtained where the FRE plans to maintain or process, outside Canada, information or data relating to certain corporate, accounting and customer records. Section 8 of the December 2003 B-10 revision has been deleted in its entirety.
OSFI has expressed the opinion that the revised Guideline should not necessitate changes to existing contracts and, accordingly, no transition period is provided with respect to this revision.