After various rounds of consultations with the industry during the fall and early winter, the Office of Superintendent of Financial Institutions (OSFI) issued a revised and final Guideline B-10 Outsourcing of Business Activities, Functions, and Processes (the “Guideline”) on March 11, 2009. There is no transition period for implementation of the Guideline. The Guideline replaces the previous Guideline B-10 (“Previous Guideline”), which had been in place since 2003.
The Guideline was revised to reflect changes arising from Bill C-371 which removed the need for a federally regulated entity (“FRE”) to obtain OSFI approval to maintain and process outside Canada information or data relating to the preparation and maintenance of certain corporate, accounting and customer records. The removal of this OSFI approval requirement lightens the regulatory burden on FREs and recognizes that non-Canadian outsourcing arrangements relating to information and data maintenance and processing, and record retention are a regular part of doing business in the twenty first century’s global economy.
OSFI suggests that the other revisions to the Guideline should not necessitate changes to existing outsourcing contracts or substantive amendments to policies and procedures, but the other revisions are intended to clarify certain provisions of the previous Guideline. There is no transition period for implementation of the Guideline. In practice, FREs may find that some amendments to existing contracts or arrangements may be required. Some of the potential items are highlighted below.
The impact of the following revisions to the Guideline should be considered by FREs:
Aside from the removal of the OSFI approval, some other noteworthy revisions include the following:
1. Outsourcing arrangements arising from acquisitions. Outsourcing arrangements that a FRE has obtained as a result of an acquisition are expected to comply with the expectations set out in the Guideline at the first opportunity, such as the time the outsourcing contract, agreement or statement of work (where applicable) is substantially amended, renewed or extended.
2. Intra-group outsourcing arrangements. Where a member of an FRE group enters into a material outsourcing arrangement with another entity that is also a member of the same FRE group, the FRE must adhere to the legislative requirements relating to location of records.
3. Exposure to multiple outsourcing arrangements with a single provider. The Guideline states that there is a potential influence on the FRE where a single service provider provides multiple outsourcing arrangements. This influence should be measured in the aggregate in order to assess the materiality of the arrangement in question.
4. Due Diligence for substantially amended outsourcing arrangements. The existing due diligence requirements that a FRE must comply with now also apply to substantially amended outsourcing arrangements (in addition to the current application to selecting or renewing an outsourcing arrangement).
5. Tracking the physical location of service provision. The Guideline now requires that details are be obtained in respect of the physical location from which outsourced services are being provided.
6. Expanded Scope for Ensuring Contingency Planning. The Guideline now requires that an outsourcing arrangement address a service provider’s plans to address events (in addition to problems) that may affect their operations, including systems breakdown and natural disaster and other reasonably foreseeable events. An FRE must ensure that the service provider regularly tests its business recovery system as it affects the outsourced activity, and address material deficiencies. In addition, the FRE is expected to provide a summary of the test results to OSFI on receipt of reasonable notice.
7. Change to circumstances regarding exercise of OSFI audit rights. The Guideline clarifies that OSFI will provide the FRE with reasonable notice of its intent to exercise its audit rights and will share its findings with the FRE where appropriate. The previous Guideline stated that OSFI would typically only exercise its audit rights in "extreme circumstances". The term "extreme circumstances" has been removed in the Guideline.
8. Expanded scope of monitoring service providers. In addition to a FRE’s annual review of a service provider’s ability to continue to provide the service, based on the risk, the Guideline now suggests FREs undertake a similar assessment regarding the use and performance of significant subcontractors.
9. Summary Template. The Guideline now includes a standardized template for FREs to summarize all material outsourcing arrangements.
FREs would be well-advised to include a review of material outsourcing arrangements to ensure compliance with the Guideline as part of their regular compliance and audit process.