On 25 February 2018, after extensive consultation the European Banking Association (“EBA”) has published its latest set of guidelines (the “Guidelines”) relating to the outsourcing arrangements of those financial institutions that fall within its remit. The impetus of the Guidelines is intended to harmonise the approach of the financial institutions and to make appropriate updates in line with advancements in electronic money technology.
It should be noted that the updated Guidelines also incorporate the standalone publication made by the EBA in December 2017 relating to the issue of outsourcing to cloud service providers, so the whole guidance framework can be referred to in one document.
Two key themes that seem to emerge from the Guidelines are: (1) a new emphasis on categorising ‘critical or important’ outsourcings, and (2) alignment of definitions across EU legislation.
Financial institutions should now consider which of their outsourcing arrangements should be classed as ‘critical or important’, or ‘non-material’ outsourcings, with the Guidelines setting out several factors that should influence that decision. This new distinction reflects the feedback provided in the consultation process that the previous guidelines were overly prescriptive for small outsourcing arrangements. It should be noted that the EBA has not broken down what requirements of the Guidelines should apply to each size or level of outsourcing, considering that that this was already sufficiently clear.
The Guidelines also ensure that the definitions and requirements of outsourcing set out in the Payment Services Directive (PSD2), the Markets in Financial Instruments Directive (MiFID II) and the Commission’s Delegated Regulation (EU) 2017/565 are now consistent.
The updated Guidelines can be found at: https://eba.europa.eu/-/eba-publishes-revised-guidelines-on-outsourcing-arrangements. They should be considered in detail in order to determine whether wholesale (or any) revision of outsourcing contractual arrangements will be required. The Guidelines will come into force on 30 September 2019 and include transitional periods in order to allow: (1) the implementation of a register of outsourcing arrangements, (2) to make agreements between competent authorities, and (3) to otherwise reintegrate outsourced functions or move them to a new service provider if the guidelines prove difficult to meet.