What does it mean for bank service providers?
The Reserve Bank of New Zealand (RBNZ) released its revised BS11 Outsourcing Policy (BS11) last week following a two year consultation period. While the RBNZ initially consulted on lowering the threshold of BS11 to apply to some smaller banks, the finalised BS11 policy will continue to apply to "large banks" only (currently being ANZ, Westpac, BNZ, ASB and Kiwibank). Service providers, as well as banks, will need to understand and have processes in place to comply with this revised policy.
BS11 regulates a very wide range of bank outsourcing arrangements, covering any services or functions provided by a third party on a regular or continuing basis that could be undertaken by the bank, unless that service or function is on the "white list" published on the RBNZ's website. While the white list exempts a wide range of general services and functions, there are likely to be some service providers that are surprised to have their contracts captured by the policy.
Concerns have been raised over the course of the consultation process about the lack of Trans-Tasman alignment in relation to bank outsourcing requirements given the interconnected nature of the New Zealand and Australian banking markets. For example, the Australian Prudential Regulation Authority (APRA) only applies its CPS 231 Outsourcing policy to outsourcing arrangements that involve "material business activities". Therefore far fewer outsourcing arrangements are captured by the APRA policy. Service providers dealing with both the parent and subsidiary of the big four banks on both sides of the Tasman need to be aware of, and have processes in place to manage, this and other misalignments in the policies.
The revised BS11 policy introduces a RBNZ non-objection process for some outsourcing arrangements where banks will be required to seek RBNZ non-objection before entering into certain arrangements. Service providers will need to factor this process in to their commercial negotiation timelines with banks, with the RBNZ indicating that it will aim to review outsourcing arrangement non-objection applications within 20 working days.
Other obligations under the policy will require some service providers to provide evidence of their business continuity and disaster recovery arrangements and include prescribed contractual terms in the outsourcing arrangement. The prescribed terms largely relate to business continuity matters upon the bank being placed into statutory management and RBNZ access to documentation relating to the arrangement.
Banks will also be required to prepare a compendium of their outsourced arrangements for disclosure to RBNZ under the revised BS11 policy, which will include sensitive commercial details such as a breakdown of the costings under an outsourcing arrangement. Service providers will need to ensure that their confidentiality and data security clauses are carefully drafted to reflect these new requirements.