Legal Updates

In December 2021 the Central Bank of Ireland (the “Central Bank”) published its Cross-Industry Guidance on Outsourcing (the “Outsourcing Guidance”) and its feedback statement on its Consultation Paper 138 (the “Feedback Statement”).

In accordance with the Outsourcing Guidance, the Central Bank expects that regulated financial service provider (“RFSPs”) establish and maintain an outsourcing register which is required to contain certain specific information regarding outsourcing arrangements. These information requirements include, but are not limited to:

• A reference number for each outsourcing arrangement;
• The start date and, as applicable, the next contract renewal date, the end date and/or notice periods for the service provider and for the institution or payment institution;
• A brief description of the outsourced function, including the data that is outsourced and whether or not personal data has been transferred or if their processing (of personal data) is outsourced to a service provider;
• A category assigned by the institution or payment institution that reflects the nature of the function as described above (e.g. information technology (IT), control function), which should facilitate the identification of different types of arrangements;
• The name of the service provider, the corporate registration number, the legal entity identifier (where available), the registered address and other relevant contact details, and the name of its parent company (if any) the details should specify whether the outsourced service provider (“OSP”) is a regulated firm and if so provide the name of the regulator;
• The country or countries where the service is to be performed, including the location (i.e. country or region) of the data;
• Whether or not (yes/no) the outsourced function is considered critical or important, including, where applicable, a brief summary of the reasons why the outsourced function is considered critical or important or not;
• In the case of outsourcing to a cloud service provider, the cloud service and deployment models, i.e. public/private/hybrid/community, and the specific nature of the data to be held and the locations (i.e. countries or regions) where such data will be stored;
• The date of the most recent assessment of the criticality or importance of the outsourced function.

In its Feedback Statement, the Central Bank advised that with regard to the expectations set out in the Outsourcing Guidance, notification templates appropriate to each sector and aligned with the requirements of the EBA Guidelines (GL 02/2019) would be published. On 9 August 2022, the Central Bank published the outsourcing register templates (the “Template Registers”) and supporting guidance notes (the “Completion Guidance”) for completion on its website. The proposed content of the Template Register had been included in Outsourcing Guidance. The Central Bank has published specific Template Registers and Completion Guidance published for specific industry sectors:

• Less Significant Institutions (Banking LSIs),
• Insurance and Re-insurance,
• Payments and E-Money Firms; and
• Markets Firms.

For UCITS Management Companies and AIFMs, the relevant Template Register will be the investment outsourcing template for “Markets Firms” and the Central Bank has provided detailed supporting Completion Guidance.

Do all RFSPs need to make outsourcing submissions?

It is worth noting that the Template Registers are only required to be filed with the Central Bank by firms which are categorised as medium low or above in accordance with the Central Bank’s PRISM rating system. RFSPs which do not fall within these PRISM categories should still seek to use the Template Registers as a guide to completing their internal register in order to ensure that they are in a position to provide a report to the Central Bank in its prescribed form should the Central Bank make a request for such a report. In its Feedback Statement, the Central Bank advised firms categorised as Low Impact under the Central Bank’s PRISM rating system that they may be asked to submit their Outsourcing Register on a case by case basis.

Supporting Guidance for completion of templates

The Completion Guidance provides useful information on the manner in which the various sections of the template register are to be completed and provide practical information to assist RFSPs to submit returns through the Central Bank’s online reporting system (“ONR”). The Template Registers require outsourcing arrangements to be reported on a contract-by-contract basis and additional sections within the Template Register are to be completed in respect of those critical or important outsourcing arrangements and are also required to include details relating to any sub-outsourcing of critical or important outsourcing arrangements. Fund administrators are also required to provide certain specified additional information. In addition, the Central Bank requires certain additional data to assist it in performing its regulatory responsibilities including those relating to the assessment of concentration risk. Some of the data provides additional granularity with the intention being to ensure clarity within the registers with respect to the service providers with whom RFSPs are contracting.

The Template Registers are also required to provide details of all outsourcing arrangements that group entities supervised by the Central Bank make use of, irrespective of whether the entities signed contractual arrangements themselves or if they were signed on their behalf, e.g. by a non-supervised entity outside of the Central Bank’s jurisdiction. All intragroup outsourcing arrangements where the Central Bank is the supervisory authority are required to be reported.

The Completion Guidance at Appendix 2 provides information on the categories of outsourced functions/services and can be used for mapping purposes. Completion Guidance makes it clear that certain arrangements (i.e. provision of professional services (legal, annual audit and advisory services)) should be excluded from submission of any Template Register.

Regulatory deadlines and implementation

RFSPs which are required to file returns with the Central Bank are advised in the Completion Guidelines that the reference date for the submission of data is 31 December 2021. This means that RFSPs should submit the register with all outsourcing arrangements in place as of that date. RFSPs are expected to submit the completed register via the ONR by close of business on 7 October 2022.

It is proposed that the submission deadline from 2023 onwards will be at the end of February of each year, with the reference date of 31 December of the previous year and that the submission deadline for 2023 will be confirmed in due course.

Queries regarding the content of the registers

Any queries which RFSPs may have in relation to the completion and or submission of the register should be directed to outsourcing.register@centralbank.ie and the Central Bank has advised that RFSPs should ensure they keep their respective Supervisory Contact / Team in copy on any correspondence.

For further information on any of the issues discussed in this publication, please contact the authors or your usual contact in Dillon Eustace.