BMA releases guidance on outsourcing

However, there has been a growing appreciation by such companies of the potential risks involved when an organisation enters into such agreements and companies become heavily reliant on relationships with particular outsourcing service providers.

In recognition of the risks posed, and that outsourcing has increased considerably in Bermuda over the past three years, the Bermuda Monetary Authority has released new Guidance Notes on outsourcing for the benefit of “relevant licensed entities” (RLE).

In this context, the RLEs are banks, deposit companies, the Bermuda Stock Exchange, corporate service providers, trust companies, money service businesses, investment businesses, fund administrators, and the credit union licensed by the BMA.

Although the Guidance Notes apply to all outsourcing arrangements, the BMA is most concerned with those that are “material”, defined as those whereby failure in provision or performance of the activity would materially impact business operations, financial performance, ability to manage risk, or compliance with Bermuda laws and regulations.

The BMA has further narrowed the scope of the Guidance Notes by excluding the provision of auxiliary services that many companies outsource, i.e. those not integral to delivery of the company’s own services.

Examples include the provision of external legal advice, external training and security, and management and maintenance of the RLE’s premises. The definition also excludes the provision of standardised services such as office equipment, stationery or photocopying, which by their nature are unlikely to pose a significant risk.

The new guidelines will come into force on May 1, 2020. Prior to this, transition periods will operate. The first transition period is from October 1, 2019 to January 3, 2020. During this period RLEs will have two options regarding pre-existing outsourcing arrangements:

• to seek prior approval from the BMA by submission of a complete and comprehensive application, demonstrating compliance with the Guidance Notes, for each material outsourcing arrangements the RLE identifies; or
• the attestation route, which involves the CEO, or board-nominated senior executive, attesting that each material outsourcing arrangement entered into by the RLE complies fully with all aspects of the Guidance Notes. These attestations will then subsequently be verified by the BMA’s supervisory programme post-implementation.

The second transition period will run from January 4, 2020 to implementation of the Guidance Notes on May 1, 2020. During this period, where an RLE wishes to enter into a new material outsourcing arrangement it can use either the pre-approval or attestation routes.

Once implementation of the Guidance Notes has taken place, RLEs wishing to enter into new material outsourcing arrangements will be required to make prior notification submissions to the BMA.

The Guidance Notes make it clear that there is an expectation that RLEs wishing to enter into material outsourcing arrangements will have clear guidelines and policies for managing these arrangements.

In particular, the BMA expects that RLEs will be able to demonstrate that a risk evaluation process has been conducted that identifies not only the benefits of outsourcing but also risks and how these can be mitigated.

RLEs will also be expected to conduct appropriate due diligence on the outsourcing providers they have selected, including contingency plans should the service fail.

RLEs also need to consider whether the written agreement entered into adequately captures the terms of the arrangement and specifically addresses any issues identified during the risk evaluation and due diligence stages of the process.

Monitoring of the risks posed by outsourcing should also be an ongoing process and RLEs should be able to demonstrate that the level of monitoring is proportionate to the risks posed.

Prior to release of the Guidance Notes the BMA sought feedback from companies and industry bodies representing market participants. This feedback prompted the BMA to change its regulatory approach from that of “prior approval” to one of “prior notification”.

In adopting a prior notification approach, the BMA has reduced approval times from 60 days to 20 days. Applications will notify the BMA that the RLE intends on entering into a material outsourcing arrangement subject to no objection being made by the BMA within the 20 working day notification period.

This change addressed the concern expressed by RLEs that prior approval could potentially lead to costly delays and interruptions to businesses operating in Bermuda, potentially proving detrimental to competitiveness.

During the notification period the BMA can take several actions including requesting further information, effectively stopping the 20 working day clock, increasing the speed of response by agreeing to the outsourcing, or formally objecting to the proposed arrangement.

Following the release of the Guidance Notes RLEs should now have a much clearer understanding of the expectations that the BMA has regarding outsourcing relationships and of the steps necessary to obtain approval for both existing agreements and those entered into post-implementation.

These Guidance Notes may also have the additional benefit of assisting RLEs in identifying and applying additional scrutiny to outsourcing arrangements that pose systemic risk to their business.