EBA releases outsourcing guidelines

01 March 2019

On 25 February 2018, after extensive consultation the European Banking Association (“EBA”) has published its latest set of guidelines (the “Guidelines”) relating to the outsourcing arrangements of those financial institutions that fall within its remit. The impetus of the Guidelines is intended to harmonise the approach of the financial institutions and to make appropriate updates in line with advancements in electronic money technology.

It should be noted that the updated Guidelines also incorporate the standalone publication made by the EBA in December 2017 relating to the issue of outsourcing to cloud service providers, so the whole guidance framework can be referred to in one document. 

Two key themes that seem to emerge from the Guidelines are: (1) a new emphasis on categorising ‘critical or important’ outsourcings, and (2) alignment of definitions across EU legislation.

Financial institutions should now consider which of their outsourcing arrangements should be classed as ‘critical or important’, or ‘non-material’ outsourcings, with the Guidelines setting out several factors that should influence that decision. This new distinction reflects the feedback provided in the consultation process that the previous guidelines were overly prescriptive for small outsourcing arrangements. It should be noted that the EBA has not broken down what requirements of the Guidelines should apply to each size or level of outsourcing, considering that that this was already sufficiently clear.

The Guidelines also ensure that the definitions and requirements of outsourcing set out in the Payment Services Directive (PSD2), the Markets in Financial Instruments Directive (MiFID II) and the Commission’s Delegated Regulation (EU) 2017/565 are now consistent.

The updated Guidelines can be found at: https://eba.europa.eu/-/eba-publishes-revised-guidelines-on-outsourcing-arrangements. They should be considered in detail in order to determine whether wholesale (or any) revision of outsourcing contractual arrangements will be required. The Guidelines will come into force on 30 September 2019 and include transitional periods in order to allow: (1) the implementation of a register of outsourcing arrangements, (2) to make agreements between competent authorities, and (3) to otherwise reintegrate outsourced functions or move them to a new service provider if the guidelines prove difficult to meet.

If you have any questions on the above, the Guidelines, or require assistance in reviewing or revising your existing outsourcing arrangements, or in relation to new arrangements, please contact Alan Nelson or Ian Stevens.

Show more Show less

Back to top

Agency Database

Future Dates

* Estimated date

  • 24 November 2019

    Form K, the conversion form under SM&CR,  must be submitted by 23.59pm on 24 November 2019.

  • 9 December 2019

    The changes set out in the appendices of PRA PS20/19, implementing changes to the prescribed responsibility for recovery and resolution under SM&CR,  will come into force. 

  • 9 December 2019

    PRA Consultation CP20/19 closes.