The Board of the International Organization of Securities Commissions (IOSCO) published a final report updating the outsourcing principles for regulated entities that outsource tasks to service providers, including the cloud service provider. The updated principles are based on the earlier outsourcing principles for market intermediaries and for markets, but their application has been expanded to include trading venues, intermediaries, market participants acting on a proprietary basis, and credit rating agencies.
The revised outsourcing principles comprise a set of fundamental precepts and seven principles. The fundamental precepts cover issues such as the definition of outsourcing, the assessment of materiality and criticality, affiliates, sub-outsourcing, and outsourcing on a cross-border basis. The seven principles set out expectations for regulated entities that outsource tasks, along with the guidance for implementation. One key principles specifies that a regulated entity should take appropriate steps to ensure that service providers protect confidential information and data related to the regulated entity and its clients, from intentional or inadvertent unauthorized disclosure to third parties. In general, the principles address the following factors:
- Due diligence in the selection and monitoring of a service provider and its performance
- The contract with a service provider
- Information security, business resilience, continuity and disaster recovery
- Confidentiality Issues
- Concentration of outsourcing arrangements
- Access to data, premises, personnel, and associated rights of inspection
- Termination of outsourcing arrangements
The report also briefly addresses the impact of COVID-19 on outsourcing and operational resilience and includes an Annex that describes how outsourcing integrates with cloud computing and how credit rating agencies use and incorporate outsourcing and cloud computing in their organizational strategies and structures. It covers, among others, the three cloud service models—namely, Infrastructure as a Service, Platform as a Service, and Software as a Service. The report notes that the basic approaches to outsourcing and cloud computing are not limited to the credit rating agency sector, rather they span the financial services industry.
Keywords: International, Banking, Securities, Outsourcing Principles, Cloud Service Providers, PAAS, SAAS, Operational Resilience, Cyber Risk, Operational Resilience, Cyber Risk, Operational Risk, Regtech, IOSCO
Previous ArticleEC Adopts Legislative Package on Basel III Rules for Banks
The European Commission (EC) published a public consultation on the review of revised payment services directive (PSD2) and open finance.
The European Commission (EC) has issued two letters mandating the European Supervisory Authorities (ESAs) to jointly propose amendments to the regulatory technical standards under Sustainable Finance Disclosure Regulation or SFDR.
The European Banking Authority (EBA) published its annual report on convergence of supervisory practices for 2021. Additionally, following a request from the European Commission (EC),
The Farm Credit Administration published, in the Federal Register, the final rule on implementation of the Current Expected Credit Losses (CECL) methodology for allowances
The U.S. Securities and Exchange Commission (SEC) looks set to intensify focus on crypto-assets and cyber risk and extended the comment period on the proposed rules to enhance and standardize climate-related disclosures for investors.
The Australian Prudential Regulation Authority (APRA) announced reduction in the aggregate Committed Liquidity Facility and issued an update on the operational preparedness for zero and negative market interest rates.
The Commission for the Financial Market (CMF) in Chile published capital adequacy ratios (as of February 2022, January 2022, and December 2021) for 17 banks and for the banking system.
The Prudential Regulation Authority (PRA) issued a statement on the European Banking Authority (EBA) guidelines on management of non-performing exposures (NPEs) and forborne exposures.
The European Banking Authority (EBA) updated the implementing technical standards that specify the data collection for the 2023 supervisory benchmarking exercise in relation to the internal approaches used in market risk, credit risk, and IFRS 9 accounting.
The European Insurance and Occupational Pensions Authority (EIOPA) published a feedback statement on the responses received to the consultation on blockchain and smart contracts in insurance.