Featured Product

    IOSCO Updates Outsourcing Principles for Operational Resilience

    October 27, 2021

    The Board of the International Organization of Securities Commissions (IOSCO) published a final report updating the outsourcing principles for regulated entities that outsource tasks to service providers, including the cloud service provider. The updated principles are based on the earlier outsourcing principles for market intermediaries and for markets, but their application has been expanded to include trading venues, intermediaries, market participants acting on a proprietary basis, and credit rating agencies.

    The revised outsourcing principles comprise a set of fundamental precepts and seven principles. The fundamental precepts cover issues such as the definition of outsourcing, the assessment of materiality and criticality, affiliates, sub-outsourcing, and outsourcing on a cross-border basis. The seven principles set out expectations for regulated entities that outsource tasks, along with the guidance for implementation. One key principles specifies that a regulated entity should take appropriate steps to ensure that service providers protect confidential information and data related to the regulated entity and its clients, from intentional or inadvertent unauthorized disclosure to third parties. In general, the principles address the following factors:

    • Due diligence in the selection and monitoring of a service provider and its performance
    • The contract with a service provider
    • Information security, business resilience, continuity and disaster recovery
    • Confidentiality Issues
    • Concentration of outsourcing arrangements
    • Access to data, premises, personnel, and associated rights of inspection
    • Termination of outsourcing arrangements

    The report also briefly addresses the impact of COVID-19 on outsourcing and operational resilience and includes an Annex that describes how outsourcing integrates with cloud computing and how credit rating agencies use and incorporate outsourcing and cloud computing in their organizational strategies and structures. It covers, among others, the three cloud service models—namely, Infrastructure as a Service, Platform as a Service, and Software as a Service. The report notes that the basic approaches to outsourcing and cloud computing are not limited to the credit rating agency sector, rather they span the financial services industry. 

     

    Related Links

    Keywords: International, Banking, Securities, Outsourcing Principles, Cloud Service Providers, PAAS, SAAS, Operational Resilience, Cyber Risk, Operational Resilience, Cyber Risk, Operational Risk, Regtech, IOSCO

    Related Articles
    News

    APRA Penalizes Heritage Bank for Incorrect Reporting of Capital

    The Australian Prudential Regulation Authority (APRA) found that Heritage Bank Limited had incorrectly reported capital because of weaknesses in operational risk and compliance frameworks, although the bank did not breach minimum prudential capital ratios at any point and remains well-capitalized.

    November 29, 2021 WebPage Regulatory News
    News

    OSFI Releases Annual Report 2021-2022

    The Office of the Superintendent of Financial Institutions (OSFI) released the annual report for 2020-2021.

    November 29, 2021 WebPage Regulatory News
    News

    APRA Finalizes Guidance on Management of Climate Change Risks

    The Australian Prudential Regulation Authority (APRA) released the final Prudential Practice Guide on management of climate change financial risks (CPG 229) for banks, insurers, and superannuation trustees.

    November 26, 2021 WebPage Regulatory News
    News

    EBA Publishes Single Rulebook Q&A Updates in November 2021

    The European Banking Authority (EBA) Single Rulebook Question and Answer (Q&A) tool updates for this month include answers to 10 questions.

    November 26, 2021 WebPage Regulatory News
    News

    EC Proposes New Measures Under Capital Markets Union Package

    The European Commission (EC) has adopted a package of measures related to the Capital Markets Union.

    November 25, 2021 WebPage Regulatory News
    News

    European Council Adopts Position on Digital Finance Package Proposals

    The European Council adopted its position on two proposals that are part of the digital finance package adopted by the European Commission in September 2020, with one of the proposals involving the regulation on markets in crypto-assets (MiCA) and the other involving the Digital Operational Resilience Act (DORA).

    November 25, 2021 WebPage Regulatory News
    News

    PRA Proposes Rulebook Changes; BoE Extends BEEDS Testing Window

    The Prudential Regulation Authority (PRA) is proposing, via the consultation paper CP21/21, to apply group provisions in the Operational Resilience Part of the PRA Rulebook (relevant for the Capital Requirements Regulation or CRR firms) to holding companies.

    November 25, 2021 WebPage Regulatory News
    News

    FED Outlines Lending Conditions and Supervisory Activities in H1 2021

    The Board of Governors of the Federal Reserve System (FED) published a report that summarizes banking conditions in the United States, along with the supervisory and regulatory activities of FED.

    November 24, 2021 WebPage Regulatory News
    News

    EBA Publishes Standards to Calculate Risk-Weights of CIUs Under CRR

    The European Banking Authority (EBA) published the final report on draft regulatory technical standards for the calculation of risk-weighted exposure amounts of collective investment undertakings or CIUs, in line with the Capital Requirements Regulation (CRR).

    November 24, 2021 WebPage Regulatory News
    News

    APRA Expects Boards to Strengthen Ability to Oversee Cyber Resilience

    The Australian Prudential Regulation Authority (APRA) recently completed two pilot initiatives in its 2020-2024 Cyber Security Strategy, which was published in November 2020.

    November 23, 2021 WebPage Regulatory News
    RESULTS 1 - 10 OF 7736