EBA Outsourcing Guidelines – delivering a successful ...

The EBA Guidelines apply to any "Outsourcing" arrangements, defined as: "an arrangement of any form between [a firm] and a service provider ... August3,2021 EBAOutsourcingGuidelines–deliveringasuccessfulremediationprojectinfivesteps TristanJonckheer,MichaelWainwright Dentons +Follow x Following x Following -Unfollow Contact LinkedIn Facebook Twitter Send Embed Toembed,copyandpastethecodeintoyourwebsiteorblog: FirmshavefivemonthsbeforethedeadlinetobringlegacyoutsourcingarrangementsintocompliancewiththeEuropeanBankingAuthority"Guidelinesonoutsourcingarrangements"("EBAGuidelines").Inthisnote,UKoutsourcingpartner,TristanJonckheer,setsoutfiveclearstepstoachievecompliancewithinthisshorttimeframe. TheEBAGuidelinescameintoeffecton30September2019.Theseguidelinesrequirefinancialservicesfirmstoincludespecificprovisionsintheiroutsourcingcontracts.FirmsarerequiredtobringlegacyoutsourcingarrangementsintocompliancewiththeEBAGuidelinesnolaterthanthenextcontractrenewaldate,or31December2021atthelatest. NotwithstandingBrexit,UKregulatorsnotifiedtheEBAthattheUKwillcomplywiththeEBAGuidelines.However,duetotheCOVID-19pandemic,thePRAandFCAhavebothconfirmedtheywillgivefirmsintheUKuntil31March2022tobringlegacyoutsourcingarrangementsintocompliancewiththeUK'simplementationoftheEBAGuidelines.OutsidetheUK,regulatorsinEUmemberstateshaveremainedcommittedtotheoriginaldeadlineof31December2021. Asaresult,firmsarerushingtoplanandimplementremediationprojectsacrosstheirEuropeanoperationstobringlegacycontractsintocompliancewiththeEBAGuidelinesbeforethedeadline.Thisisacomplextaskandcanbedauntingwhenhundredsofcontractsinmultiplejurisdictionsmaybein-scope. Inthisnote,wehavebrokendownsuchremediationprojectsintofivedistinctstepsandsetoutsometipsfordeliveringtheseprojectsinamanageableandefficientmanner: Fivestepsfordeliveringaremediationproject Step1–Identifyin-scopecontracts In-scopefirms–dotheEBAGuidelinesapplytoyou? InitiallyyouwillneedtoestablishiftheEBAGuidelinesapplytoyourfirmand,ifso,towhichaspectsofitsoperations. TheEBAGuidelinesapplyto: creditinstitutionsandinvestmentfirmssubjecttotheEUCapitalRequirementDirective(2013/36/EU).Thesearebanks,buildingsocietiesandIFPRUinvestmentfirms;and paymentinstitutionsandelectronicmoneyinstitutions. AssomeEUmemberstateshaveappliedtheiroutsourcingguidelinestoabroaderrangeoffirms,localcounselshouldbeinstructedinrelevantjurisdictionstoadviseonthescopeoflocallawimplementationsoftheEBAGuidelines.Forexample,intheUKthePRA'sSupervisoryStatement2/21(SS2/21)alsoappliesto: insuranceandreinsurancefirmsandgroupsin-scopeofSolvencyII,includingtheSocietyofLloyd’sandmanagingagents(insurers);and branchesofoverseasbanksandinsurers(third-countrybranches). In-scopejurisdictions–whichjurisdictionsdoyouoperatein? RegulatorsinEUmemberstateshavecommittedtocomplyingwiththeEBAGuidelines(seecompliancetablehere).NotwithstandingBrexit,theUKwillimplementtheEBAGuidelines,totheextentthattheyremainrelevantpost-Brexit. FirmswillthereforeneedtoassesswhichoftheirEuropeanoperationsmayhavearrangementswithinthescopeoftheEBAGuidelines. In-scopecontracts–whichofthecontractsarein-scopeoftheEBAGuidelines? OnceafirmhasidentifiedwhichaspectsofitsEuropeanoperationsmaybeimpactedbytheEBAGuidelines,itmustidentifytheoutsourcingarrangementswhicharein-scopeineachrelevantjurisdiction. TheEBAGuidelinesapplytoany"Outsourcing"arrangements,definedas:"anarrangementofanyformbetween[afirm]andaserviceproviderbywhichthatserviceproviderperformsaprocess,aserviceoranactivitythatwouldotherwisebeundertakenbythe[firm]itself."Thisincludesunwritteninformalarrangementsandintra-groupoutsourcing. Thefollowingarrangementsarenot"outsourcing": afunctionthatislegallyrequiredtobeperformedbyaserviceprovider(e.g.astatutoryaudit); marketinformationservices(e.g.provisionofdatabyBloomberg,Moody’s,Standard&Poor’s,Fitch); globalnetworkinfrastructures(e.g.Visa,MasterCard); clearingandsettlementarrangementsbetweenclearinghouses,centralcounterpartiesandsettlementinstitutionsandtheirmembers; globalfinancialmessaginginfrastructuresthataresubjecttooversightbyrelevantauthorities; correspondentbankingservices;and theacquisitionofservicesthatwouldotherwisenotbeundertakenbytheinstitutionorpaymentinstitution(e.g.utilities). Theoutputofthisphaseoftheprojectshouldbealistofin-scopeoutsourcingarrangements,includingtherelevantinformationrelatingtoeachsucharrangement. Step2–Prioritise Identifycriticalcontracts–doesthecontractrelatetoacriticalorimportantfunction? WhencomplyingwiththeEBAGuidelines,firmsshouldhaveregardtotheproportionalityprincipleandtakeintoaccountthecomplexityoftheoutsourcedfunctions,therisksarisingfromtheoutsourcingarrangement,thecriticalityorimportanceoftheoutsourcedfunctionandthepotentialimpactoftheoutsourcingonthecontinuityoftheiractivities.Inotherwords,themorecriticaltheoutsourcingarrangement,themoreimportantitwillbetomeettherequirementsoftheEBAGuidelines. Inaddition,somerequirementsintheEBAGuidelinesonlyapplytocriticalorimportantoutsourcingarrangements,butnottoother(lessimportant)arrangements. CriticalcontractsshouldthereforebeidentifiedandprioritisedinanyprojecttocomplywiththeEBAGuidelines.Thisrequiresariskassessmentofeachoutsourcingarrangementinthelistofin-scopecontracts(seeStep1),sothelistidentifiesthecriticalandimportantcontracts. TheEBAGuidelinessetoutsomecriteriatohelpwiththisassessment.Theyalsomakeclearacontractwillalwaysbecriticalorimportantwhere: adefectorfailureinitsperformancewouldmateriallyimpair: itscontinuingcompliancewiththeconditionsoftheirauthorisationoritsotherobligationsundertheCapitalRequirementslaws; itsfinancialperformance;or thesoundnessorcontinuityofitsbankingandpaymentservicesandactivities; operationaltasksofinternalcontrolfunctionsareoutsourced,unlesstheinappropriateprovisionoftheoutsourcedfunctionwouldnothaveanadverseimpactontheeffectivenessoftheinternalcontrolfunction;or itoutsourcesfunctionsthatwouldrequireauthorisationbyacompetentauthority. Identifyrenewaldates–willthecontractexpireorberenegotiatedinanyevent? Foreachin-scopecontractidentified(seeStep1),youshouldidentifytheexpirydateofthethencurrentterm. Iftheexpirydateisbeforethedeadlineforcompliance(31December2021(EU);31March2022(UK)),thecontractcanusuallybeexcludedfromtheremediationproject.Onexpiryofsuchlegacycontract,thereplacementcontractshouldbecompliantwiththeEBAGuidelinesinaccordancewiththefirm'sbusiness-as-usualoutsourcingpolicy. Step3–Gapanalysis Eachin-scopeoutsourcingarrangementshouldbereviewedagainsteachrequirementoftheEBAGuidelines,toconfirmeitherthattherequirement: hasbeenmetandnofurtheractionisrequired;or hasnotbeenmetandthecontracteither: mustbeamendedtomeettherequirement;or applyingtheproportionalityprinciple,nofurtheractionisrequired. Thiscanbedonebycheckingeachcontractagainstachecklistandidentifyinganygaps.Afirmshouldseekexpertlegaladvicebeforedecidingnottoremedyanyidentifiednon-compliancewiththeEBAGuidelines. Wheremanycontractsarewithinthescopeofthereview,thiscanrequireextensiveresources.Criticalandimportantcontractsshouldbeprioritised(seeStep2),bothassensibleriskmanagementandasfirmswillneedtoreportanynon-complianceinrespectofsuchcontractstotheirregulatorsoncethedeadlinehaspassed. FirmsmaystandupateamofparalegalstohelptoperformreviewsagainsttheEBAGuidelineschecklistinafastandcost-efficientmanner,particularlywheretherearelargenumbersofnon-criticalcontracts(forexample,DentonscanuseparalegalsbasedinitsremoteLegalDeliveryCentretoperformsuchreviews). Step4–Developprecedents Firmsshoulddevelopaprecedentaddendum,orsetofclauses,whichmeettherequirementsoftheEBAGuidelines. WheretheGapAnalysis(Step3)hasidentifiedthatarequirementoftheEBAGuidelineshasnotbeenmet,therelevantprovisionsintheprecedentdocumentscanbeincorporatedintothecontractto"fillthegap"bymeetingtherequirement. Thisaddendum(ortherelevantclauses)mayalreadyhavebeencreatedbythefirmforuseinnewcontracts.Ifnot,anewaddendumcanbedrafted. Step5–Amendcontracts Firmsshouldamendeachofthein-scopecontractstoremedyany"gap"incompliancewiththeEBAGuidelines(seeStep3).Again,themostcriticalarrangementsshouldbeprioritised(seeStep2).Therearevariousapproachestoachievethis: ThebestwaytoensurecompliancewiththeEBAGuidelinesistonegotiatebespokecontractualamendmentswiththeserviceprovider(viathecontractuallyprescribedChangeControlProcedure,oraseparateamendmentagreement)toremedyanygaps.FirmsmayusetheirprecedentEBAGuidelinesaddendum(seeStep4)asasourcebookfortherelevantcontractualprovisions. Alternatively,firmsmayseektominimisethetimerequiredtoremedyanygapbyrequiringtheserviceprovidertosignanamendmentagreementwhichcontainstheEBAGuidelinesaddendum(or,ideally,onlythoseprovisionsintheEBAGuidelinesaddendumwhichrelatetoanyidentifiedgap). However,whereaserviceproviderisintransigent(oftenprovidersoflargesharedITplatformsorinfrastructure),itmayrefusetoengageinnegotiationsonitsstandardcontractualterms.Inthiscase,firmsmayrequesttheserviceprovider'sstandardEBAaddendum.Wheretheserviceproviderofferssuchanaddendum,thisshouldbecarefullycheckedagainsttherelevantrequirementsoftheEBAGuidelines.SuchaddendumswilloftenseektomeettherequirementsintheleastburdensomemannerfortheserviceproviderandmaynotgofarenoughtofullysatisfytherequirementsoftheEBAGuidelines. IfanyserviceproviderdoesnotmeettherequirementsoftheEBAGuidelinesfollowingnegotiations,thismustberecordedandaddressed,forexamplethroughfurthernegotiations,replacementoftheserviceprovideroraformalriskacceptanceprocess. Yourprojectteam AnyprojecttobringlegacycontractsintocompliancewiththeEBAGuidelineswillbecomplex.Insomeprojects,therearemanyhundredsofagreementsin-scope.Asaresult,appointingtherightdeliveryteamwillbeessentialtodeliveringtheprojectefficiently. Theteamshouldinclude: Projectmanager–Legalprojectmanagementskillswillbeessentialtodeliveringtheprojectefficiently.Whereverpossible,firmsshouldengagespecialistprojectmanagers,eitherin-house,oranexternallegalprojectmanagementteam,todelivertheproject. Leadlegaladviser–FirmsshouldengageinternalorexternallawyerswithexperienceofdeliveringprojectstocomplywiththeEBAGuidelines.Theywillhavedevelopeddocumentstoassistwithcompliance,whichcanbereadilycustomised,savingtimeandcosts(seeDentons'EBAGuidelinesToolkitbelow).Theleadlegaladvisershouldalsoactasasinglepointofcontact,managinganylocalcounselasrequired(seebelow). Localcounsel–LocalcounselwillneedtobeengagedtoadviseonlocalimplementationsoftheEBAGuidelines.Ifyourleadlegaladviserisagloballawfirm,suchasDentons,thelocalcounselwillbeengagedandmanageddirectlybythem. Legaldeliveryteam–Someofthemoreresource-intensivetasksintheprojectaremoreadministrativeinnatureandwillnotrequireexpertlegaladvice,inparticularmanyaspectsofSteps3(Gapanalysis)and5(Amendcontracts).Alegaldeliveryteam,consistingofcontractmanagersandparalegalswilloftenbeabletoperformmuchofthe"heavylifting"inthesestepsinarapid,cost-efficientmanner. DentonsEBAGuidelinesToolkit Dentonshasdevelopedthefollowingtoolsandresourceswhichwillbecustomisedanddeployedasappropriatewhenadvisingonafirm'sEBAremediationproject: EBAScopingFlowchart-Aflowcharttohelpafirmtodeterminewhichcontractsarein-scopeforreviewagainsttheEBAGuidelines. EBACriticalContractsFlowchart-Aflowcharttohelpafirmtodeterminewhichcontractsarecriticalorimportant. EBAGuidelinesChecklist-AdetailedchecklisttoconfirmiftherequirementsoftheEBAGuidelineshavebeenmetbyanoutsourcingcontract. EBAGuidelinesAddendum–Acontractualaddendumwhichcanbeincorporatedintoanyin-scopecontract(inwholeorinpart)whichcontainsclauseswhichmeettherequirementsoftheEBAGuidelines. EBAGuidelinesAddendumPlaybook-Acustomisedplaybook(withpreferredandfall-backpositions)sothattheprocurement,contractmanagementandlegalteamcannegotiateamendmentstotheEBAGuidelinesAddendumandmakeappropriateescalationswhereneeded. Dentons'LegalProjectManagementTeam–Aspecialistteamoflegalprojectmanagerstoenabletheefficientdeliveryofyourremediationproject,ontimeandtobudget. Dentons'LegalDeliveryCentre–Projectdeliverysupportfromourcost-efficientremoteparalegalteam. DentonsDirect–Advancedcollaborationandprojectworkflowtooltohostdocumentsandfacilitatetracking,reportingandprojectmanagement. Send Print Report LatestPostsKenyaBudget2022-Summary CostaRica:Inactiveentitieshavemoretimetofileincometaxstatement FairPayAgreementsBillintroducedtoParliament Thecivilliabilitiesofdirectors,shareholdersandseniormanagementinwindingupproceedingsinHongKong LegalissuesforUKConstructionBusinesses,Spring2022 Seemore» DISCLAIMER:Becauseofthegeneralityofthisupdate,theinformationprovidedhereinmaynotbeapplicableinallsituationsandshouldnotbeacteduponwithoutspecificlegaladvicebasedonparticularsituations. ©Dentons|AttorneyAdvertising Refineyourinterests» Writtenby: Dentons Contact +Follow x Following x Following -Unfollow TristanJonckheer +Follow x Following x Following -Unfollow MichaelWainwright +Follow x Following x Following -Unfollow more less PublishedIn: EuropeanBankingAuthority(EBA) +Follow x Following x Following -Unfollow FinancialInstitutions +Follow x Following x Following -Unfollow FinancialServicesIndustry +Follow x Following x Following -Unfollow LegacyContracts +Follow x Following x Following -Unfollow Outsourcing +Follow x Following x Following -Unfollow Remediation +Follow x Following x Following -Unfollow UK +Follow x Following x Following -Unfollow GeneralBusiness +Follow x Following x Following -Unfollow Finance&Banking +Follow x Following x Following -Unfollow more less Dentonson: "Mybestbusinessintelligence,inoneeasyemail…" Yourfirststeptobuildingafree,personalized,morningemailbriefcoveringpertinentauthorsandtopicsonJDSupra: SignUp Login *Byusingtheservice,yousignifyyouracceptanceofJDSupra'sPrivacyPolicy. -hide -hide Thiswebsiteusescookiestoimproveuserexperience,trackanonymoussiteusage,storeauthorizationtokensandpermitsharingonsocialmedianetworks.Bycontinuingtobrowsethiswebsiteyouaccepttheuseofcookies.Click heretoreadmoreabouthowweusecookies. Continue