GUIDELINES ON OUTSOURCING

1 CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 GUIDELINES ON OUTSOURCING CONSULTATION PAPER P019-2014 SEPTEMBER 2014 CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 PREFACE 1 MAS first issued the GUIDELINES on OUTSOURCING ( the GUIDELINES )

2 In 20041 to promote sound risk management practices for OUTSOURCING arrangements of financial institutions ( institutions ). As OUTSOURCING arrangements have become more prevalent and complex over the years, MAS proposes revisions to the GUIDELINES . These proposals are part of MAS efforts to raise the standards of institutions risk management practices. 2 The updated GUIDELINES provide further guidance on sound practices relating to the Responsibility of the Board and Senior Management and Monitoring and Control of OUTSOURCING Arrangements in paragraphs and , respectively. These changes underscore the need for an institution-wide, responsive and rigorous approach towards management of OUTSOURCING arrangements.

3 3 MAS invites interested parties to submit their views and comments on updates to the GUIDELINES , including the above-mentioned sections as well as in the following areas where significant changes have been made: a) Applicability to Institutions (Page 2) b) Definition of Material OUTSOURCING Arrangement (Page 3) c) Notification of Adverse Developments (Page 7) d) Fit and Proper Criteria (Page 12) e) Audit Frequency and Scope (Page 21-22) f) Register of OUTSOURCING Arrangements (Page 30) 4 Electronic submission of views and comments is encouraged. Please email your comments to by 7 October 2014. Alternatively, you may wish to submit your comments by post to: OUTSOURCING Workgroup (Attention: Banking Department II) Monetary Authority of Singapore 10 Shenton Way, MAS Building Singapore 079117 1 The GUIDELINES on OUTSOURCING were subsequently updated on 1 July 2005.

4 CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 5 Please note that any submission received may be made public unless confidentiality is specifically requested for the whole or part of the submission.

5 CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 1 1 INTRODUCTION .. 4 2 APPLICABILITY OF GUIDELINES .. 4 3 LEGAL AND REGULATORY OBLIGATIONS .. 6 4 ENGAGEMENT WITH MAS ON OUTSOURCING .

6 6 NOTIFICATION OF MATERIAL OUTSOURCING 6 NOTIFICATION OF ADVERSE DEVELOPMENTS .. 7 NEWLY REGULATED INSTITUTIONS OR ACQUIRED ARRANGEMENTS .. 7 5 RISK MANAGEMENT PRACTICES .. 8 OVERVIEW .. 8 RESPONSIBILITY OF THE BOARD AND SENIOR MANAGEMENT .. 8 EVALUATION OF RISKS .. 10 ASSESSMENT OF SERVICE PROVIDERS .. 11 OUTSOURCING AGREEMENT .. 13 CONFIDENTIALITY AND SECURITY .. 15 BUSINESS CONTINUITY MANAGEMENT .. 16 MONITORING AND CONTROL OF OUTSOURCING ARRANGEMENTS .. 18 AUDIT AND INSPECTION .. 20 OUTSOURCING OUTSIDE SINGAPORE .. 22 OUTSOURCING WITHIN A GROUP .. 23 OUTSOURCING OF INTERNAL AUDIT TO EXTERNAL AUDITORS .. 23 ANNEX 1 .. 25 ANNEX 2 .. 27 ANNEX 3 .. 28 ANNEX 4.

7 30 CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 2 DEFINITIONS In these GUIDELINES on OUTSOURCING , unless the context otherwise requires: board or board of directors means (a) in the case of an institution incorporated in Singapore, the board of directors; and (b) in the case of an institution incorporated or established outside Singapore, a management committee or body beyond local management charged with oversight and supervision responsibilities for the institution in Singapore; customer means (a) in relation to any trustee for a collective investment scheme authorised under section 286 of the Securities and Futures Act (Cap.)

8 289), that is approved under that Act, the managers of and participants of the collective investment scheme; (b) in relation to an approved exchange, recognised market operator incorporated in Singapore, approved clearing house, recognised clearing house incorporated in Singapore, and licensed trade repository under the Securities and Futures Act, a person who may participate in one or more of the services provided by such entities; or (c) in relation to a licensed trust company under the Trust Companies Act (Cap. 336), a trust for which the trust company provides trust business services and includes the settlor and any beneficiary under the trust; customer information means (a) in relation to a licensed trust company, protected information as defined in section 49 of the Trust Companies Act; (b) in relation to an approved exchange, recognised market operator incorporated in Singapore, approved clearing house and recognised clearing house incorporated in Singapore, user information as defined in section 2 of the Securities and Futures Act.

9 (c) in relation to a licensed trade repository, user information and transaction information as defined in section 2 of the Securities and Futures Act; or (d) in the case of any other institution, information held by the institution that relates to its customers and these include customers accounts, particulars, transaction details and dealings with the financial institutions; institution means any financial institution as defined in section 27A of the Monetary Authority of Singapore Act (Cap. 186); CONSULTATION PAPER ON GUIDELINES ON OUTSOURCING SEP 2014 3 material OUTSOURCING arrangement means an OUTSOURCING arrangement (a)

10 Which, in the event of a service failure or security breach, has the potential to either: (i) materially impact an institution s business operations, reputation or profitability; or (ii) adversely affect an institution s ability to manage risk and comply with applicable laws and regulations, or (b) which involves customer information and, in the event of any unauthorised access or disclosure, loss or theft of customer information, may materially impact an institution s customers; OUTSOURCING agreement means a written agreement setting out the contractual terms and conditions governing relationships, functions, obligations, responsibilities, rights and expectations of the contracting parties in an OUTSOURCING arrangement; OUTSOURCING arrangement means an arrangement in which a service provider provides the institution with a service that may currently or potentially be performed by the institution itself and which includes the following characteristics: (a) the institution is dependent on the service on an ongoing basis but such service excludes services that involve the provision of a finished product ( insurance policies).