Outsourcing & Third-Party Risk Guidance

Outsourcing includes delegation of a function, process, service, or activity to a third party that the licensee would otherwise perform itself, including intra-group arrangements where relevant.

A function is “material” where failure or degradation would materially impact: continuity of service; system integrity; confidentiality or data security; client outcomes; compliance; or the Authority’s ability to supervise.

Firms must apply this Guidance proportionately. Higher-risk and material arrangements require deeper governance, stronger contractual protections, and more frequent monitoring.

The licensee remains fully responsible for outsourced activities. Governance must define accountable owners, approval thresholds, and escalation processes for outsourcing decisions and incidents.

Maintain an outsourcing/third-party risk policy that covers: materiality criteria, due diligence, contract standards, oversight cadence, security controls, incident reporting, sub-outsourcing, and exit planning.

Maintain a current register of third-party arrangements including: provider, service, data types, locations, materiality rating, key SLAs, renewal dates, sub-processors, and exit plans.

Before engaging a provider, assess: operational impact, data exposure, cyber risk, compliance impact, service criticality, portability, concentration risk, and substitutability.

Due diligence should include, as applicable:

1. corporate and ownership checks (including UBO/controller identification where relevant);
2. financial stability and continuity indicators;
3. security posture (certifications, controls, penetration testing summaries, vulnerability management);
4. data protection posture and data residency capabilities;
5. BCP/DR capability, RTO/RPO targets and test evidence;
6. service delivery track record and incident history;
7. sub-processor mapping and control over onward outsourcing.

Classify third parties (e.g., low/medium/high; material/non-material) and set oversight requirements accordingly. Material/high-risk services must have enhanced controls and documented approvals.

Contracts for material outsourcing should include:

1. clear service description, responsibilities, and control boundaries;
2. service levels (availability, support hours, response times, performance metrics);
3. security obligations (access control, encryption, logging, vulnerability management);
4. incident notification obligations with timeframes and cooperation duties;
5. audit rights (direct or via independent assurance reports), including regulator access where applicable;
6. sub-outsourcing controls (approval rights and full visibility of sub-processors);
7. data handling terms (locations, retention, deletion, breach notification);
8. business continuity and disaster recovery commitments;
9. exit/termination rights, portability, and transition assistance;
10. liability, indemnities, and remediation obligations proportionate to risk.

Contracts should require advance notice for material changes (sub-processors, locations, architecture, security posture) and allow the licensee to object or exit where risks become unacceptable.

Monitor performance against SLAs, security posture, incident trends, and control effectiveness. Material arrangements should have scheduled reviews and documented outcomes.

For higher-risk services, obtain independent assurance where available (e.g., SOC reports, ISO certifications, audit summaries) and evaluate exceptions with remediation tracking.

Ensure incident playbooks include third-party coordination, contact points, and clear obligations for evidence preservation, root-cause analysis, and timelines for corrective actions.

Identify dependencies on single providers, regions, or infrastructures (including cloud concentration). Where concentration is high, implement mitigants (multi-vendor strategy, portability planning, enhanced resilience testing).

Licensees must have visibility into sub-processors and retain control through approval rights, security standards, and contractual flow-down obligations.

Maintain exit plans for material providers, including data portability, transition timelines, minimum notice periods, replacement options, and tested restoration of service.

Identify data types processed by third parties and apply data minimisation. Apply stronger controls for sensitive data (identity documents, financial data, KYC records, transaction data).

Document where data is stored/processed, who can access it, and how access is controlled and logged. Ensure appropriate controls for cross-border processing and lawful disclosure requests.

For material services, implement encryption in transit and at rest. Where feasible, adopt robust key management practices and define responsibilities for key custody and rotation.

During supervision, the Authority may request evidence such as:

1. outsourcing policy and governance approvals;
2. outsourcing register and materiality assessments;
3. due diligence pack and ongoing monitoring records;
4. contracts (or key clause extracts) for material providers;
5. BCP/DR test results, incident reports and remediation tracking;
6. sub-processor lists and change notifications.

Licensees should notify the Authority of material outsourcing changes or significant third-party incidents where these may impact continuity, integrity, confidentiality, or compliance.

This Guidance is effective upon publication. Licensees should implement proportionate controls promptly and ensure material arrangements are reviewed and uplifted where gaps exist.

This Guidance supplements the supervisory framework and supports risk-based oversight. It does not replace or override obligations under applicable Acts, license conditions, or codes.