• CTRL Part 8.2 CTRL Part 8.2 Material outsourcing arrangements

    • CTRL 8.2.1 Meaning of material outsourcing

      In these rules:

      material outsourcing, for an authorised firm, means the outsourcing of a function of such importance that weakness or failure in the exercise of the function would cast serious doubt on:

      (a) the firm’s ability to comply with:
      (i) any regulations, rules or principles; or
      (ii) any condition, restriction or requirement of its authorisation;
      (b) its financial performance or position; or
      (c) its ability to continue in business.

      Note The outsourcing of the internal audit function is a material outsourcing — see rule 6.4.2 (3).


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)

    • CTRL 8.2.2 Due skill in material outsourcing arrangements

      (1) The senior management of an authorised firm must exercise due skill, care and diligence in selecting, entering into, managing and exiting from a material outsourcing arrangement.
      (2) Before entering into a material outsourcing arrangement, the senior management:
      (a) must assess the risks that the outsourcing poses to the firm’s business; and
      (b) must satisfy themselves that the service provider selected has the ability and capacity to perform the relevant function reliably and professionally at the start and during the life cycle of the outsourcing.
      (3) For this rule, the senior management must take into account at least the following matters:
      (a) whether the service provider is regulated, to what extent, and by whom;
      (b) whether the function is subject to specific regulation or supervision;
      (c) the risk that the service provider’s service may become unavailable because of the number of other persons using the service provider;
      (d) the financial stability and expertise of the service provider;
      (e) any conflict of interest that might arise from the provision of the function by the service provider.


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)

    • CTRL 8.2.3 Written agreement for material outsourcing arrangements

      (1) The written agreement (required by rule 8.1.5 (2)) between an authorised firm and a service provider for a material outsourcing arrangement must require the service provider:
      (a) to deal with the Regulatory Authority in an open and co-operative way in relation to matters relating to the firm under the material outsourcing; and
      (b) to grant the Authority access to the firm’s books, records and data in the possession or control of the service provider.
      The Authority expects firms to be able to demonstrate that the outsourced function is being performed effectively. The Authority may seek documentary evidence relating to the performance of the service provider.
      (2) The agreement must include, if appropriate, provisions as to:
      (a) the law applicable to the agreement;
      (b) the reporting or notification requirements on the service provider and the means for measuring quantitative and qualitative performance by the service provider;
      (c) access by the firm, its internal auditors, external auditors or actuaries to the firm’s books, records and data while they are in the possession or control of the service provider;
      (d) the obligation to protect confidential information and personal data (that is, any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identification number or to 1 or more factors specific to the individual’s physical, physiological, mental, economic, cultural or social identity);
      (e) the rules for subcontracting, if the arrangement permits it;
      (f) the termination rights of each party; and
      (g) contingency arrangements.

      Note Rule 8.2.6 requires contingency arrangements to be made to allow the business of the firm to continue in the event of a significant loss of services from the service provider.


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)

    • CTRL 8.2.4 Regulatory Authority to be notified of certain matters

      (1) An authorised firm must not enter into a material outsourcing arrangement unless it gives the Regulatory Authority at least 30 business days’ prior written notice of its intention to enter into the arrangement.
      (2) If the arrangement permits subcontracting to a third party, the firm must give the Authority notice of that fact.


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)

    • CTRL 8.2.5 Additional information about material outsourcing arrangements

      (1) The Regulatory Authority may, by written notice to an authorised firm, require the firm to give the Authority, within a stated reasonable period, information about a material outsourcing arrangement (or proposed material outsourcing arrangement) that the Authority reasonably needs to enable it to decide whether the arrangement complies with this Chapter.
      (2) The power given by this rule is additional to the Authority’s other powers.
      Note See for example FSR, article 48 (Powers to obtain documents and information).


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)

    • CTRL 8.2.6 Contingency arrangements

      (1) An authorised firm that enters into a material outsourcing arrangement must make comprehensive contingency arrangements to allow its business to continue in the event of a significant loss of services from the service provider.
      (2) The contingency arrangements must include:
      (a) an exit strategy; and
      (b) if appropriate, provision for partial exit and step-in.
      (3) The contingency arrangements must cover at least the following:
      (a) a significant loss of resources at the service provider;
      (b) financial failure of the service provider;
      (c) unexpected termination of the outsourcing arrangement.


      Derived from QFCRA RM/2020-4 (as from 1st July 2021)