CTRL 8.2.3 Written agreement for material outsourcing arrangements

(1) The written agreement (required by rule 8.1.5 (2)) between an authorised firm and a service provider for a material outsourcing arrangement must require the service provider:
(a) to deal with the Regulatory Authority in an open and co-operative way in relation to matters relating to the firm under the material outsourcing; and
(b) to grant the Authority access to the firm’s books, records and data in the possession or control of the service provider.
Guidance
The Authority expects firms to be able to demonstrate that the outsourced function is being performed effectively. The Authority may seek documentary evidence relating to the performance of the service provider.
(2) The agreement must include, if appropriate, provisions as to:
(a) the law applicable to the agreement;
(b) the reporting or notification requirements on the service provider and the means for measuring quantitative and qualitative performance by the service provider;
(c) access by the firm, its internal auditors, external auditors or actuaries to the firm’s books, records and data while they are in the possession or control of the service provider;
(d) the obligation to protect confidential information and personal data (that is, any information relating to an individual who can be identified, directly or indirectly, in particular by reference to an identification number or to 1 or more factors specific to the individual’s physical, physiological, mental, economic, cultural or social identity);
(e) the rules for subcontracting, if the arrangement permits it;
(f) the termination rights of each party; and
(g) contingency arrangements.

Note Rule 8.2.6 requires contingency arrangements to be made to allow the business of the firm to continue in the event of a significant loss of services from the service provider.

 

Derived from QFCRA RM/2020-4 (as from 1st July 2021)