Revised Outsourcing Framework for Non-Bank Financial Institutions

Bangko Sentral ng PiliPinas

OFFICE OF THE GOVERNOR

CIRCULAR NO. 764

Series of 2012

Subject: Revised Outsourcing Framework for Non-Bank Financial Institutions

the revisions to the outsourcing framework of non-bank financial institutions, amending the Manual of Regulations for Non-Bank Financiai Institutions (MORNBFI) The Monetary Board, in its Resolution No. 1179 dated 19 July 2012, approved

NSSLAs, Section 4190P for Pawnshops and Section 4190N for Other NBFIs, Trust Entities, Subsidiaries and Affiliates of Banks and Quasi-Banks. particularly Section 4162Q (2008 -- 4190Q) for Quasi-Banks, Section 4190S for

1. Section 4162Q ((2008 - 4190Q) Duties. and Responsibilities of Quasi-Banks and their Directors/Officers in All Cases of Outsourcing of Quasi-Banking Functions] is re-titled and amended to read as follows:

Section 4162Q (2008 - 4190Q) Guidelines on Outsourcing. The rules on outsourcing of banking functions as shown in Appendix Q-37 shall be adopted insofar as they are applicable to QBs.

2. Subsection & 4406Q.9 Outsourcing Services in Trust Departments is amended to read as follows:

Subsection S 4406Q.9 Outsourcing Services in Trust Departments.

Q-37 shall be adopted insofar as they are applicable to trust investment management activities. The rules on outsourcing of banking functions as shown in Appendix departments of QBs performing trust and other fiduciary business and

3. Subsection s 4701Q.13 Outsourcing of Internet and Mobile Electronic Services is

amended to read as follows:

Electronic Services. The rules on outsourcing of banking functions as Subsection S 4701Q.13 Outsourcing of Internet and Mobile

shown in Appendix Q-37 shail be adopted insofar as they are applicable to quasi-banks' outsourcing of internet and mobile electronic services.

4. Section 4190S Duties and Responsibilities of NSSLAs and their Directors/Officers in All Cases of Outsourcing of NSSLA Functions is re-titled and amended to read as follows:

A. Mabini St., Malate 1004 Manila, Philippines * (632) 524-7011 * www.bsp.gov.ph [email protected]

Section 4190s Guidelines on Outsourcing. The rules on outsourcing of banking functions as shown in Appendix Q-37 shall be adopted insofar as they are applicable to NSSLAs.

5. Section 4190P Duties and Responsibilities of Pawnshops and their Directors/Officers in All Cases of Outsourcing of Pawnshop Functions is re-titled and amended to read as follows:

Section 4190P Guidelines on Outsourcing. The rules on outsourcing

insofar as they are applicable to Pawnshops. of banking functions as shown in Appendix Q-37 shall be adopted

6. Section 4190N Duties and Responsibilities of Non-Bank Financial institutions and

their Directors/Officers in All Cases of Outsourcing of Non-Bank Financial Institutions is re-titled and amended to read as follows:

insofar as they are applicable to Fls. Section 4190N Guidelines on Outsourcing. The rules on outsourcing of banking functions as shown in Appendix Q-37 shall be adopted

7. Appendix 37 of the MORNBFI is re-titled as Revised Outsourcing Framework for

Banks and amended to read as shown in the Annex A.

publication either in the Official Gazette or any newspaper of general circulation. This Circular shall take effect fifteen (15) calendar days following its

FOR THE MONETARY BOARD:

AMANDO M. TETANGCO, JR.

Governor

3 August 2012

Page 2 of 2

Appendix 37

REVISED OUTSOURCING FRAMEWORK FOR BANKS (Appendix to Section 4162Q (2008-4192Q, 4190S, 4190P, 4190N)

1. Section X162 of the MORB ((2008 - X169) Duties and Responsibilities of Banks and their

Directors/Officers in All Cases of Outsourcing of Banking Functions] is re-titled and amended to reflect a statement of principle which shall read as follows:

Section X162 Statement of Principle on Outsourcing. An institution may outsource banking support and marketing activities subject to the provisions set forth below. Accordingly, an institution is exposed to operational risks as a result of outsourcing. As such, an institution that avails of outsourcing should have in place appropriate mechanisms to ensure the effective management of attendant risks.

The previous Section X162 of the MORB shall be renumbered as Subsection S X162.1 and

amended to read as follows:

Subsection S X162.1 Governance .in All Cases of Outsourcing of Banking Functions. When outsourcing is allowed by law, a bank shall:

a. Be responsible for the performance of the outsourced activity in the same

manner and to the same extent as if it was performing directly the said activity;

b. Comply with all laws and regulations applicable in the Philippines including

labor laws and those governing the banking activities/services performed by the qualified service providers on the bank's behalf;

c. Monitor and review on an ongoing basis the performance of the service providers undertaking the outsourced activity and/or service; and

d. Update as necessary its assessment of the extent of the materiality of its

outsourcing arrangements vis-a-vis the adequacy of its risk management System.

3. The previous Subsection $ X162.1 of the M0RB ((2008 -- X169.1) Prohibition against

folows: MORB on relevant documentations. The new Subsection s X162.2 is amended to read as previous Subsection s X162.2 (2008 - X169.2) on Outsourcing of Information Technology Systems/Processes is amended and transferred to the Appendix of Section X162 of the outsourcing certain banking functions] shall be re-numbered as Subsection S X162.2. The

Appendix 37

No bank shall outsource inherent bank functions such as: Subsection $ X162.2 Prohibition against outsourcing of inherent banking functions.

1. Services normally associated with placement of deposits and withdrawals including the recognition based on recording of movements in the deposit accounts;

2. Granting of loans and extension of other credit exposures;

3. Position-taking and market risk-taking activities;

4. Managing of risk exposures; and

5. Strategic decision-making.

4. The previous Subsection S X162.3 ((2008 - X169.3) - Outsourcing of Other Banking Functions] is deleted. The new Subsection S X162.3 of the MORB shall contain the definition of outsourcing and shall read as follows:

Subsection s X162.3 Definition. Outsourcing shall refer to any contractual arrangement between a bank and a qualified service provider for the latter to perform designated activities on a continuing basis on behalf of the bank.

5. The new Subsection S X162.4 of the MORB shall focus on the responsibility of the bank to

manage the operational risks that arise from outsourcing. It shall read as follows:

outsource banking activities unless it has in place the appropriate processes, procedures, and information system that can adequately identify, monitor and Subsection S X162.4 Managing Outsourcing-Related Risks. No bank may mitigate operational risks that are borne by the bank as a result .of its outsourcing activities.

A bank shall determine the materiality of its outsourcing arrangements when

An outsourcing arrangement is considered material if' the activity, when establishing guidelines, processes and controls in managing outsourcing risks.

disrupted,.has the potential to significantly impact the bank's business operations, reputation, profitability or regulatory responsibilities. A bank may take into consideration the following factors in determining the materiality of its outsourcing arrangements:

Importance of the activity to be outsourced and the potential impact of outsourcing on earnings, solvency, liquidity, funding and capital and risk profi le

Appendix 37

Consideration on the bank's reputation and ability to achieve its objectives, strategy and plans, should the service provider fail to perform the services

Aggregate exposure to a particular service provider in cases where the bank outsources various functions to the same service provider;

N. Ability to maintain appropriate internal controls and meet regulatory

requirements, if there were operational problems faced by the service provider; and

V Exposure to risk of confidentiality, integrity and availability of customer

and bank data.

After due evaluation of a bank's risk management processes with respect to outsourcing, the BSP may require the bank to terminate, modify,:make alternative arrangements or re-integrate the activity into the bank, as may be necessary, in cases where the risk infrastructure is deemed inadequate for purposes of managing outsourcing-related risks.

6. The new Subsection S X162.5 shall read as follows:

Subsection S X162.5 Authority to Outsource. Only those banks with a CAMELS composite rating of at least "3" and a Management Rating of not lower than "3" shall be allowed to outsource designated activities without prior BSP approval. Otherwise, the bank must 'secure prior approval from the appropriate supervising department of the BSP whose evaluation will be based on the bank's ability to manage risks attendant to outsourcing.

7. The new Subsection S X162.6 shall read as follows:

Subsection 5 X162.6 Documentations. The bank should maintain necessary documentation to show that outsourcing arrangements are properly reviewed and the appropriate due diligence has been undertaken prior to implementation.

The bank shall keep in its file the documents shown in Annex A of Appendix 37 and the same shall be made available to authorized representatives of the BSP for inspection.

8. Subsections S X162.11 (2008 -- X169.11) and S X162.12 (2008 -- X169.12) of the MORB are consolidated, re-titled and renumbered as Subsection s X162.7 and amended to read as follows:

Appendix 37

Subsection S X162.7 Intra-group Outsourcing. The guidelines and requirements of outsourcing to third-party service providers shall be observed when outsourcing within a business group including. its head office, another branch or related company.

When the bank is the service provider, the bank may only render services it

least 5% common ownership; or (ii) the service is rendered to its own depositors service is rendered to subsidiaries, affiliates and companies related to it by at on account of the bank being a depositary. performs in the ordinary course of its banking business, provided that: (i) the

following: The bank,'acting as a service provider within its group, shall uphold the

a. Confidentiality of deposits and investments in government bonds as

defined under Republic Act No. 1405, as amended; and b. Prohibition on cross-selling except as :allowed . under applicable

regulations.

9. The new Subsection S X162.8 shall read as follows:

Subsection S X162.8 Offshore Outsourcing. Offshore outsourcing exists when

is permitted only when the service provider operates in jurisdictions which MORB on Intra-Group Outsourcing likewise applies in cases of offshore outsourcing. In addition, offshore outsourcing of the bank's domestic operations uphold confidentiality. the service provider is located outside the country. Subsection X162.7 of the

When the service provider is located in other countries, the bank should take into account and closely monitor, on continuing basis, government policies and other conditions in countries where the service provider is based during risk assessment process. The bank shall also develop appropriate contingency and exit strategies.

The BSP examiners shall be given access to the service provider and those relating to the outsourced domestic operations of the bank.. Such access may be fulfilled by on-site examination through coordination with host authorities, if necessary. The domestic branch of foreign bank shall be principally liable in

service provider located offshore. cases where the clients are prejudiced due to errors, omissions and frauds of the

The BSP may require the bank to terminate, modify, make alternative outsourcing arrangements or re-integrate the outsourced activity into the bank, as may be necessary, if confidentiality of customer information, effective

Aedx 3

customer redress mechanisms or the ability of the BSP to carry out its supervisory functions cannot be assured.

10. The previous Subsection S X162.4 (2008 -- X169.4) of the M0RB on Service Providers is

renumbered as the new Subsection S X162.9. lt shall be amended to read as follows:

Subsection X162.9 Service Providers. The bank shall carry out due diligence in selecting service providers. It must ensure the integrity, technical expertise, operational capability, financial capacity and suitability of the service provider to perform the outsourced activity. In cases where the clients are prejudiced due to errors, omissions and frauds by the service provider, the bank shall be liable in providing the appropriate remedies as may be allowed by laws or regulations, without prejudice to recourse by the bank to the service provider.

11. The previous Subsection s X162.5 on Review of subsisting outsourcing contracts is re.

numbered as Subsection S X162.10 and re-titled as Transitory Provision. It is amended to read as follows:

Subsection X162.10. Transitory Provision. All outsourcing agreements 'must be aligned with the provisions of Section X162 of the MORB. Existing outsourcing agreements which are not in accordance with this circular will not be unwound. However, it must comply with the requirements provided herein upon renewal of the agreements.

12. The previous Subsection S X162.19 on Penalties is re-numbered as Subsection S X162.11

Annex A of Appendix 37 Appendix to Section X162 of the MORB (2008 -- X169) on the Revised Outsourcing Framework for Banks

1 A comprehensive policy on outsourcing duly approved by the board of directors of the

bank.

M b. Fee structure; Service ievel agreement or contract between the bank and the service provider, which a. Complete description of the work to be performed or services to be provided; shall, at a minimum, include all of the following: d Provisions regarding on-line communication availability, transmission line security, Responsibilities regarding hardware, software and infrastructure. upgrades and transaction authentication (applicable to IT outsourcing);

g. Mandatory notification by the service provider of all systems changes that will affect Provisions governing amendment and pretermination of contract; the bank (applicable to IT outsourcing): Details of all security procedures and standards (applicable to IT outsourcing); (applicable to IT outsourcing):

h Responsibility, fines, penalties and accountability of the service provider for errors,

Confidentiality clause covering alt data and information; solidary liability of service omissions and frauds; Law) actions that the bank may take against the service provider for breach of applicable penalties: provider and bank for any violation of R.A. No. 1405, (the Bank Deposits Secrecy confidentiality or any form of disclosure of confidential information; and the

M Disaster recovery/business continuity contingency pians and procedures; Segregation of the data of the bank from that of the service provider and its other clients;

m. Ownership/maintenance of the computer hardware, software (program source Adequate insurance for fidelity and fire liability (applicable to IT outsourcing); code), user and system documentation, master and transaction data files (applicable

to IT outsourcing): Guarantee that the service provider will provide necessary levels of transition assistance if the bank decides to convert to other service providers or other arrangements; O Access to the financial information of the service provider; p. q. Access of BSP to the operations of the service provider in order to.review the same Provision which requires the service provider to. immediately take the necessary provider; Access of internal and external auditors to information regarding the outsourced and those of the internal and/or external auditors of the bank and/or the service in relation to the outsourced activities/services; corrective measures to satisfy the findings and recommendations of BSP examinersl activities/services which they need to fulfill their respective responsibilities;

Page 1 of 2

Annex A of Appendix 37

S Remedies for the bank in the event of change of ownership, assignment, attachment

Provision allowing the bank to cancel the contract by contractual notice of dismissat of assets, insolvency, or receivership of the service provider; and

or extraordinary notice of cancellation if so required by the BSP.

Secretary's certificate on the minutes of meeting of the board of directors of the bank (or a local/regional management committee, in case of foreign banks), explicitly

with which the bank is entering into an outsourcing contract; arrangement is considered material or non-material and the specific service provider approving the activity to be outsourced, the determination of whether an outsourcing

4 Profile of the selected service provider; and

5 and shall form part of the corporate governance reviews undertaken by the bank. A central record of all .outsourcing arrangements which shall be periodically updated

Page 2 of 2