Revised Outsourcing Framework for Banks

BangKO Sentral Ng PiLiPInAS

OFFICE OF THE GOVERNOR

CIRCULAR NO. 765

Series of 2012

Subject: Revised Outsourcing Framework for Banks

The Monetary Board, in its Resolution No. 1179 dated 19 July 2012, approved the revisions to the outsourcing framework of banks, amending the entirety of Section X162 (2008 - X169) and other relevant provisions of the Manual of Regulations for Banks (MORB).

1. Section X162 of the MORB ((2008 - X169) Duties and Responsibilities of Banks

and their Directors/Officers in All Cases of Outsourcing of Banking Functions] is re-titled and amended to reflect a statement of principle which shall read as follows:

Section X162 Statement of Principle on Outsourcing: An institution

the provisions set forth below. Accordingly, an institution is exposed may outsource banking support and marketing activities subject to

to operational risks as a result of outsourcing. As such, an institution that: avails of outsourcing should have in place appropriate mechanisms to ensure the effective management of attendant risks.

2. The previous Section X162 of the MORB shall be renumbered as Subsection s

X162.1 and amended to read as follows:

Subsection S X162.1 Governance in All Cases of Outsourcing of Banking Functions. When outsourcing is allowed by law, a bank shall:

a. Be responsible for the performance of the outsourced activity in the same manner and to the same extent as if it was performing directly the said activity;

b. Comply with all laws and regulations applicable in the Philippines

including labor laws and those governing the banking

the bank's behalf; activities/services performed by the qualified service providers on

c. Monitor and review on an ongoing basis the performance of the

service providers undertaking the outsourced activity and/or service; and

A. Mabini St., Malate 1004 Manila, Philippines * (632) 524-7011 * www.bsp.gov.ph * [email protected]

d. Update as necessary :its assessment of the extent of the materiality of its outsourcing arrangements vis-a-vis the adequacy of its risk management system.

3. The previous Subsection 5 X162.1 of the MORB ((2008 - X169.1) Prohibition against outsourcing certain banking functions] shall be re-numbered as Outsourcing of Information Technology Systems/Processes is amended and transferred to the Appendix of Section X162 of the MORB on relevant documentations. The new Subsection S X162.2 is amended to read as follows: Subsection 5 X162.2. The previous Subsection S X162.2 (2008 - X169.2) on

functions. No bank shall outsource inherent bank functions such as: Subsection S X162.2 Prohibition against outsourcing of inherent banking

1. Services normally associated with placement of deposits and withdrawals including the recognition based on recording of movements in the deposit accounts;

2. Granting of loans and extension of other credit exposures;

3. Position-taking and market risk-taking activities;

4. Managing of risk exposures; and

5. Strategic decision-making.

4. The previous Subsection S X162.3 ((2008 - X169.3) - Outsourcing of Other

contain the definition of outsourcing and shall read as follows: Banking Functions] is deleted. The new Subsection S X162.3 of the MORB shall

Subsection s X162.3 Definition. Outsourcing shall refer to any contractual arrangement between a bank and a qualified service provider for the latter to perform designated activities on a continuing basis on behalf of the bank.

5. The new Subsection S X162.4 of the MORB shall focus on the responsibility of the bank to manage the operational risks that arise from outsourcing. It shall read as fows:

Subsection S X162.4 Managing Outsourcing-Related Risks. No bank may outsource banking activities unless it has in place the appropriate

bank as a result of its outsourcing activities. processes, procedures, and information system that can adequately identify, monitor and mitigate operational risks that are borne by the

Page 2 of 6

A bank' shall determine the materiality of its outsourcing arrangements when establishing guidelines, processes and controls in managing outsourcing risks. An outsourcing arrangement is considered material if the activity, when disrupted, has the potential to significantly impact the bank's business operations, reputation profitability or regulatory responsibilities. A bank may take into consideration the following factors in determining the materiality of its outsourcing arrangements:

Importance of the activity to be outsourced and the potential impact of outsourcing on earnings, solvency, liquidity, funding and capital and risk profile;

I. its objectives, strategy and plans, should the service provider Consideration on the bank's reputation and ability to achieve fail to perform the services;

I Aggregate exposure to a particular service provider in cases

where the bank outsources various functions to the same service provider;

Ability to maintain appropriate internal controls and meet regulatory requirements, if there were operational problems faced by the service provider; and

Exposure to risk of confidentiality, integrity and availability of customer and bank data.

After due evaluation of a bank's risk management processes with respect to outsourcing, the BSP may require the bank to terminate, modify, make alternative arrangements or re-integrate the activity into the bank, as may' be necessary, in cases where the risk infrastructure is deemed inadequate for purposes of managing outsourcing-related risks.

6. The new Subsection S X162.5 shall read as follows:

Subsection S X162.5 Authority to Outsource. Only those banks with a CAMELS composite rating of at least "3" and a Management Rating

activities without prior BSP approval. Otherwise, the bank must secure prior approval from the appropriate supervising department of of not lower than "3" shall be allowed to outsource designated

manage risks attendant to outsourcing. the BSP whose evaluation will be based on the bank's ability to

Page 3 of 6

7. The new Subsection S X162.6 shall read as follows:

Subsection $ X162.6 Documentations. The bank should maintain necessary documentation to show that outsourcing arrangements are properly reviewed and the appropriate due diligence has been undertaken prior to implementation.

the BSP for inspection. The bank shall keep in its file the documents shown in Appendix and the same shall be made available to authorized representatives of

8. Subsections s X162.11 (2008 - X169.11) and s X162.12 (2008 - X169.12) of the MORB are consolidated, re-titled and renumbered as Subsection S X162.7 and

amended to read as follows:

Subsection s X162.7 Intra-group Outsourcing. The guidelines and requirements of outsourcing to third-party service providers shall be

office, another branch or related company. observed when outsourcing within a business group including its head

When the bank is the service provider, the bank may only render services it performs in the ordinary course of its banking business, provided that: (i) the service is rendered to subsidiaries, affiliates and

service is rendered to its own depositors on account of the bank being a depositary. companies related to it by at least 5% common ownership; or (ii) the

The bank, acting as a service provider within its group, shall uphold the following:

a. Confidentiality of deposits and investments in government

bonds as defined under Republic Act No. 1405, as amended; and b. Prohibition on cross-selling except as allowed under applicable

regulations.

9. The new Subsection S X162.8 shall read as follows:

Subsection $ X162.8 Offshore Outsourcing.Offshore outsourcing exists when the service provider is located outside the country. Subsection X162.7 of the MORB on Intra-Group Outsourcing likewise applies in cases of offshore outsourcing. In addition, offshore outsourcing of the bank's domestic operations is permitted only when the service provider operates in jurisdictions which uphold confidentiality.

Page 4 of 6

When the service provider is located in other countries, the bank should take into account and closely monitor, on continuing basis, government policies and other conditions in countries where the service provider is based during risk assessment process. The bank shall also develop appropriate contingency and exit strategies.

The BSP examiners shall be given access to the service provider and those relating to the outsourced domestic operations of the bank. Such access may be fulfilled by on-site examination through coordination with host authorities, if necessary. The domestic branch of foreign bank shall be principally liable in cases where the clients are prejudiced due to errors, omissions and frauds of the service provider located offshore.

The BSP may require the bank to terminate, modify, make alternative outsourcing arrangements or re-integrate the outsourced activity into the bank, as may be necessary, if confidentiality of customer information, effective customer redress mechanisms or the ability of the BSP to carry out its supervisory functions cannot be assured.

10.The previous Subsection S X162.4 (2008 - X169.4) of the MORB on Service

Providers is renumbered as the new Subsection S X162.9. It shall be amended to read as follows:

Subsection X162.9 Service Providers. The bank shall carry out due diligence in selecting service providers. It must ensure the integrity technical expertise,: operational capability, financial capacity and suitability of the service provider to perform the outsourced activity In cases where the clients are prejudiced due to errors, omissions and frauds by the service provider, the bank shall be liable in providing the appropriate remedies as may be allowed by laws or regulationsj without prejudice to recourse by the bank to the service provider.

11. The previous Subsection S X162.5 on Review of subsisting outsourcing contracts

is re-numbered as Subsection S X162.10 and re-titled as Transitory Provision. It is amended to read as follows:

agreements must be aligned with the provisions of Section X162 of accordance with this circular will not be unwound. However, it must SubsectionX162.10. the MORB. Existing outsourcing agreements which are not in Transitory Provision. Alloutsourcing

comply with the requirements provided herein upon renewal of the agreements.

12. The previous Subsection S X162.19 on Penalties is re-numbered as Subsection s X162.11.

Page 5 of 6

13. Subsection S X406.9 of the MORB on Outsourcing Services in Trust Departments and Subsection $ X701.13 (2008 - X621.13) of the MORB on Outsourcing of Internet and Mobile Banking Services are deleted given that the general guidelines on outsourcing are already provided under Section X162 of the MORB.

publication either in the Official Gazette or any newspaper of general circulation. This Circular shall take effect fifteen (15) calendar days following its

FOR THE MONETARY BOARD:

AMANDO M. TETANGCO, JR. I Governor

1 August 2012

Page 6 of 6

Appendix

Appendix to Section X162 of the MORB (2008 -- X169) on the

Revised Outsourcing Framework for Banks

A comprehensive policy on outsourcing duly approved by the board of directors of the bank.

2 Service level agreement or contract between the bank and the service provider, which

shall, at a minimum, include all of the following: a. - Complete description of the work to be performed or services to be provided; b. Fee structure;

Provisions regarding on-line communication availability, transmission line security and transaction authentication (applicable to IT outsourcing); Responsibilities regarding hardware, software .and infrastructure upgrades

Provisions governing amendment and pretermination of contract; (applicable to IT outsourcing);

Mandatory notification by the service provider of all systems changes that will affect

5 Details of all security procedures and standards (applicable to IT outsourcing); the bank (applicable to IT outsourcing):

h. Responsibility, fines, penalties and accountability of the service provider for errors,

omissions and frauds; Confidentiality clause covering all data and information; solidary liability of service provider and bank for any violation of R.A. No. 1405, (the Bank Deposits Secrecy Law) actions that the bank may take against the service provider for breach of confidentiality or any form of disclosure of confidential information; and the applicable penalties; I Segregation of the data of the bank from that of the service provider and its other

Disaster recovery/business continuity contingency plans and procedures; clients;

Adequate insurance for fidelity and fire liability (applicable.to IT outsourcing); m. Ownership/maintenance of the computer hardware, software (program source

code), user and system documentation, master and transaction data files (applicable

n. Guarantee that the service provider will provide necessary levels of transition to IT outsourcing);

assistance if the bank decides to convert to other service providers or other

o. Access to the financial information of the service provider; arrangements;

p. Access of internal and external auditors to information regarding the outsourced

activities/services which they need to fulfill their respective responsibilities; O Access of BSP to the operations of the service provider in order to review the same

in relation to the outsourced activities/services; I Provision which requires the service provider to immediately take the necessary

corrective measures to satisfy the findings and recommendations of BSP examiners and those of the internal and/or external auditors of the bank and/or the service provider;

Page 1 of 2

Appendix

S Remedies for the bank in the event of change of ownership, assignment, attachment

t Provision allowing the bank to cancel the contract by contractual notice of dismissal of assets, insolvency, or receivership of the service provider; and

or extraordinary notice of cancellation if so required by the BSP.

3 Secretary's certificate on the minutes of meeting of the board of directors of the bank

(or a local/regional management committee, in. case of foreign banks), explicitly approving the activity to be outsourced, the determination of whether an outsourcing arrangement is considered material or non-material and the specific service provider with which the bank is entering into an outsourcing contract;

4 Profile of the selected service provider; and

5 A central record of all outsourcing arrangements which shall be periodically updated

and shall form part of the corporate governance reviews undertaken by the bank.

Page2 of 2