Cookies on Pinsent Masons website

Our website uses cookies and similar technologies to allow us to promote our services and enhance your browsing experience. If you continue to use our website you agree to our use of cookies.

To understand more about how we use cookies, or for information on how to change your cookie settings, please see our Cookie Policy.

EBA to issue final outsourcing guidelines in early 2019

The European Banking Authority will issue final guidelines early next year on what banks and other financial institutions should have in place when outsourcing some of their functions to third parties, including cloud providers.24 Oct 2018

The timeframe was confirmed in the EBA's newly published work programme for 2019 (31-page / 371KB PDF) in which it said new guidelines on outsourcing would be published in the first quarter of the year.

The EBA opened a consultation on proposed new outsourcing guidelines back in June. That consultation closed in September. The EBA recently published the responses it received to its consultation, including submissions from Pinsent Masons, the law firm behind Out-Law.com.

Pinsent Masons said that competition and digital innovation at banks is at risk unless significant changes are made to the EBA's draft guidelines on outsourcing. Pinsent Masons highlighted a number of issues with the EBA's draft guidance, including the broad definitions given to key terms, the broad scope of the guidelines' intended application and the requirements they set out around audit rights and sub-contracting arrangements.

"Many of the issues we have identified in our consultation response have also been highlighted in the responses others have submitted to the EBA," said financial services and technology law expert Yvonne Dunn of Pinsent Masons. "In total, the EBA has published 49 responses and we are aware that others have responded on a confidential basis. This is a large number of responses which demonstrates the importance of these guidelines to the financial services sector and the desire to influence the future direction of travel."

"There are some clear themes emerging from the feedback, including: the fact that the definition of 'outsourcing' is felt to be too broad; the lack of distinction between external and intragroup outsourcing; the application of the guidelines to non-critical or important outsourcings; the need to consider the challenges of applying the guidelines to cloud outsourcing; and the need to balance the stated aim of proportionality with some of the more prescriptive requirements in the guidelines. We remain hopeful that the EBA will address these key issues when it comes to finalise the guidelines in the first quarter of 2019," she said.

The new outsourcing guidance will be an important document as, when finalised, it will update the existing Committee of European Banking Supervisors (CEBS) outsourcing guidelines that have been in place since 2006 as well as separate cloud outsourcing recommendations the EBA has developed more recently, which only came into effect in July.

The EBA has said that it will issue a follow-up report or opinion on "the implementation" of its cloud outsourcing recommendations. It has still to confirm when in 2019 that paper will be published.

According to the EBA's work programme for 2019, the supervisory body will continue to focus much of its attention on the regulatory compliance implications of fintech.

Specifically, the EBA said that new reports and guidelines can be expected on "innovation facilitators and the cross-border coordination of schemes" in the final quarter of next year. It said "a regulatory perimeter for new financial activities and ‘sandboxing’ and ‘innovation hub’ schemes" is one of its priority policy areas. It has promised a report or opinion on "cross-border obstacles with regard to innovation" between the beginning of April and end of June 2019.

In 2019, the EBA has also promised to issue guidelines and a report or opinion on IT management and security. It also plans to develop a "coherent cyber resilient testing framework" next year.

The EBA is also due to publish reports on emerging technology risks and related guidance for prudential supervisors, such as big data and data analytics, distributed ledger technology and open banking, in the second and fourth quarters of 2019, it said.

A further report on regulatory technologies (regtech) is also expected to be issued towards the end of next year, it said.