Outsourcing. FSA Regulated firms (including offshore outsourcing) Contents. March 2004

Transcription

1 Outsourcing FSA Regulated firms (including offshore outsourcing) March 2004 Contents 2. Introduction 2. How do the regulations impact an outsourcing? 3. Prudential Sourcebooks 4. Service Level Agreements 5. Other issues 5. Conclusion - What next? 6. Contacts

2 Introduction The outsourcing contract with the service provider needs to take into account both the normal legal principles and case law on the one side, and the regulatory framework imposed on regulated firms by the Financial Services Authority (the FSA ), and through them upon the service provider. The nature of the FSA requirements is such that the greater the perceived risk of the outsourcing, and the greater the perceived loss of control, the more Systems and Controls need to be in place in the regulated firm and the more heavily scrutinized the firm is likely to be. So while there is little specific regulation in respect of offshoring, it is likely that the checks and measures an organisations puts into place will need to be more extensive. There are a number of overarching prudential (and other) principles that relate to a regulated firm in accordance with FSA requirements these are set out in the Financial Services and Markets Act 2000, Interim Prudential Sourcebooks, in the paper entitled CP142 - Operational Risk Systems and Controls, and elsewhere. CP142 has formed the basis of Section 6 of the Integrated Prudential Sourcebook a single Prudential Sourcebook applying to all firms regulated by the FSA due to come into effect in September This paper will concentrate on the obligations that are specific to outsourcing defined in the Glossary to the draft Integrated Prudential Sourcebook as: the use of a person to provide customised services to a firm other than: a member of the firm's governing body acting in his capacity as such; or an individual employed by a firm under a contract of service The definition of outsourcing includes the provision of all customised services this is far wider than the traditional definition of outsourcing which requires a function to transfer from the client to the provider. There is no exception for outsourcing to (i) group companies, (ii) other regulated companies, or (iii) commonly outsourced services e.g. investment management or custody (although they may not be customised services.). Where relevant, the paper will also refer to the current trend to offshore, i.e. outsource overseas. How do the regulations impact on outsourcing? The regulations can impact an outsourcing in (at least) four ways: the authorised entity will need to directly comply with any regulations, notwithstanding the outsourcing of a function; in certain circumstances, a service provider or its employees may also require authorisation, and it may therefore need to directly comply with the regulations; time scales if the FSA needs to consider a proposal, i.e. because it is a material outsourcing, they require a reasonable time in which to consider it. In an offshoring, any such consideration is likely to take longer than in, for example, a more conventional outsourcing due to the increased risk profile; and the regulations will affect the contractual position both the customer and service provider are able to take in contractual negotiations. Authorisation The first question that both the customer and service provider need to ask is, are the services provided by me or for my client a regulated activity?". If so, the party(ies) needs authorisation if carried out in the UK, and the rules described in this paper would directly apply. The definition of regulated activity is set out in the Financial Services and Markets Act 2000 (Regulated Activities) Order 2001 and includes, for example, accepting deposits, managing investments, effecting contracts of insurance and dealing in investments as agent. It also includes assisting in the administration and performance of a contract of insurance and safeguarding and administering investments etc. Regulated activities include arranging, advising and the administration of assets There are exemptions to the above, as well as territorial limits. The following may, on the facts, be examples of regulated activities: 2

3 an insurance company outsources the administration of policies and sales to a provider of consultancy services; a bank outsources treasury and loan administration; strategic advice is given to a company; and a service provider helps a company raise money from investors. Approved Persons There are also additional concerns in respect of FSA Approved Persons. Approved Persons have authority to carry out Controlled Functions ie certain functions carried out by regulated firms. Controlled Functions are either management roles (eg directors, FOs, internal audit, heads of large departments (but not heads of IT or HR), or customer facing roles (arranging, advising or making transactions). If a person is designated an Approved Person, such person has individual responsibility under the Rules and is subject to Systems and Controls of the company. There are penalties for breach. Where an employee is an Approved Person, special consideration also needs to be given. Prudential Sourcebooks The Interim Prudential Sourcebooks as they apply to regulated organisations set out guidance in respect of outsourcing. While these principles are expressed as guidance, their primary legal source derives from the Financial Services and Markets Act 2000 and as such, it is imperative that the guidance is followed. Principle 3 of the Principles for Business states: A firm must organise and control its affairs effectively which includes having adequate systems and controls. The Threshold Conditions ( Suitability ) also include the need to ensure that a firm conducts its affairs soundly and prudently. Relevant to the meeting of these requirements is a [firm's] outsourcing arrangements. The obligation to have adequate systems and controls and to conduct affairs soundly and prudently has great importance in respect of offshoring, as a result of the location, political back-drop and cultural differences often exhibited in the service provider s jurisdiction. The main obligations are as follows: Informing the FSA in respect of outsourcings which materially either impacts its systems and controls or affects the risk profile of a regulated firm, the FSA must be informed. Where material problems are encountered during the outsourcing, the FSA must also be informed. Obligations on the regulated firm the regulated firm must carry out an impact analysis / risk profile of the outsourcing and it must allow the FSA access to files relevant to the outsourcing. These obligations are further categorised into a number of principles (see below). General The regulated firm must make the FSA aware of a material outsourcing proposal in a reasonable time for the FSA to consider it. In respect of an offshoring arrangement, it may be reasonable for the FSA to require additional time and information including the draft outsourcing agreement and operational risk analysis to pass its consideration due the complexity and perceived additional risk. This needs to be taken into account when project managing a deal of this nature, and the FSA's approval process can become critical path. Principles governing the regulated firm's relationship with its service provider The regulated firm must monitor and manage on an on-going basis its relationship with the service provider so as to seek to ensure that the integrity of its systems and controls are maintained. Additionally there are requirements on the regulated firm to ensure that the service provider is competent and financially sound. There is also an obligation on the regulated firm to ensure that the service provider informs it of any developments which may have a material adverse impact on the service provider's ability to meet its obligations. Regular communications with the provider and the retention by the customer of an appropriate internal management function 3

4 become particularly important, when the service provider is located offshore, because loss of control, on the face of it, is more likely. The regulated firm should also be aware of material risks to the provision of the services by the service provider. The provision of relevant management information will assist here. The contract should also contemplate adequate resources at senior level within the regulated firm to ensure that the relationship with the service provider is properly managed. A person within a regulated firm must be formally tasked with managing the relationship as between its firm and the service provider, under a written mandate. Such a person must be sufficiently experienced to carry out this role, and must have the time to take this on. The person must have a direct line to its senior management. Where recommendations are made by this mandated individual, senior management must accept them, unless it has good reason not to. On termination, the contract should state that the regulated firm is entitled to all of its work or records which are material to the regulated firm's business. Additionally, the guidance advises that the termination clauses provide adequate notice for the regulated firm to put in place alternative arrangements. The greater the risk involved in the outsourcing, the more onerous this requirement. So, when dealing with an offshore firm, knowledge transfer and contingency planning (see below) take on an additional significance. Rather than relying solely on exit management for the knowledge transfer, an ongoing knowledge transfer (in addition to an appropriate exit management regime) is highly advisable, so that if an agreement needs to be terminated quickly, the FSA can be confident that the regulated firm can bring the function back in-house or transferred to an alternative service provider, with the minimum of inconvenience. In respect of an offshore service provider, distance, geography and culture will once again play a major role in deciding the extent to which this is achieved. Data Protection Act 1998 The FSA also directs the regulated firm to the Data Protection Act 1998 and recommends appropriate confidentiality provisions. In respect of data protection, in particular, any offshoring will require adherence to the eighth data protection principle (which states that, with exceptions, transfers of personal data outside the European Economic Area cannot take place unless the country receiving the data ensures an adequate level of protection). Integrated Prudential Sourcebook The Operational Risk sections of the Integrated Prudential Sourcebook are in near final form, and include requirements relating to outsourcing. These are likely to come into force later in They expand in detail on the guidance for outsourcing by regulated firms described in this Paper. They form part of the much wider requirements for Operational Risk in Consultancy Paper 142. Service Level Agreements The regulated firm should always have a written SLA in place with its service providers, which contemplates periodic reviews. The FSA uses the term "service level agreement" in a way which is contrary to that commonly used in the industry i.e. it encompasses the entire service description and associated clauses (rather than being merely a performance regime). The FSA recommends the following, which represents good practice in any event: a clear service description; a change control procedure; key personnel provisions; performance targets; step-in rights. In this respect, the requirement of the authorised firm is to consider the conditions under which the firm or the service provider can terminate the outsourcing arrangement, and the smooth transfer of outsourced activities on termination. On the face of it, there is no actual prescription from the FSA to the authorised firm to give it extensive step-in rights: it is for the firm to consider how extensive these should be, and how they should be triggered. In doing so, it needs to take into account the nature of the outsourced services, the risks to the firm itself and to investors, the responsibility of the firm for business continuity to the FSA and to investors etc; and most importantly, extensive, detailed and 4

5 relevant reporting requirements in order to ensure that the regulated firm can avert potential mishaps before they occur. The obligation is wider than most good practice guidance because, despite a firm outsourcing a given function to a service provider, the regulated firm is still ultimately responsible to the FSA and not the service provider. Other issues Contingency planning A regulated firm should have contingency plans in place to enable it to set up new business arrangements immediately, if the contract is suddenly terminated or the service provider fails. The regulated firm is also advised to request information on the service provider's contingency plans. Clearly in an offshoring, contingency becomes more important, more expensive and less practical. Supervisors' access to information The regulated firm must be able to provide the FSA and delegated authorities of the FSA with any information it requires to ensure effective supervision. The regulated firm must also have access to this information itself. Where the service provider is based outside the UK, the regulated firm should assess the extent to which the local regulator or regulations may restrict access to information about the outsourced activity. The role of the auditor The regulated firm should have processes in place to identify and deal with weaknesses in the service provider's procedures which could have a materially adverse effect on the regulated firm e.g. access to auditors, independent reports on the service provider etc. Sub-contracting The contract must state that if the outsourcing service provider decides to subcontract further, the original outsourcing service provider continues to be contractually liable. Conclusion - What next? On the assumption that the Integrated Prudential Sourcebook comes into effect shortly, the guidelines contained in it are somewhat more prescriptive although, once again, almost all the requirements represent good practice. For example, in respect of software, the guidelines refer to the need for continued availability of software following difficulty at the third party supplier. If the regulated firm does not own the intellectual property rights in software outright, then it needs to ensure that it has the benefit of a sufficiently wide licence on exit or step-in rights to ensure a smooth transition from the outgoing service provider to a replacement supplier or back in-house. Additionally, there is an increased emphasis on the need for a risk profile, and the weighing up of operational risk throughout the life-cycle of the contract. This affects the regulated firm in a number of ways. For example, in Year 2006/2007 there will be significant changes to the capital adequacy rules under BASEL II. One of the key financial resourcing requirements is how well a firm manages operational risk which includes outsourcing and offshoring. A firm is even more likely to demand stringent contractual protections to minimise its capital requirements. Finally, we are seeing an increased regulatory burden in respect of money laundering - checks and measures will need to be heightened in respect of all money transfers, but it is worth making special mention of overseas money transfers. Guidance notes issued in December 2003 state that: where elements of a UK business have been outsourced to offshore locations, a UK firm should consider putting in place a group money laundering strategy to protect its global reputation and its UK regulated business. where activities relating to UK business operations are undertaken by processing staff outside of the UK eg call centres based in other jurisdictions, those staff should be aware of the anti-money laundering policies and procedures applicable to the UK 5

6 Contacts Nigel Wildish t: +44 (0) e: Robert Shooter t: +44 (0) e: 6

7 Field Fisher Waterhouse LLP 35 Vine Street London EC3N 2AA t. +44 (0) f. +44 (0) This publication is not a substitute for detailed advice on specific transactions and should not be taken as providing legal advice on any of the topics discussed. Copyright Field Fisher Waterhouse LLP All rights reserved. Field Fisher Waterhouse LLP is a limited liability partnership registered in England and Wales with registered number OC318472, which is regulated by the Law Society. A list of members and their professional qualifications is available for inspection at its registered office, 35 Vine Street London EC3N 2AA. We use the word partner to refer to a member of Field Fisher Waterhouse LLP, or an employee or consultant with equivalent standing and qualifications.