Banking and financial services outsourcing in Asia: the legal and regulatory essentials

Transcription

1 Briefing Banking and financial services outsourcing in Asia: the legal and regulatory essentials Summary Asia s banking and financial services sector is increasingly looking to outsourcing and offshoring as important features of regional operations strategies. This briefing outlines the key legal and regulatory issues to consider. For more information please contact Connie Carnabuci T E connie.carnabuci@freshfields.com Mark Parsons T E mark.parsons@freshfields.com 1

2 The key business drivers The key business drivers of this trend are clear: cost reduction; building platforms for future growth; and focussing on core competencies. Cost reduction Many banks and financial services providers in the region have historically developed their businesses around separate operations in each country, loosely weaving together a country-by-country patchwork of platforms and systems. Operations structured in this way generate inefficiencies and fail to leverage potential economies of scale across the regional organisation. With impressive business growth, many of these banks and financial services providers have now reached the tipping point at which investment in regional hubs and shared processing centres will pay tangible rewards, particularly where operations serving higher-cost jurisdictions can be consolidated into shared operations based in lower-cost ones. Consolidating operations through outsourcing and offshoring also creates opportunities to harmonise systems and procedures, which can yield further cost savings. Platforms for future growth Asia s financial services markets are poised to undergo significant expansion in coming years as large populations in the region age, grow increasingly affluent and develop greater interest in more sophisticated banking and financial services products. Banks and financial services providers that have scalable operations platforms in place in anticipation of this business growth will be among the best placed to capitalise on it and bring new products and services to market quickly, at a predictable cost and at a reliable service level. Outsourcing will often be the most effective means of establishing a flexible operational capability that minimises capital expenditure requirements. Core competencies and innovation Outsourcing non-core activities allows businesses to focus on areas of strategic competitive advantage, such as product and brand development, customer experience and marketing and distribution: ie areas that will be key success factors in gaining a share of these increasingly competitive markets. The corollary is that outsourced service providers can make valuable systems and operations expertise available to financial services players, allowing them to improve and transform business operations, yielding further competitive advantage and cost reduction. The legal and regulatory essentials Outsourcing and offshoring present some significant legal and regulatory obstacles that need to be navigated. Key areas for the legal team to focus on are as follows. Regulatory approvals: core v non-core In line with regulators across the globe, Asia s banking, securities and financial services regulators generally view their authorised institutions business activities as falling into one of two categories: (i) core functions that cannot be outsourced; and (ii) non-core functions that can be outsourced subject to certain restrictions and requirements. Back-office functions such as information technology (IT), infrastructure, human resources and finance and accounting are likely to be characterised as non-core activities that authorised institutions should, subject to some fairly manageable restrictions, be in a position to outsource. Increasing interest in business process outsourcing (BPO), however, has led to outsourcing proposals that draw objections from regulators on the basis that core functions are involved. The contours of the debate vary from jurisdiction to jurisdiction, but, in the main, much of the distinction between core and non-core functions will come down to how clearly the functions are 2

3 characterised to regulators and how well it can be demonstrated that the supporting contractual arrangements will ensure that appropriate boundaries between core and non-core functions will be maintained. A careful explanation of the intended scope of service may tip the balance on whether the outsourcing gets approved. For example, although the middle office of a securities business function would fall into most if not all regulators definitions of a core function, sub-functions within the middle office may be characterised as non-core if the outsourced service provider s role is suitably constrained, particularly for aspects such as business discretion, responsibility for compliance activities and direct contact with customers. The practical point is that the proposed scope of the outsourcing should be checked at the earliest stage before assumptions affecting the project s business case are made. Changes to the scope of services or manner of service delivery may be necessary to ensure compliance and may fundamentally affect the project s economics. Material outsourcing regulations A number of regulators in the region have published outsourcing guidelines that formalise regulatory requirements for material outsourcings. Those published by the Hong Kong Monetary Authority, the Monetary Authority of Singapore, the Japanese Financial Services Agency and, in relation to IT outsourcings, the China Banking Regulatory Commission, are leading examples of rules directed at assessing authorised institutions operational risk management in relation to outsourcing. They focus on areas such as: vendor due diligence; service management and governance structures; data security; contingency planning; and whether the proposed contractual arrangements include adequate protections for the authorised institution in areas such as reporting, audit rights and service levels. Navigating material outsourcing consultations can be a time-consuming exercise, particularly for the uninitiated. Careful planning and adequate foresight to prepare materials anticipating the regulators concerns can minimise the number of iterations and the volume of paperwork necessary to clear the process. Data privacy and banking secrecy regulations Outsourcings and offshorings often involve transfers of personal data to third party service providers, making an analysis of relevant data privacy laws and regulations necessary. Cross-border data transfers for offshorings, in particular, can give rise to regulatory stumbling blocks. Malaysia s recent enactment of a European-style data protection act (expected to come into force this year) and Singapore s announcement of its intention to introduce a comprehensive data privacy law in 2012 demonstrate that data privacy regulation is a developing area in Asia and the playing field can shift at any time. Export controls, in particular, may be directed at encouraging onshore service industries at the expense of offshore rivals. Malaysia, South Korea, Taiwan and Indonesia all have potentially relevant export controls that will need to be considered in context. In China, the government's national standard for personal information security is due to be published before the second half of this year, and will set a benchmark for the collection and handling of personal data in China. In most jurisdictions, customer terms and conditions and other relevant personal information collection statements will still need to be examined for any potential restrictions; and contractual arrangements with the service provider will need to support the data processing requirements set out in the applicable outsourcing regulations under any data privacy laws in force. Bank secrecy laws add a further layer of potential complexity to outsourcings and offshorings involving the disclosure of customer information to service providers. 3

4 The Tournier common law principles applicable in a number of jurisdictions generally support disclosures of customer data for outsourcing purposes, subject to contractual restrictions agreed with customers, but specific banking secrecy regulations need to be carefully considered in each of the relevant jurisdictions. Labour and employment regulations Outsourcings may involve transfers of employees to an outsourced service provider. Subject to a small number of exceptions unlikely to be applicable here, Asian jurisdictions do not have frameworks akin to Europe s Acquired Rights Directive, under which employees automatically transfer to an outsourced service provider by operation of law. The absence of an overarching regulatory framework necessitates a contractual process in which employees either consent to the transfer of their employment or agree to terminate their existing employment and accept fresh terms of employment with the outsourced service provider. The specific legal arrangements need to be examined carefully. In India, for example, retrenchment compensation may be payable to some kinds of workers if the transfer is characterised as a termination of one employment and the creation of another rather than a consent to transfer of contracts. A number of other jurisdictions, such as the PRC, Thailand and Vietnam, require new terms of employment to be at least as favourable as the old ones (including, in the case of the PRC, explicit recognition of accrued years of service). To ensure that employees take up employment with the service provider, a similar approach is often taken as a commercial matter in other jurisdictions, irrespective of any legal requirement to do so. Employees may have pensions, share options and other benefits arrangements that need to be addressed, too. Employer obligations to give notice and consult affected employees may also apply. Unions and other forms of collective representation are less common in Asia than in other regions, but must nevertheless be considered. Whether or not there are any specific employee consultation requirements to be followed, businesses will want to invest some time in carefully developing a communications strategy for disclosing the outsourcing plans to employees both those directly affected by the proposals and more broadly across the organisation. Contract structure Outsourcings are often regional deals with affiliated entities receiving services across multiple jurisdictions. Contractually, this often necessitates the use of a master services agreement (MSA) structure in which an MSA is entered into at the regional level and local services agreements (LSAs) are entered into by local affiliates. The MSA-LSA structure is often pursued in regional outsourcings to accommodate regulatory insistences that licensed entities in each jurisdiction have a binding contract for service. The structure may also support tax planning and accounting treatment, which may depend on local point-to-point billing arrangements for some or all of the service charges. The structure can be fine-tuned to the specific context. The agreement of overarching terms in the MSA alleviates the burden of having to agree and document separate terms for each jurisdiction, but still leaves flexibility to incorporate jurisdiction-specific terms into individual LSAs. Most of the region s banking and financial services regulators are open to parties incorporating MSA terms by reference into LSAs, which can allow for LSAs to be comparatively short-form documents if that is the desired approach. Alternatively, a thin MSA that does little more than capture high-level commercial and structural principles may also be implemented, leaving much of the detail to LSAs. 4

5 Contracting for change Well-drafted outsourcing agreements are prepared with an eye to change. The addition or removal of new and divested businesses and the ability to add or subtract new services and geographies, all on clear terms, are a structural necessity for regional outsourcings in Asia. Bargaining for changes in law and regulation is an essential feature of the arrangements, given the developing regulatory environment. The market for outsourced services being as dynamic as it is in Asia, benchmarking and other contractual mechanisms aimed at maintaining continuous market discipline over the life of the contract are a must. Asian currencies may fluctuate dramatically. Cost of living adjustments and labour market inflation can be significant, particularly for personnel whose skills are in short supply. Service volume growth in excess of forecasts can upset the commercial basis for the outsourcing. Likewise, if the business objectives are not achieved for any reason, the business will want to have a clear understanding of the consequences and options for resetting the commercial balance or, if necessary, withdrawing from the arrangements in an orderly fashion. Intellectual property rights (IPR) Although intellectual property laws in most Asian jurisdictions are evolving towards international norms, there is no doubt that standards of enforcement remain a persistent concern for businesses considering outsourcing and offshoring within the region. Whatever the local currency, an ounce of prevention will always buy a pound of cure. Effective due diligence into service providers operating procedures especially those on physical and logistical security, employee screening, training and disciplining is the essential starting point. Understanding the particular service provider s culture on IPR and confidential information will also be an important aspect of the due diligence exercise. Working with the service provider to develop a shared understanding of desired standards, and then proceeding to contractualise these standards in a clear manner in the outsourcing agreement, will help manage the risk of IPR leakage. Taxes Regional outsourcings often give rise to complex withholding tax issues, which need to be analysed and optimised through the invoicing structure implemented by the MSA-LSA framework. Early tax planning is an essential step towards proving an outsourcing business case in detail. Conclusions Outsourcing promises tremendous benefits to Asia s banks and financial services providers, but the following should be borne in mind: an early-stage evaluation of the proposed outsourcing from a legal and regulatory perspective is highly advisable, both to check the intended scope of the arrangements and to factor in timing requirements for any approvals, consultations or notifications; the contracting structure needs to be carefully evaluated to accommodate legal, regulatory, tax and accounting requirements; and a well-drafted outsourcing agreement will reflect the particular dynamics and complexities of doing business in Asia. freshfields.com is a limited liability partnership registered in England and Wales with registered number OC It is authorised and regulated by the Solicitors Regulation Authority. For regulatory information please refer to Any reference to a partner means a member, or a consultant or employee with equivalent standing and qualifications, of or any of its affiliated firms or entities. This material is for general information only and is not intended to provide legal advice.,,