The MAS is proposing changes to requirements for outsourcing arrangements by banks and merchant banks. The proposals will extend requirements on outsourcing to a wider range of outsourcing arrangements as well as enhance the requirements for such arrangements. Other changes have also been proposed to the Banking Act.
Consultation paper on outsourcing by banks and merchant banks
The Monetary Authority of Singapore (MAS) issued a Consultation Paper on Outsourcing by Banks and Merchant Banks (Outsourcing Consultation Paper) on 7 February 2019. It sets out proposed enhancements to the existing regulatory regime for outsourcing as currently set out in MAS Notice 634 (applicable to banks) and MAS Notice 1108 (applicable to merchant banks).
The MAS had earlier consulted on requirements for outsourcing arrangements in September 2014. It will not be proceeding with those earlier proposals following feedback as to the variation in scale and nature of how outsourcing is used by different classes of financial institutions. Instead, it will adopt a more targeted approach to outsourcing requirements, with different requirements applying to different classes of financial institutions. The proposals in the Outsourcing Consultation Paper are to apply only to banks and merchant banks (referred to collectively in this update as banks), and the MAS will be consulting on the approaches for other financial institutions later.
The MAS is proposing a transition period of 12 months from the date of issuance.
Outsourcing requirements to have a wider scope
The proposed outsourcing requirements will apply to a much wider set of outsourcing arrangements than is currently the case. At the moment, the outsourcing requirements set out in MAS Notice 634 / 1108 only apply to outsourcing arrangements where customer information is disclosed and service provider is located outside Singapore. The Outsourcing Consultation Paper proposes that these two limits will no longer apply.
Under the draft legislation, the MAS may give directions to banks imposing requirements as to their outsourcing arrangements. This power extends to the following outsourcing arrangements:
• Outsourcing arrangements between a service provider and the bank or between a service provider and the bank’s related entities; and
• The service provider provides a service commonly performed by banks to the bank or the service provider provides a service to the bank’s customers on the bank’s behalf.
The outsourcing requirements themselves will be set out in a Notice on Outsourcing (Notice). The draft of the Notice states that it applies to outsourcing arrangements where the bank is dependent on the service on an ongoing basis (this may require further clarification from the MAS as the Outsourcing Consultation Paper states that the definition of “outsourcing arrangement” is to include arrangements that the bank is not dependent on an ongoing basis.) Furthermore, the service provided under the outsourcing arrangement must be either:
• Integral to the provision of a financial service by the bank; or
• Provided to the market by the service provider in the name of the bank.
It should be noted that, unlike the current regime, there is no requirement that the outsourcing arrangement involve customer information or be provided by a service provider that is located outside Singapore.
Material outsourcing arrangements
Under the draft Notice, a sub-set of these outsourcing arrangements will need to comply with an additional set of requirements. Each of the following are outsourcing arrangements (referred to in the draft Notice as material outsourcing arrangements) to which the additional requirements will apply:
• The outsourcing arrangement is one which, in the event of a service failure or a security breach, has the potential to materially impact the bank’s business operations, reputation or profitability;
• The outsourcing arrangement is one which, in the event of a service failure or a security breach, has the potential to adversely affect the bank’s ability to manage risk and comply with applicable laws and regulations;
• The outsourcing arrangement involves customer information which, if accessed or disclosed without authorization, would materially impact the bank’s customers; and
• The outsourcing arrangement involves customer information which, if lost or stolen, would materially impact the bank’s customers.
Enhancements to the outsourcing requirements
In addition to extending the outsourcing requirements to a wider range of arrangements, the MAS is also proposing to enhance the existing requirements. With respect to the requirements that will apply to all outsourcing arrangements covered by the Notice, the following are noteworthy:
• The agreements with the service provider must, among other terms, contain an indemnity by the service provider to the MAS, its officers, agents and employee and hold them harmless from any liability, loss or damage to the service provider and its sub-contractors arising out of any action taken to access and inspect the service provider or its sub-contractors pursuant to the outsourcing agreement.
• The agreements must also contain a right to terminate the agreement in any of the following events (among others):
o The bank is prevented from conducting any audits or obtaining any report and finding made on the service provider;
o The bank is prevented from assessing the service provider’s compliance with the agreement; and
o The bank is directed by the MAS to terminate the agreement as the service provider has failed to comply with all applicable laws and regulations.
The following are among the enhanced requirements will also apply to material outsourcing arrangements:
• Banks are to maintain a central register of all material outsourcing arrangements.
• Due diligence on the service provider of such arrangements must be conducted at least annually.
• Independent audits on material outsourcing arrangements must be conducted at least once every three years.
Proposed amendments to the Banking Act
In addition to the Outsourcing Consultation Paper, the MAS has also issued a Consultation Paper on Proposed Amendments to the Banking Act on 7 February 2019. The following points are noteworthy:
• Auditors will be required to report material adverse developments in relation to a bank’s financial soundness.
• Banks may publish their accounts on their internet websites instead of in the newspapers. Should they choose to do this, they must instead publish a statement in the newspapers stating, among other things, that the information is available on their website.
• For credit card or charge card licensees, 20% controllers and key appointment holders must be approved by the MAS. This will bring them in line with banks and other financial institutions.
• The grounds on which the MAS can revoke a bank’s licence will be expanded to include contraventions of the MAS Act, when the parent bank of a foreign-owned bank has its licence withdrawn, and when it appears to the MAS that it is in the public interest to do so.
