The Bank of Greece specifies the regulatory framework governing outsourcing of supervised institutions
07/10/2020 - Press Releases
- A harmonised outsourcing framework is introduced
- Outsourcing becomes easier without requiring prior supervisory approval
- Outsourcing to cloud service providers is specified
The Bank of Greece issued Executive Committee Act no. 178/5/2.10.2020 adopting the guidelines of the European Banking Authority (EBA) on outsourcing arrangements (EBA/GL/2019/02). These guidelines also incorporate EBA recommendations on outsourcing to cloud service providers. The new Act abolishes the existing framework for outsourcing, laid down in Annex 1 to Bank of Greece Governor’s Act 2577/9.3.2006.
The aim of the Act is to establish a harmonised framework for the outsourcing of functions by all the institutions supervised by the Bank of Greece. Its scope therefore encompasses not only credit institutions, but also financial institutions, including payment institutions and e-money institutions.
The new outsourcing framework provides a clear definition of outsourcing, as well as of critical or important functions. In addition, it includes specific internal governance requirements and obligations of institutions, both before entering into an outsourcing arrangement and during the term of the arrangement, with a view to the more effective management of the risks entailed by outsourcing. Stricter requirements apply to the outsourcing of critical or important functions, given the higher risk entailed.
Under the new framework, institutions are required to inform the Bank of Greece of their intended arrangements for the outsourcing of critical or important functions before they enter into any outsourcing agreement, but without the need for a relevant approval decision from the Bank of Greece, so as to facilitate and accelerate the outsourcing process. However, where it is judged that the relevant supervisory requirements are not met, the Bank of Greece may decide not to allow the outsourcing of functions or may request the termination of any outsourcing agreement in force.
In order to ensure adequate and standardised information on outsourcing arrangements by all institutions, the new framework introduces the obligation for institutions to maintain a register of information on all outsourcing agreements, following the template provided in the Annex to the Act. Institutions shall make available to the Bank of Greece, upon request, this register, as well as any other information necessary for the exercise of effective supervision.