EBA outsourcing guidelines: What banks, fintechs and cloud providers need to know

Change and churn in regulations

This is evident from the contents of the European Banking Authority’s (EBA) cloud outsourcing guidelines, which, upon their publication in July 2018, meant that banks, building societies and certain categories of investment firms were no longer covered by the FCA’s guidance.

“The EBA recommendations provided further detail as to what is specifically required in cloud outsourcing contracts, and provided greater clarification and reassurance to financial institutions that are considering a move to cloud-based services,” says Read.

From that point onward, the journey to the cloud for the banking sector would be shaped by the EBA’s guidelines, which covered a lot of the same ground as the FCA’s, says Read, while providing financial institutions with a means of addressing some of its more “impractical” terms.

For example, the FCA guidance makes reference to the fact that organisations and their auditors should be able to access the “business premises” of any service provider to which they are outsourcing their IT, but states: “This does not necessarily include their datacentres.”

It then goes on to say that “service providers may, for legitimate security reasons, limit access to some sites, such as datacentres”.

While the wording itself gives cloud providers some grounds to turn down requests for users to visit their datacentres, the phrasing still suggests that a user might be able to demand and gain access if they absolutely require it.

“You can’t have customers turning up at your datacentre all the time if you’re a cloud provider,” says Read. “Amazon, Google and Microsoft would just not accept that, and that is a problem with the regulator requiring unfettered audit access to virtually anything going on there.”

The EBA guidelines seek to address this by including clauses that make it possible for organisations to achieve compliance through more indirect means – and, in turn, reduce the organisational burden caused by clients requiring on-demand and unfettered access to their service provider’s datacentres.

On this point, the EBA guidelines give financial institutions the option to embark on “pooled audits”, whereby a third party appointed by a group of clients undertakes a visit on behalf of all of them, or to rely on internal audit reports or the attainment of certain third-party certifications.

The major cloud providers have been accepting of these terms, says Read, because if they refused to play ball, their ability to do business with the banking sector would be severely impaired.

“The Microsofts of this world, the Amazons and Googles have got on board because they recognise they have to, in order to participate in the financial services market, and have all got their own [sector-specific] addendums attached to their terms,” he says.

“Google has a set of terms that it sticks onto the back of its standard terms, for example, that if you are a regulated institution, these are the terms that apply in addition. They will give you pooled audit information, and allow the regulators to have access, and enable clients to terminate whenever they want to, which are all things you have to have.

“So the big boys have all got involved because they realised that they are getting so much pushback from their regulated client base that they couldn’t afford not to.”

All change across Europe

In an industry as highly regulated as financial services, organisations are aware that the regulatory landscape in which they operate is subject to frequent change and revision. And this is just as well, given that the EBA rules will soon be integrated into a far larger and wider-ranging set of guidelines.

These are the EBA Guidelines on Outsourcing Arrangements, which come into effect on 30 September 2019, and are billed as a means of providing financial institutions with a single set of rules governing how they should approach all their outsourcing engagements – including their cloud contracts.

“Outsourcing [contracts] entered into, reviewed or amended after that date must comply with the guidelines,” says Jake Ghanty, a financial regulatory partner at technology-specialist law firm Kemp Little, during a panel discussion about the guidelines in early September 2019.

“That may sound like – in relation to existing outsourcings – that you don’t really need to worry about these guidelines right now, but that’s not strictly the case. If you were to amend an existing outsourcing, you need to start taking account of these guidelines.”

Also, by 31 December 2021, all entities whose activities fall under the scope of the guidelines must ensure their existing outsourcing contracts have been updated and reviewed to ensure compliance.

This means they will need to embark on a large-scale reassessment of every single outsourcing engagement they have in place in the light of these new requirements. And, given how prone financial services firms are to outsourcing, this is unlikely to be quick or easy.

Read says: “From the financial institution’s point of view, there is a lot to consider both internally and externally, when they’re contracting for these types of services or consuming them.

“They are going to have to read and review all of their existing contracts to get compliant again, like they’ve done with GDPR [General Data Protection Regulation], and like they’ve done with the 2018 [EBA] cloud guidance, but they are going to have to do it on a much broader scale.

“Because it could cover anything from outsourcing your datacentre security to your main banking platform, to a small bit of HR services, or it could be a small connector that fits to another system or whatever, because the scope and remit of the guidelines has got a lot broader.”

This is not just in terms of outsourcing types, adds Ghanty, but also with regard to the wide range of companies that will have to follow these guidelines – not just banks, building societies and investment firms, but also companies specialising in payment services, electronic money institutions and fintech providers.

The fact that these entities have been brought into the scope of the guidelines is a clear acknowledgement by the EBA that financial institutions are increasingly outsourcing a wider variety of their functions to third-party technology providers, says Ghanty.

“One positive act in relation to these guidelines it that they will now only need to consult one set of guidelines in relation to both cloud and non-cloud outsourcing,” he adds.

Outsourcing assessments and reviews

As detailed in the 125-page guidance, financial institutions will have to assess whether the arrangement they have in place falls under the EBA’s definition of outsourcing. And if it does, they then need to decide whether that particular process or activity would classified as critical or important to how the organisation functions.

If any disruption – in the form of what the EBA calls a defect or failure – in performance of the outsourced function were to “materially impair” its financials, the running of its business or its regulatory standing, that would be considered a critical or important function – and would be subject to more stringent controls.

Ghanty adds: “There are specific, additional provisions that will apply in relation to business continuity planning for these types of outsourcing and there is a higher level of due diligence required in relation to entering into a critical or important outsourcing.”

For example, he points to a portion of the guidelines that puts the onus on financial institutions to ensure their chosen outsourcing partner has some form of track record with taking care of critical and important functions on behalf of their clients.

Ghanty points out that this could have implications for startups, which may not have as many reference customers that they can call upon to verify their ability to deal with critical and important functions.  

“The guidelines aren’t prohibiting firms from outsourcing to businesses without a long track record, but they will need to document or record some kind of objective justification for choosing the outsourced service provider that they have,” he says.

As financial institutions become more and more reliant on third parties to operate, one of the overarching aims of the EBA guidelines is to prevent them from effectively becoming what it calls “empty shell” organisations.

“The guidelines clarify that the management body of each financial institution remains responsible for that institution and its activities at all times,” says the EBA in a statement.

“To this end, the management body should ensure that sufficient resources are available to appropriately support and ensure the performance of those responsibilities, including overseeing all risks and managing the outsourcing arrangements.

“Outsourcing must not lead to a situation in which an institution becomes an ‘empty shell’ that lacks the substance to remain authorised.”

The guidelines seek to prevent this happening to financial institutions in two different ways. The first is through the creation of a written outsourcing policy that is regularly reviewed and updated, and sets rules governing how outsourcing arrangements should be managed.

Ghanty says: “The guidelines require in-scope firms to implement a written outsourcing policy, defining principles, responsibilities and processes relevant to each phase of the outsourcing lifecycle. This policy needs to document internal risk management policies, and defined procedures for things like renewal processes.”

The second way the guidelines seek to protect financial institutions from becoming “empty shells” is by mandating that firms should maintain an updated register containing information on every single outsourcing arrangement they have in place.

According to the guidance, the register should log details about the start and renewal date of each outsourcing contract the financial institution operates, alongside a brief description about the function being outsourced and the identity of the third party responsible for overseeing it.

It also stipulates that institutions document where in the world these functions will be performed by the outsourcer, and take a note of whether the functions are considered critical or important, as well as the reasons why.

The guidelines state: “In the case of outsourcing to a cloud service provider, the cloud service and deployment models (public, private, hybrid, community), and the specific nature of the data to be held and the locations where such data will be stored should be recorded.”

The idea is that documenting such information will make it easier for organisations to keep on top of their current outsourcing arrangements, while also providing regulators with a means of tracking which suppliers financial services firms regularly do business with.

Outsourcing register: What to include and how to manage

The register is not exactly a new requirement, says Read, given that followers of the EBA cloud guidance were instructed to keep a similar register of all the suppliers from which they sourced off-premise services.

“All our clients have done it, and they’ve taken different views about how far they should push that definition of cloud outsourcing,” he says. “Some have said everything that has any element of cloud needs to be on the register, and others have taken a bit more of a granular view on it.”

The reason for that is because the guidelines are not overly prescriptive about how organisations should go about creating and managing these registers, which – based on the guidance – require firms to log substantial amounts of data about each outsourcing contract they embark upon.

Read says there are plans afoot to bring a degree of consistency and clarity to all this through the potential creation of a centralised, online portal – overseen by the Prudential Regulation Authority (PRA) – that financial services firms can use to log this information. 

“Someone will input a record of all their outsourcings into this with a bunch of dropdown fields or some sort of data taxonomy, so that’s all in one place, and people don’t have to keep wrestling with submissions from spreadsheets or other documents,” he says.

“Some organisations were working on building their own… but the expectation is there will be some sort of online register they can use, partly because of the experience [regulators have had] around GDPR notifications and the management of that, where everyone starts submitting loads of stuff, all the time, in random formats, which is a nightmare.”

As for when that online portal is likely to put in an appearance, Read suggests a pilot may not be in the offing until the December 2021 implementation end-date has passed. But if and when it does, it will make the administrative load for both regulators and their charges a little lighter.

Particularly, as Read points out, the guidance essentially encourages people to notify regulators “more frequently than they have ever done in the past” about any changes in their circumstances from an outsourcing point of view.

For regulators, the data gleaned from this register should also make it easier for them to gauge whether the sector is becoming too heavily reliant on certain providers and taking steps to protect themselves from any risks that might pose to their organisations, he adds.

“It means they can say, should we be encouraging or requiring people to have a more even spread across other cloud providers, for example,” says Read.

Preparation for new regulation

So it is clear that the financial services, fintech and cloud provider community have plenty of work to do to prepare for the guidelines coming into force, but – in our expert’s view – how ready are they?

From an end-user perspective, TLT LLP’s Read thinks many financial institutions have put their preparation work on the back burner because of the uncertainty over how the entire regulatory environment could change post-Brexit.

“I don’t think many institutions are ready for it yet,” he says. “Some of them are, and are getting on board about it, but some are waiting to see what the consequence of Brexit will be on the regulatory landscape, because this is not UK-specific guidance.

“But the expectation and intention from people like the regulators is that it will be applied in the UK, so it can’t be ignored.”

From a cloud provider point of view, if suppliers took steps to ensure compliance with the EBA’s previous guidelines, they should be ready for what is to come, says Read.

“From the cloud provider point of view, from last year to this year’s guidance, nothing has really changed,” he says. “It is the same guidance that has been rolled into the new set of guidelines.”

Computer Weekly understands there has been a degree of pushback previously, particularly during the consultation process for the guidelines, from some members of the fintech community about the EBA’s plans to bring its organisations into the scope of the guidance.

From a preparation perspective, Read feels the fintech community is lagging behind its cloud provider counterparts, but, as is often the case with regulation, some firms are on more solid ground than others.

Luke Scanlon, head of fintech propositions at legal firm Pinsent Masons, tells Computer Weekly that part of that might be down to how long some of these firms have been operating.

“For fintech providers specifically, regulation isn’t front of mind for new technology providers, but it needs to be because sometimes they don’t understand that what is holding banks and other financial institutions back from purchasing their technologies is the lack of understanding around changes like this,” says Scanlon.

“Their initial meetings with innovation people and sales might get them excited, but it is the regulation barrier that is holding them back [from winning deals].”

As mentioned above, these guidelines will require firms to reassess all their current outsourcing agreements and rethink how they manage any new ones they enter into in the future, as they set about working out which ones could and should be considered critical or important.

During these determinations, it might transpire that a function that has previously been handed to a third-party fintech provider to do is now considered outsourcing, but was not previously.

Scanlon adds: “Banks, for example, might not have been thinking about their fintech suppliers too closely in the past from that regard, but with the guidelines focusing on critical and important functions, all suppliers will need to rethink their positions if they want to continue to service the financial services market.”