The Bermuda Monetary Authority (BMA) has released Guidance Notes for Relevant Legal Entities, including banks, corporate service providers, trust companies, investment businesses and fund administrators, which require them to demonstrate good risk management and to notify the BMA of any new material outsourcing arrangements. The guidelines come into force on 1 May 2020. Until that time there is a transition period during which entities should provide attestation for pre-existing arrangements, and seek prior approval or provide attestation for new outsourcing arrangements.
Over the last three years there has been an increase in the use of outsourcing by entities such as investment businesses, fund administrators, banks, deposit companies, corporate service providers, trust companies, money service businesses, and credit unions licensed by the BMA. The BMA has issued updated Guidance Notes for these “Relevant Legal Entities” (RLEs) to ensure risks from outsourcing are appropriately managed.
While the Guidance Notes are applicable to all outsourcing arrangements, they are specifically concerned with ‘material’ outsourcing i.e. those arrangements where failure in performance would materially impact the RLE’s business operations, reputation or financial performance, ability to manage risk, or compliance with applicable laws. RLE management will also have to consider whether the provision of innovative technology (including cloud services, artificial intelligence and distributed ledger technologies) by third-parties constitutes outsourcing, and if so whether it is material outsourcing.
Provision of or use of services which do not form part of the services and activities provided by the RLE itself, are not regarded as outsourcing. This may include external training of staff, external security and management of the RLE’s premises, and the provision of external legal advice to the RLE.
The new Guidance Notes cover the BMA’s general expectations regarding the policies and procedures that the management of RLEs must have in place to manage the risks. These policies should include criteria for determining what constitutes material outsourcing, the risk appetite for outsourcing activities, due diligence to be undertaken in selecting a service provider and ongoing management and monitoring of arrangements.
To continue reading full articles in PDF format:
New BMA Guidelines Require Notification of Outsourcing Arrangements and Ongoing Monitoring