Preparing an FCA Application for Authorisation: Outsourcing and Inter-company arrangements

Background

The The use of outsourcing to support the delivery of services by payments firms is common and well understood by the FCA. However, for a firm to outsource key business functions certain regulatory requirements must be met.

Regulatory requirements are documented in the Electronic Money Regulations 2011 and Payment Services Regulations 2017, with guidance provided in a number of documents published by the FCA and EBA. Outsourcing requirements apply to “operational functions” that relate to the provision of the regulated services and apply equally to intra-group outsourcing arrangements as well as the use of third-parties. The FCA does not consider operational functions to include legal advice, training or the purchase of standardised services, including market information services.

Firms will need to ensure that its outsourcing arrangements:

• do not impair the quality of internal control or the FCA’s ability to monitor the firm
• do not result in the delegation of responsibility for complying with regulatory requirements
• the relationship and obligations of the firm towards its customers is not substantially altered
• that compliance with conditions of authorisation are not altered; and
• no authorisation conditions require removal or variation.

Policies and procedures

Firms should develop outsourcing policies and procedures that cover the areas detailed below and describe these in their application for authorisation. These outsourcing policies and procedures should be detailed in the firm’s Compliance Manual or separate supporting documents (depending on how the firm organises its compliance framework).

• Outsourcing service description – the activities that will be outsourced should be defined in service descriptions, including service delivery metrics. Service descriptions would be based on the activities and responsibilities associated with the business function to be outsourced and will form the basis of the discussions to be held with prospective service providers, selection and due diligence of the service providers, and the monitoring of service provision. Service descriptions should be documented and ideally approved by the Board.
• Service provider due diligence – a process will need to be developed to support the initial selection, and ongoing review, of outsourced service providers. On an ongoing basis the initial due diligence performed on service providers should be kept up to date and reviewed as part of the ongoing monitoring arrangements. Due diligence should, for example, ensure that the service provider is willing to sign up to contractual agreements that will meet regulatory requirements, including the provision of audit rights to the firm and the FCA.
• Contractual arrangements – contractual agreements should be put in place between the firm and its service providers (including intra-group service providers). The contractual arrangement should include a clear service description and service levels as well as contractual terms such as audit rights for both the firm and the FCA, termination rights, and handover rights.
• Oversight arrangements – the firm must retain responsibility for all outsourced functions, this responsibility cannot be delegated. This necessitates the allocation of ‘oversight’ responsibility to an appropriate role within the business, typically the role that would have been responsible for the business function had it not been outsourced. The outsourced business function should be included in the staff organisation chart together with the reporting line to the oversight role.
• Maintain a summary of outsourcing arrangements – a table of the outsourcing arrangements should be included in the application for authorisation and for ongoing internal reference. The summary should include information such as the service description, service provider name, location, the role assigned with oversight responsibility and contact points.

How we can assist

Please contact us if you would like to discuss your outsourcing arrangements, either as part of an application for authorisation or if you are authorised and reviewing your arrangements. We are experienced at drafting outsourcing policies and procedures and our sister law firm, FM Legal, is able to review or draft contractual outsourcing agreements.