Rulebook on the Outsourcing of Business Processes of a Leasing Company

UNOFFICIAL CONSOLIDATED TEXT RULEBOOK ON THE OUTSOURCING OF BUSINESS PROCESSES OF A LEASING COMPANY (Official Gazette Nos. 66/14 and 142/22) The Rulebook on the Amendment of the Rulebook on the Outsourcing of Business Processes of a Leasing Company (Official Gazette No. 142/22) entered into force and is applicable from December 15, 2022.

Rulebook on the Outsourcing of Business Processes of a Leasing Company - Unofficial Consolidated Text (Official Gazette Nos. 66/14 and 142/22) 1 Introductory Provisions Article 1. (1) This Rulebook further specifies the conditions and criteria for the outsourcing of business processes, the rules for managing risks associated with the outsourcing of business processes, the scope of internal acts related to the outsourcing of business processes, requirements regarding access to data and documentation, and the performance of supervision by the Agency, the minimum content of contracts with service providers, and the content of documentation in accordance with Article 71, paragraph 5 of the Leasing Act. (2) The provisions of this Rulebook apply to the leasing company referred to in Article 3 of the Leasing Act, and mutatis mutandis to the branch of a leasing company from a Member State referred to in Article 46, paragraph 1 of the Leasing Act, the branch of a leasing company from a third country, and the branch of a leasing company from a Member State referred to in Article 46, paragraph 2 of the Leasing Act, which carry out leasing activities on the territory of the Republic of Croatia. (3) This Rulebook does not apply to the process of outsourcing standardized services such as services related to the use of telecommunications infrastructure, advertising services, cleaning services, market research services, and similar services. Meaning of Terms Article 2. For the purposes of this Rulebook, the terms used have the following meanings: (1) Act – Leasing Act ("Official Gazette" No. 141/13) (2) Agency – Croatian Financial Services Supervisory Agency (3) Outsourcing of business processes is the contractual entrustment of performing acts, services, or activities of a leasing company to service providers, which the leasing company would otherwise perform itself. (4) Acts, services, or activities which a leasing company would otherwise perform itself are acts, services, or activities that enable the leasing company to carry out its registered activity, including acts, services, or activities that support the carrying out of the registered activity (e.g., use of information technology, risk management, internal control functions, accounting). (5) A service provider referred to in Article 71, paragraph 2 of the Leasing Act may be any legal or natural person who is authorized according to the regulations of the country in which it is established to carry out the activities that are the subject of outsourcing, if such specific authorization for certain activities is determined by regulations. Conditions and Limitations for Outsourcing Business Processes Article 3. (1) A leasing company may outsource business processes on the condition that the outsourcing of business processes does not impair:

1. the conduct of regular business of the leasing company,
2. effective risk management of the leasing company,
3. the internal control system of the leasing company,
4. the possibility of supervision by the Agency. (2) When assessing the fulfillment of the conditions from paragraph 1 of this Article, the Agency will pay particular attention to the fulfillment of the following:
5. outsourcing is carried out for objective reasons and exclusively with the aim of increasing the efficiency of performing those activities,
6. the person to whom the outsourced activities are transferred must have all necessary resources for the proper, high-quality, and efficient performance of the outsourced activities,

Rulebook on the Outsourcing of Business Processes of a Leasing Company - Unofficial Consolidated Text (Official Gazette Nos. 66/14 and 142/22) 2 3. authorized persons of the other party must have a good reputation and the professional qualifications and experience necessary for performing the outsourced activities, 4. the leasing company must prove that the other party is qualified and capable of performing the outsourced activities, that it was selected with due diligence, and that the leasing company can effectively supervise the performance of the outsourced activities at any time, 5. the leasing company will continuously monitor the other party in the performance of the outsourced activities, 6. the leasing company must not outsource business processes to other parties to such an extent that it can no longer be considered a leasing company in the sense that one of the circumstances determined by Article 71, paragraph 4, items 1, 2, and 3 of the Leasing Act would be significantly impaired, nor in the case where deficiencies and/or failures in relation to the performance of outsourced business processes could significantly affect the leasing company's ability to fulfill obligations prescribed by existing regulations and/or the uninterrupted continuation of business, 7. business processes must not be outsourced to a person whose interests may conflict with the interests of the leasing company, 8. outsourcing must not reduce the effectiveness of supervision over the leasing company, 9. the leasing company must be enabled to give additional instructions to the person to whom business processes are outsourced or terminate the outsourcing contract with immediate effect at any time when there is a justified interest. (3) The liability of the leasing company to third parties must in no case be transferred to service providers. Internal Acts Related to Outsourcing of Business Processes Article 4. (1) A leasing company is obliged to prescribe procedures related to the outsourcing of business processes in its internal acts. (2) The internal acts from paragraph 1 of this Article consist of one or more documents that must minimally contain criteria and procedures related to:

1. the process of making a decision on the outsourcing of business processes,
2. determining business processes that are key to the business of the leasing company in the sense that without them the provision of leasing services would be impossible,
3. risk analysis and assessment of the impact of outsourcing business processes,
4. analysis of service providers,
5. the method of selecting service providers,
6. the process of concluding contracts with service providers (negotiation, definition of contract content, approval, and conclusion of contracts),
7. management of contractual relationships with service providers,
8. monitoring the performance of activities that are the subject of the contract,
9. monitoring and reporting to the management of the leasing company on exposure to risks associated with the outsourcing of business processes.

Rulebook on the Outsourcing of Business Processes of a Leasing Company - Unofficial Consolidated Text (Official Gazette Nos. 66/14 and 142/22) 3 Risk Management Related to Outsourcing of Business Processes Article 5. (1) A leasing company is obliged to establish an appropriate risk management system related to the outsourcing of business processes. (2) The general rules for the application and establishment of risk management systems in the sense of the Act and regulations adopted on the basis of the Act must also apply to the management of risks associated with the outsourcing of business processes. (3) Acts, services, or activities that are the subject of outsourcing must be appropriately covered by the internal control mechanisms of the leasing company. (4) A leasing company is obliged to define for each individual outsourced business process the roles and responsibilities of organizational units or persons responsible for supervising and managing the outsourced business process, as well as the exit strategy of the leasing company in the event of early termination of the contractual relationship and/or inability to fulfill contractual obligations. Risk Analysis and Assessment of the Impact of Outsourcing Business Processes on the Leasing Company Article 6. (1) A leasing company is obliged to analyze risks and assess the impact of outsourcing business processes before making a decision on the outsourcing of business processes, among others, on:

1. fulfillment of the conditions from Article 3, paragraph 2, items 1 and 6,
2. financial results and business continuity of the leasing company,
3. costs and solvency of the leasing company,
4. business risks and risk management of the leasing company,
5. quality of service provision,
6. the degree of difficulty and time required to select an alternative service provider or return the performance of those activities to the leasing company if necessary. (2) In addition to the analysis from paragraph 1 of this Article, the leasing company is obliged to prepare an analysis of the service provider which must at least cover the analysis of the conditions from Article 3, paragraph 2, items 2, 3, 4, and 7. (3) A leasing company is obliged to determine, before making a decision on the outsourcing of business processes, whether the regulations of the country or countries in which the service provider operates allow the Agency to, for the purpose of achieving supervisory objectives, conduct supervision of part of the service provider's business that is related or can be linked to the outsourcing of business processes, as well as supervision of the performance of activities that will be the subject of the contract concluded with the leasing company. Access to Documentation and Data Article 7. A leasing company is obliged to contractually obligate the service provider to allow the leasing company itself, the authorized auditor of the leasing company, the internal auditor of the leasing company, and the Agency timely access to all documentation and all data related to the outsourced business processes, which are in the possession of the service provider, and to release them from the duty of professional, attorney-client, or other secrecy, in the part necessary to fulfill the requirements of the authorized auditor, internal auditor, or the Agency, in the manner and form prescribed for the relevant activity of the service provider, without delay.

Rulebook on the Outsourcing of Business Processes of a Leasing Company - Unofficial Consolidated Text (Official Gazette Nos. 66/14 and 142/22) 4 Supervision by the Agency Article 8. A leasing company is obliged to ensure that supervision by the Agency in the part of the service provider's business that is related or can be linked to the outsourced business process, as well as direct supervision of the performance of activities that are the subject of the contract, is in no way and at no time prevented, restricted, or hindered. Contractual Relationship between Leasing Company and Service Provider Article 9. (1) When concluding a contract with a service provider, a leasing company is obliged to ensure that contractual provisions, in terms of their scope and content, cover the risks associated with the outsourcing of business processes and are adequate to the scope and complexity of the outsourced activities. (2) The contract with the service provider must be in written form, must clearly define all relevant data and terms, conditions, rights, obligations, and responsibilities of the contracting parties, and must contain at least:

1. a detailed description of the activities that are the subject of the contract,
2. the duration of the contract,
3. the price of the service and any other related costs,
4. the leasing company's requirements regarding the level of service and quality of service provision,
5. the method of monitoring the performance of activities that are the subject of the contract,
6. the obligation to keep business secrets and the obligation to keep and protect confidential data,
7. the obligation of the service provider to promptly inform the leasing company of all facts and changes in circumstances that significantly affect or could significantly affect the fulfillment of contractual obligations, compliance with the Act, or this Rulebook,
8. the obligation of the service provider to allow the Agency to conduct direct supervision at the location of service provision, i.e., at the service provider, and to ensure access to documentation and data related to the outsourced business process, which are in the possession of the service provider,
9. a detailed description of the conditions for termination and/or cancellation of the contract, including the right of the leasing company to terminate or cancel the contract with the service provider if ordered by the Agency,
10. a detailed description of the rights and obligations of the contracting parties in the event of early termination of the contract to ensure the continuity of service provision,
11. the choice of applicable law in contracts with international characteristics,
12. the method of dispute resolution. Notification to the Agency Article 10. (1) If a leasing company intends to outsource business processes on a significant scale, it is obliged to notify the Agency in writing before concluding a contract with the service provider, for the purpose of assessing the compliance of the submitted notification and documentation with the provisions of the Act and this Rulebook. (2) The notification from paragraph 1 of this Article must contain an explanation that includes a detailed description of the acts, services, or activities intended to be outsourced and the reasons for making the decision to outsource.

Rulebook on the Outsourcing of Business Processes of a Leasing Company - Unofficial Consolidated Text (Official Gazette Nos. 66/14 and 142/22) 5 (3) The following documents must be attached to the notifications from paragraph 1 of this Article:

1. a description of the manner of connection between the service provider and the leasing company, if the service provider is a related party to the leasing company,
2. a draft contract that the leasing company intends to conclude with the service provider referred to in Article 9 of this Rulebook,
3. a risk analysis and assessment of risks associated with the outsourcing of business processes from Article 6, paragraph 1 of this Rulebook,
4. an analysis of the service provider from Article 6, paragraph 2 of this Rulebook,
5. a statement by the leasing company and the service provider that the outsourcing of business processes will not lead to a conflict of interest. (4) If the service provider has its registered office and/or operates outside the Republic of Croatia, the leasing company is obliged, in addition to the documents from paragraph 3 of this Article, to submit proof confirming that the regulations of the country or countries in which the service provider operates allow the Agency:
6. to conduct direct supervision of part of the service provider's business that is related or can be linked to the outsourced business process, as well as direct supervision of the performance of activities that are the subject of the contract, for the purpose of achieving supervisory objectives,
7. timely and unlimited access to documentation and data related to the outsourced business process, which are in the possession of the service provider. (5) In addition to the documents listed in paragraphs 2, 3, and 4 of this Article, the Agency may request other documentation it deems necessary to assess whether the conditions for outsourcing business processes prescribed by the Act and this Rulebook are met. (6) The Agency will, within 30 days from the date of receipt of the notification and complete documentation from paragraph 3 of this Article, assess whether the outsourcing of business processes prevents or hinders the effective and continuous fulfillment of the conditions from Article 3 of this Rulebook, and inform the leasing company of the results of the assessment. (7) The leasing company is obliged to submit the notification from paragraph 1 of this Article in accordance with the instruction on the method of submitting data to the Agency. Transitional and Final Provisions Article 11. (1) This Rulebook enters into force on the eighth day from the date of publication in the "Official Gazette". (2) A leasing company is obliged to adopt the internal acts from Article 4 of this Rulebook by September 30, 2014. (3) A leasing company is obliged to align its business and outsourcing contracts concluded with service providers before the entry into force of this Rulebook with the provisions of Articles 3, 5, 6, 7, 8, and 9 of this Rulebook no later than December 31, 2014.