Guidance Notes Outsourcing Register Template Payments & E-Money Firms

July 2023 Guidance Note Outsourcing Register Template Payments & E-Money Institutions

July 2023 Guidance Note Outsourcing Register Template Central Bank of Ireland Page 1 Contents

1. Background and Scope .................................................................................... 2
2. Timeline for Submitting Online Returns ................................................... 2
3. Mechanism for Submission of Returns ...................................................... 2
4. Where do I go if I need further information? ........................................... 3
5. Where do I go if I have technical issues with the Portal?..................... 4
6. Overview of the Register and Information to be provided by RFSPs 4
7. Instructions / Guidance Notes for Completing the Register .............. 5 7.1 Worksheet – Cover.......................................................................................................... 5 7.2 Worksheet - R01 .............................................................................................................. 7 7.2.1 Information to be provided for all Outsourcing Arrangements 7 7.2.2 Information to be provided for all Critical or Important Outsourcing Arrangements ........................................................................................11 7.3 Worksheet - Entity Signing the Contract................................................................18 7.4 Worksheet - Supervised Entity ..................................................................................19 7.5 Worksheet - Service Provider ....................................................................................20 7.6 Worksheet – Function Information..........................................................................25 7.7 Worksheet – Sub-Contractor .....................................................................................34 7.8 Worksheet – Alternative Provider ..........................................................................37 7.9 Worksheet - Additional General Information .......................................................38 Appendix 1: Guidance on Criteria for Determining Criticality and Importance of Outsourcing Arrangements.......................................................44 Appendix 2: Guidance on Categorisations of Outsourced Functions / Services..........................................................................................................................45

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 2

1. Background and Scope As set out in the Cross-Industry Guidance on Outsourcing1 published in December 2021, the Central Bank of Ireland (the “Central Bank”) expects that each regulated firm will establish and maintain an outsourcing register. The Central Bank has developed a template for recording all relevant outsourcing arrangements and for reporting purposes. Based on the information contained within the registers, the Central Bank will conduct analysis and assess the interconnectedness of the financial sector with third party service providers and potential concentration risk at an institution and sectoral level. All regulated financial service providers (“RFSPs”) will be required to submit their completed reporting template to the Central Bank via the Central Bank of Ireland Portal. The reporting frequency, the timeline for submission and the submission process relating to the reporting template are outlined in Sections 2 and 3.
2. Timeline for Submitting Online Returns The reference date for the submission of data for the outsourcing arrangements of all designated RFSPs is 31 December 2022. RFSPs should submit their register with data complete as of 31 December 2022 and only include contracts / written agreements with a start date before that date. The deadline for submission will be Q4 2023 and an exact date will be confirmed in due course.
3. Mechanism for Submission of Returns The Outsourcing Register must be populated using the provided excel template. Less Significant Institutions (LSIs Banks), Insurance and Re-insuranceRFSPs, Payments and E-Money RFSPs and Markets RFSPs must complete the template relevant for their sector. The templates can be accessed on the Central Bank website by clicking here.

1 Underpinned by the EBA Guidelines on Outsourcing EBA GL/02 2019

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 3 The completed Outsourcing Register return file should be uploaded on the Central Bank of Ireland Portal at: https://www.centralbank.ie/regulation/central-bank-portal The submission file must conform to the guidance issued in this document. Files not conforming will be rejected. The Portal will run basic validations against the file as part of the submission process. RFSPs will be unable to complete the file submission until any issues in the file have been rectified. To ensure successful submission, please populate the provided template and adhere to the following instructions:

1. Log on to the Portal and from the Returns section select View / Edit Return’s.
2. From the "Payments Institution Section" business area select "PMI-EMI Outsourcing Register" to load the file.
3. If you cannot see the Return Type please check with your local Portal admin that you have the necessary access permissions;
4. The submission file must be populated from the provided template;
5. Do not attempt to alter the template structure in any way;
6. Only populate cells that are required within the template;
7. The template must be named with the following convention: CXXXXXX_YYYYMMDD_ABC as follows:

CXXXXXX is the institution number YYYYMMDD is the Reference Date and ABC is the designated return type code, this is POR for the PMI-EMI Outsourcing Register e.g. C12345_20221231_POR

4. Where do I go if I need further information? Section 7 (Instructions / Guidance Notes for completing the Register) is designed to aid RFSPs when completing each section / worksheet of the register.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 4 Any further queries in relation to the completion and or submission of the register should be directed to outsourcing.register@centralbank.ie Please keep your Supervisory Contact/Team in copy of any correspondence. 5. Where do I go if I have technical issues with the Portal? https://www.centralbank.ie/regulation/central-bank-portal/contact-us E-mail: portalsupport@centralbank.ie 6. Overview of the Register and Information to be provided by RFSPs Designated RFSPs shall submit one Outsourcing Register Template via the parent regulated institution or the (mixed) financial holding company. The reporting template shall include all outsourcing arrangements that Group entities supervised by the Central Bank make use of, irrespective of whether the entities signed contractual arrangements themselves or if they were signed on their behalf, e.g. by a non￾supervised entity outside of the Central Bank’s jurisdiction. All intragroup arrangements where the Central Bank is the supervisory authority should be reported. These may include any or all of the following:  Outsourcing arrangements between two separate legal entities, such as subsidiaries, in the same group.  In the case of intragroup service provisions / outsourcing arrangements such as Parent/Subsidiary, Subsidiary/Parent, Subsidiary/Subsidiary, these should all be included in the register.  The same requirement applies to Branches, if the separate legal entity (Parent, Subsidiary, Branch) availing of the outsourcing arrangement is under the Central Bank’s supervision.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 5 7. Instructions / Guidance Notes for Completing the Register The guidance notes are designed to aid RFSPs to complete each section / worksheet of the Register in conjunction with the instructions provided in the register template. There are a number of worksheets in the register to be completed. These include:  Cover  R01  Entity Signing  Supervised Entity  Service Provider  Function Information  Sub-Contractor  Alternative Provider  Additional General Information The outsourcing arrangements shall be reported on a contract-by-contract (or written agreement) basis on the Register Reporting Template. The firm is requested to provide a Unique Reference Number for each Contract or Written Agreement. This Unique Reference Number is key to linking various sections of the Reporting Template together. In the case where multiple regulated entities (of a group) that outsource services sign the contract, or multiple supervised entities make use of the outsourced service and/or multiple service providers are included in the contract, each of these entities shall be reported on a separate line in the relevant worksheet. This is explained in more detail in Sections 7.3, 7.4 and 7.5. 7.1 Worksheet – Cover The Cover Note is an important worksheet within the Template and is critical, together with the firm’s C Number (which is collected via ONR at login) in ensuring that the Central Bank can correctly identify the firm which has submitted its Register.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 6 Designated RFSPs must provide the following information in the cover sheet: LEI Code LEI of the firm completing the template. The LEI code attributed to the firm is a 20-character, alpha-numeric code based on the ISO 17442 standard. Name Name of the firm completing the template Level of consolidation Select between Solo and Group Level. Note: Each supervised group shall submit one outsourcing register template via the parent credit institution or the (mixed) financial holding company. In case a supervised entity is a solo institution and not part of a financial group, this supervised entity shall submit one outsourcing register on solo level. Reference date (DD/MM/YYYY) The reference date for the submission is 31 December 2022 (31/12/2022)

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 7 7.2 Worksheet - R01 7.2.1 Information to be provided for all Outsourcing Arrangements Data Point Column Input type Description & Instructions for Completion

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 8 Internal reference number 010 Alphanumerical (A/N) Determined by the institution. Outsourcing arrangements are reported on a contract-by-contract basis. The internal reference number is unique reference per contract and should be reported in the 010 column in the following worksheets: R01, Entity Signing, Supervised Entity, Service Provider, Function Information, Sub￾Contractor and Alternative Provider

• In the Entity Signing the unique reference should be entered in the R01 for each of entities signing the contract. If multiple entities are signing the contract in the name of all recipients of the services, please add a line entry for each entity on worksheet "Entity Signing" using the same internal reference number used for that contract in R01.
• In the Supervised Entity the unique reference should be entered in the R01 for each of Irish supervised entities signing the contract. If multiple supervised entities make use of the outsourced services, please add an additional line entry for each institution on worksheet "Supervised Entity" using the same internal reference number used for that contract in R01.
• In the Service Provider the unique reference should be entered in the R01 for each of service providers in the contract. If multiple service providers are included in the contract, please add an additional line entry for each provider on worksheet "Service Provider" using the same internal reference number used for that contract in R01. In the event of the service provider being an Intragroup arrangement, the firm should determine a unique reference number for each arrangement. Reference also Intragroup Arrangements - Column 130.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 9

• In the Function Information the unique reference should be entered in the R01 for each of functions covered in the contract. If multiple functions are included in the contract, please add an additional line entry for each function covered on the worksheet "Function Information" using the same internal reference number used for that contract in R01.
• In the Sub-Contractor the unique reference should be entered in the R01 for each of the sub-contractor used in the contract. If multiple sub￾contractors are included in the contract, please add an additional line entry for each sub-contractor on the worksheet "Sub-Contractor" using the same internal reference number used for that contract in R01.
• In the Alternative Provider the unique reference should be entered in the R01 for each of the alternative providers identified for the contract. If multiple alternative providers are identified for the contract, please add an additional line entry for each alternative provider on the worksheet "Alternative Provider" using the same internal reference number used for that contract in R01.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 10 Start date of the contract / written agreement 170 Date Date of entry into force of the agreement (dd/mm/yyyy) as stipulated in the contract / written agreement. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 Only include contracts / written agreements with a start date before the reporting date. The column cannot be left blank. Date of next contract / written agreement renewal 180 Date Date (dd/mm/yyyy) of contract renewal as stipulated in the contractual agreement / written agreement or as planned by the parties. Must be after the reporting date but before the end date of the contract. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. End date of the contract 190 Date Date (dd/mm/yyyy) as stipulated in the contractual agreement / written agreement. If the contract has been terminated on a date different than the end date, please report the termination date. Terminated and exited contracts should remain in the register. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. Notice period(s) for the institution 200 Decimal Notice period(s) for terminating the contract / written agreement by the outsourcing entity/entities in months. This field allows decimal values only. So for example populate 1 for one month or 1.5 for one and a half months notice period etc.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 11 Notice period(s) for service provider 210 Decimal Notice period(s) for terminating the contract / written agreement by the service provider(s) in months. This field allows decimal values only. So for example populate 1 for one month or 1.5 for one and a half months notice period etc. Critical or Important 270 Y/N "Y" if at least one critical or important function is outsourced and "N" if no critical or important function is outsourced. If answering "Y" to column 270, please ensure columns 280, 330 to 510 are completed. If data point 270 is answered "N", then 330 to 510 must be left blank. Last date of assessment of criticality or importance 290 Date Date (dd/mm/yyyy) of the last assessment of criticality or importance. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. 7.2.2 Information to be provided for all Critical or Important Outsourcing Arrangements In order to manage outsourcing risk effectively it is necessary to determine the criticality or importance, to the regulated firm, of the function, service or activity which is being outsourced. In conjunction with current legislation and or regulation, the Central Bank expects all regulated RFSPs to have regard to the definition of critical or important, as set out in EBA Guidelines on Outsourcing GL/02, when determining the criteria for criticality or importance of the Function(s) to be outsourced. Refer to Appendix 1 for further information.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 12 If answering “Y” to column 270, all columns from 330 to 510 must be completed and cannot be left blank. Data Point Column Input type Description & Instructions for Completion Reasons for criticality or importance 280 Predefined value (see description) Selection of the following criteria (multiple selections possible) Please populate the representative character: A -"a defect or failure in its performance would materially impair the continuing compliance with the conditions of their authorisation or its other obligations under Directives such as under Directive 2013/36/EU, Regulation (EU) No 575/2013, Directive 2014/65/EU, Directive (EU) 2015/2366 and Directive 2009/110/EC and their regulatory obligations", B -"a defect or failure in its performance would materially impair the financial performance", C -"a defect or failure in its performance would materially impair the soundness or continuity of services and activities", D - "operational tasks of internal control functions are outsourced", E - "outsourced activities or services would require authorisation by a competent authority", F - "outsourcing of operational tasks of financial and accounting function", G - "critical or important based on

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 13 requirements in national (soft) law" - See Instructions, H - or "N/A". NOTE: In case multiple criteria are applicable, please delimit with a semi-colon and ensure no spaces are included either side of the semi-colon. The data validation is case sensitive. Example of a correct submission single selection: B Example of a correct submission multiple selection: A;E;F The column cannot be left blank. Terms of contract have been reviewed and are in compliance with EBA/GL/2019/02 and relevant national laws and guidance. 330 Y/N "Y" if the contract has been reviewed and the overall compliance of the contractual arrangement with existing laws, regulations, competent authorities' policy stances, guidance or similar acts and EBA guidelines has been assessed and determined (e.g. by the legal department of the outsourcing institution). "N" otherwise.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 14 If data point at column 270 is answered "Y", then column 330 must be answered Y or N. Estimated annual budget cost 340 Decimal Estimated budget cost of the outsourcing arrangement on a contract by contract basis for the reporting period in EUR. The reference date of the outsourcing register shall be used to determine the spot Euro FX rate for conversion. Please note the data validation requires numeric input only. Inclusion of characters will lead to the file being rejected. As such please report in exact units. You may not for example report in millions/thousands, 2M will fail validation. If data point at column 270 is answered "Y", then column 340 must not be left blank. Date of last risk assessment 350 Date Date (dd/mm/yyyy) of the last risk assessment. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 If data point at column 270 is answered "Y", then column 350 must not be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 15 Summary of the main results of the risk assessment 360 A/N Brief (maximum 300 characters) summary of the main results (e.g. including the main risks identified) of the risk assessment. Please provide a combined summary of the risk assessment for all critical or important functions covered under the contract Text greater than 300 characters will lead to a data validation failure and the file will be rejected. Approving decision-making body 370 A/N The individual or decision-making body (e.g. the management body) in the institution that approved the outsourcing arrangement (maximum 300 characters). Text greater than 300 characters will lead to a data validation failure and the file will be rejected. If data point at column 270 is answered "Y", then column 370 must not be left blank. Governing law of outsourcing agreement 380 A/N The governing law of the outsourcing arrangement (maximum 300 characters). Text greater than 300 characters will lead to a data validation failure and the file will be rejected. If data point at column 270 is answered "Y", then column 380 must not be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 16 Date of last audit 390 Date The date (dd/mm/yyyy) of the last audit (if applicable). This relates to audits conducted by the internal audit department or any other additional qualified personnel of the supervised entity; a joint team together with other clients of the same service provider (“pooled audit”, see para. 91(a) of the EBA GLs); or a third party appointed by the supervised entity to audit the service provider. It does not relate to the reception or reference date of third-party certifications or internal audit reports of the service provider (para. 91(b) EBA GLs); the annual monitoring date of the outsourcing arrangement by the supervised entity; or the date of review of the risk assessment of the outsourcing arrangement by the supervised entity. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 If data point at column 270 is answered "Y", then column 390 must not be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 17 Date of next audit 400 Date The planned or estimated date (dd/mm/yyyy) of the next audit (if applicable). This relates to audits to be conducted by the internal audit department or any other additional qualified personnel of the supervised entity; a joint team together with other clients of the same service provider (“pooled audit”, see para. 91(a) of the EBA GLs); or a third party appointed by the supervised entity to audit the service provider. It does not relate to the reception or reference date of third￾party certifications or internal audit reports of the service provider (para. 91(b) EBA GLs); the annual monitoring date of the outsourcing arrangement by the supervised entity; or the date of review of the risk assessment of the outsourcing arrangement by the supervised entity. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 If data point at column 270 is answered "Y", then column 400 must not be left blank. Possibility of sub-outsourcing of material parts of the outsourced function(s) included in contract 410 Y/N "Y" if the contractual arrangement allows for sub-outsourcing of material parts of the outsourced function(s). "N" otherwise.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 18 If data point at column 270 is answered "Y", then column 410 must be answered Y or N. 7.3 Worksheet - Entity Signing the Contract Data Point Column Input type Description & Instructions for Completion LEI code 020 A/N 20-character, alpha-numeric code based on the ISO 17442 standard. In the event the signing entity/entities do not have an LEI code, please fill with "N/A". Name 030 A/N Legal name of the entity signing the contract with the service provider and that represents the entities that make use of the outsourcing. For all of the supervised entity the legal Character limit of 200. Text greater than 200 characters will lead to a data validation failure and the file will be rejected. The column cannot be left blank. If not

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 19 available, please provide details of the reason why. Country 040 AA Country in which the entity is located with uppercase alpha-2 country codes to be used. Please note the data validation is case sensitive. The column cannot be left blank. 7.4 Worksheet - Supervised Entity Data Point Column Input type Description & Instructions for Completion LEI code 050 A/N 20-character, alpha-numeric code based on the ISO 17442 standard. In the event the supervised entity/entities do not have an LEI code, please fill with "N/A".

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 20 Name 060 A/N Name of the supervised entity that makes use of the outsourcing. Character limit of 200. Text greater than 200 characters will lead to a data validation failure and the file will be rejected. The column cannot be left blank. If not available, please provide details of the reason why. Country 070 AA Country in which the entity is located with uppercase alpha-2 country codes to be used. Please note the data validation is case sensitive. The column cannot be left blank. 7.5 Worksheet - Service Provider Data Point Column Input type Description & Instructions for Completion

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 21 LEI code 080 A/N 20-character, alpha-numeric code based on the ISO 17442 standard. In cases where a Service Provider does not have an LEI code, please provide a unique id per service provider and ensure that this id is completed with the prefix SP-. Corporate registration number 090 A/N Corporate registration number as identified by the supervised entity unique to the service provider, which can be dependent on potential national regulation and identifiers (e.g. VAT number). Name 100 A/N Name of the service provider. Character limit of 200. Text greater than 200 characters will lead to a data validation failure and the file will be rejected. The column cannot be left blank. If not available, populate with "N/A". Country of the service provider's headquarters 110 AA Country in which the global operating headquarters of service provider are located with uppercase alpha-2 country

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 22 codes to be used. The column cannot be left blank. Registered address 120 A/N Registered address of the service provider as stipulated in the contractual / written agreement. Character limit of 400. Text greater than 400 characters will lead to a data validation failure and the file will be rejected. The column cannot be left blank. Intragroup outsourcing 130 Y/N Intragroup refers to an arrangement in which the service provider belongs to the same group, either as part of the accounting or prudential scope of consolidation, as the outsourcing entity that is supervised by the Central Bank of Ireland. "Y" where Intragroup outsourcing is in place, "N" otherwise.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 23 Name of the supervisory authority of the service provider 140 A/N The name of the supervisory/competent authority in the context of paragraph 63a of the EBA Guidelines on Outsourcing Arrangements, in case the service provider is a supervised entity. If the service provider is not a supervised entity, please fill with "N/A". Character limit of 100. Text greater than 100 characters will lead to a data validation failure and the file will be rejected. The column cannot be left blank. Name of the parent company of the service provider 150 A/N Name of the ultimate parent of the service provider. If the service provider is the ultimate parent, please fill with "N/A". Ultimate parent means the legal entity that is the majority owner of a company. If the service provider is a 50/50 Joint Venture, please delimit the parent companies with a semi-colon. Character limit of 200. Text greater than 200 characters will lead to a data validation failure and the

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 24 file will be rejected. The column cannot be left blank. Country of the parent company's headquarters 160 AA Country in which the parent's global operating headquarters are located with uppercase alpha-2 country codes to be used. If the service provider is a 50/50 Joint Venture, please delimit the parent companies' country with a semi-colon as per above. If the service provider is the ultimate parent's country, please fill with "N/A". Please note the data validation is case sensitive. The column cannot be left blank. Outcome of the assessment of service provider's substitutability 470 Predefined value (see description) Selection of one of the following criteria: "Easy", "Difficult", "Impossible". Please note the data validation is case sensitive. If data point at column 270 is answered

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 25 "Y", one of the criteria must be selected. Then column 470 cannot be left blank. 7.6 Worksheet – Function Information Data Point Column Input type Description & Instructions for Completion Category of the Outsourced Service Provider IE080 Predefined Value (see description) Selected category to align with data point column 220. To assist with data validation please select one or more of the options from the list below: Third Party Vendor (TPV) Sub-outsourcer Intragroup Fintech Firm Partnership Regtech Other Please delimit with a semi-colon and ensure no spaces are included either

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 26 side of the semi colon. Please note the data validation is case sensitive. Category of the outsourced function 220 A/N Category of the outsourced function assigned by the institution that reflects the nature of the function. Character limit of 600. Level 1 category of the outsourced function 221 Predefined value (see description) Selection of one of the following criteria. Please populate the representative character: A -"Administrative services" B -"Cash Management Services" C -"Customer services"

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 27 D -"Depositary tasks & administration for UCI" E -"Finance, Treasury, Accounting and Reporting" F -"Internal control functions" G -"Investment services" H -"Lending" I -"Payment services" J -"Securities" K -"AML/CFT" L -"ICT services" M -"Other" The column cannot be left blank. Description of the outsourced function 230 A/N A brief (maximum 300 characters) description of the outsourced function, including the data that are outsourced. Text greater than 300 characters will lead to a data validation failure and the

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 28 file will be rejected. The column cannot be left blank. Service Provider of the outsourced function 081 A/N The service provider(s) related to the function, whether it is intragroup or third party. Please provide the LEI or unique id as per (Service Provider column 080). When multiple service providers are applicable, please delimit with semi￾colon and ensure no spaces are included either side of the semi-colon. Example; LEI123ADRTF56789WER94;SP-01 The column cannot be left blank. Sub-Contractor of the outsourced function 422 A/N The sub-contractor(s) related to the function. Please provide the LEI or unique id as per (Sub-Contractor column 421). If no sub-contractor is applicable, please fill with "N/A". When multiple sub-contractor are applicable, please delimit with a semi￾colon and ensure no spaces are

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 29 included either side of the semi-colon. Example; LEI123ADRTF56789WER94;SO-01 Transfer or processing of personal data to/by the service provider 240 Y/N "Y" if personal data is transferred to or processed by the service provider and "N" if no personal data is transferred to or processed by the service provider. Location(s) of the data 250 AA Country/countries in which the data is stored with uppercase alpha-2 country codes to be used. If no data is stored, please fill with "N/A". In case data is stored in multiple countries, please delimit with a semi-colon and ensure no spaces are included either side of the semi-colon. Please note the data validation is case sensitive. Example of a correct population: IE;GB;FR The column cannot be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 30 Country/countries of provision of services 260 AA Country/countries from which the service is provided with uppercase alpha-2 country codes to be used. In case services are provided from multiple countries, please delimit with a semi￾colon and ensure no spaces are included either side of the semi-colon. Please note the data validation is case sensitive. Example of a correct population: IE;GB;FR The column cannot be left blank. Cloud service model(s) 300 Predefined value (see description) Selection of the following criteria (multiple selections possible): Software-as-a-Service Infrastructure-as-a-Service Platform-as-a-Service Other N/A In case multiple criteria are applicable, please delimit with a semi-colon and ensure no spaces are included either side of the semi-colon.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 31 Please note the data validation is case sensitive. Example of a correct population: Infrastructure-as-a-Service;Other The column cannot be left blank. Cloud deployment model(s) 310 Predefined value (see description) Selection of the following criteria (multiple selections possible): Public cloud Private cloud Hybrid cloud Community cloud N/A In case multiple criteria are applicable, please delimit with a semi-colon. Also ensure no spaces are included either side of the semi-colon. Please note the data validation is case sensitive. Example of a correct

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 32 population: Public cloud;Hybrid cloud The column cannot be left blank. Cloud outsourcing - specific nature of the data to be held 320 A/N Description of the specific nature of the data to be held in the cloud. If no data is held in the cloud, please fill with "N/A". Character limit of 600. Text greater than 600 characters will lead to a data validation failure and the file will be rejected. Sub-Contractor of the outsourced function 422 A/N The sub-contractor(s) related to the function. Please provide the LEI or unique id as per (Sub-Contractor column 421). If no sub-contractor is applicable, please fill with "N/A". When multiple sub-contractor are

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 33 applicable, please delimit with a semi￾colon and ensure no spaces are included either side of the semi-colon. Example; LEI123ADRTF56789WER94;SO-01 Possibility of reintegration of the outsourced function 480 Predefined value (see description) Selection of one of the following criteria: "Easy", "Difficult", "Impossible". Please note the data validation is case sensitive. If data point at column 270 is answered "Y", one of the criteria must be selected. Then column 480 cannot be left blank.

Impact of discontinuing the outsourced function 490 A/N Brief (maximum 300 characters) description of the impact of discontinuing the outsourced function. Text greater than 300 characters will lead to a data validation failure and the file will be rejected. If data point at column 270 is answered "Y", then column 490 cannot be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 34 Outsourced function supports time-critical business operations 510 Y/N "Y" if the outsourced function supports time-critical business operations, "N" otherwise. If the agreement/contract is deemed critical (R01 column 270 is answered "Y"), then column 510 must be answered Y or N. 7.7 Worksheet – Sub-Contractor Data Point Column Input type Description & Instructions for Completion

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 35 Original Contractor 011 A/N The unique id for the original contractor, whether it is intragroup or third party. If the original contractor is one of the service providers included in the "Service Providers" worksheet; use their LEI code, or the unique id starting with SP- (Service Provider Column 080) If the original contractor is one of the sub-contractors included in the "Sub￾Contractor" worksheet; use their LEI code, or the unique id starting with SO- (Sub-Contractor Column 421) Name of sub-contractor 420 A/N Name of sub-contractor. Maximum 300 characters. Text greater than 300 characters will lead to a data validation failure and the file will be rejected. LEI code of the sub-contractor 421 A/N 20-character, alpha-numeric code based on the ISO 17442 standard. In cases where a sub-contractor does not have an LEI code, please provide a unique id

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 36 per sub-contractor and ensure that this id is completed with the prefix SO-. Country where the sub￾contractor is registered 430 AA Country where the sub-contractor is registered with uppercase alpha-2 country codes to be used. If no data is stored, please fill with "N/A". Please note the data validation is case sensitive. Country/countries where services are performed by sub-contractor 440 AA Country/countries where data are stored by the sub-contractor with uppercase alpha-2 country codes to be used. If no data is stored, please fill with "N/A". In case data is stored in multiple countries, please delimit with a semi￾colon and ensure no spaces are included either side of the semi-colon. Please note the data validation is case sensitive. Example of a correct population: IE;GB;FR

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 37 Location of the data 450 AA Country/countries where data are stored by contractors for sub￾outsourcing of material parts with uppercase alpha-2 country codes to be used. If no data is stored, please fill with "N/A". In case multiple contractors provide sub-outsourcing services, please delimit with a semi-colon and ensure no spaces are included either side of the semi-colon. Please note the data validation is case sensitive. Example of a correct population: IE;GB;FR Transfer or processing of personal data 460 Y/N "Y" if personal data is transferred to or processed by the contractor for sub￾outsourcing of material parts and "N" if no personal data is transferred to or processed by the contractor for sub￾outsourcing of material parts. 7.8 Worksheet – Alternative Provider

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 38 Data Point Column Input type Description & Instructions for Completion Alternative service providers 500 A/N Identification of alternative service provider (maximum 300 characters). If data point at column 270 is answered "Y", then it should be populated at least once for the internal reference. In case no alternative service provider could be identified, please fill with "N/A". Text greater than 300 characters will lead to a data validation failure and the file will be rejected. 7.9 Worksheet - Additional General Information The general content of the register was outlined in Appendix 3 of the Cross-Industry Guidance on Outsourcing in order to give RFSPs forewarning of the need to store this data in their Registers. The Central Bank requires this additional data to assist it in performing its regulatory responsibilities including those relating to the assessment of concentration risk. Some of the data provides additional granularity to ensure clarity within the registers with respect to the service providers with whom RFSPs are contracting.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 39 Data Point Column Input type Description & Instructions for Completion A record of terminated arrangements for an appropriate retention period. IE010 Y/N "Y" if the firm keeps records of terminated arrangements, "N" otherwise. Date of the last test of the firm’s business continuity plan. IE020 Date Date (dd/mm/yyyy) of the last test of the firm's business continuity plan. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. Details / commentary on testing of firm’s business continuity plans. IE030 A/N Brief (maximum 300 characters) description / commentary on the firm's BCP testing. Text greater than 300 characters will lead to a data validation failure and the file will be rejected. Date of the last test of the OSPs business continuity plan. IE040 Date Date (dd/mm/yyyy) of the last test of the OSPs business continuity plan. For Not Applicable values report

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 40 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. Details / commentary on testing of OSPs business continuity plans. IE050 A/N Brief (maximum 300 characters) description / commentary on the OSP's BCP testing. Text greater than 300 characters will lead to a data validation failure and the file will be rejected. Date of the last test of firm’s Exit Strategies. IE060 Date Date (dd/mm/yyyy) of the last test of the firm's Exit strategy. For Not Applicable values report 01/01/4444 For Not Available values report 01/01/6666 The column cannot be left blank. Details / commentary on testing of firm's Exit strategies IE070 A/N Brief (maximum 300 characters) description / commentary on the testing of the firm's exit strategies. Text greater than 300 characters will lead to a data validation failure and the file will be rejected.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 41 Total number of outsourced service arrangements in place IE120 Integer Total Number of arrangements in place. This should include all critical or important arrangements and non-critical or important whether with external Third Party Vendors (TPVs) or Intragroup arrangements. Please populate integer value only. Inclusion of any text will lead to a data validation failure and the file will be rejected. The column cannot be left blank. Total number of “critical and or important” outsourced arrangements in place. IE130 Integer Total Number of “critical and or important” outsourced arrangements in place. Please populate integer value only. Inclusion of any text will lead to a data validation failure and the file will be rejected. The column cannot be left blank. Total number of arrangements with Cloud Service Providers (CSPs) IE140 Integer Total Number of arrangements with Cloud Service Providers (CSPs). Please populate integer value only. Inclusion of any text will lead to a data validation failure and the file

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 42 will be rejected. The column cannot be left blank. Does the firm have an Outsourcing Risk Management Framework in place? IE150 Y/N "Y" if the firm has an Outsourcing Risk Management Framework in place, "N" otherwise. Does the firm have an Outsourcing Policy in place? IE160 Y/N "Y" if the firm has an Outsourcing Policy in place, "N" otherwise. Is the Outsourcing Policy approved by the Board? IE170 Y/N "Y" if the Outsourcing Policy is approved by the Board, "N" otherwise. Does the firm provide outsourcing services to other regulated firms? IE180 Y/N "Y" if the firm provide outsourcing services to other regulated firms, "N" otherwise. Description of the services provided and to whom IE190 A/N Description of the services provided and to whom. Maximum 300 characters. Text greater than 300 characters will lead to a data validation failure and the file will be rejected. If data point at column IE180 is answered Y, then column IE190 cannot be left blank.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 43 Are Contracts / Written Agreements supported by SLAs? IE200 Y/N "Y" if Contracts / Written Agreements are supported by SLAs, "N" otherwise.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 44 Appendix 1: Guidance on Criteria for Determining Criticality and Importance of Outsourcing Arrangements The Cross-Industry Guidance on Outsourcing included an appendix, (Appendix 2 – Definitions and Criteria for Critical or Important Functions). This appendix was included for ease of reference, by RFSPs, to relevant sectoral regulations and guidelines (applicable as at time of publication) dealing with criteria relating to “critical or important”. The Central Bank did not include a prescriptive definition of what constitutes ‘critical or important’ outsourcing arrangements, but rather (in line with other relevant guidelines) has suggested factors to be considered when determining if an activity/service is critical or important. The Central Bank does not deem it appropriate to outline a list of critical or important activities/services, given that the financial service landscape is continually evolving and the use of new business models and technologies is ever changing. Rather it has provided a set of factors/criteria to be considered, which can be assessed against at a point in time and these should be subjected to regular review. RFSPs are expected to take a risk-based approach in their assessment of criticality and importance, bearing in mind the principle of proportionality.

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 45 Appendix 2: Guidance on Categorisations of Outsourced Functions / Services The function / service categories listed below can be used as a guidance tool for mapping purposes (refer to Data Point 220 “Category of the Outsourced Function” in the Outsourcing Register template). RFSPs are asked to select the relevant category that they consider the most appropriate for their respective firm and/or sector for each outsourcing arrangement. Certain arrangements (i.e. provision of professional services) should be excluded for the submission of the Register e.g. legal, annual audit services and advisory services. Function / Service Category Examples (non-exhaustive) Lending  Granting credit such as consumer credits, mortgage lending and factoring,  Lending-related processes, i.e. credit scoring for credit granting, collateral management, loan collection Securities  Clearing  FX business  Letter of credit  Guarantees for trade finance Payment services  Execution of payment transaction  Transfers of funds on a payment account  Execution of payment transactions where the funds are covered by a credit line  Execution of direct debits  Execution of payment transactions through a payment card or a similar device  Execution of credit transfers, including standing orders  Execution of card payments  Issuing of payment instruments and/or acquiring of payment transactions  Money remittance  Payment initiation services  Account information services  Card issuance and personalisation Depositary tasks & administration for UCI  Depositary tasks for UCI (undertakings for collective investment), e.g.: o Safekeeping duties o Oversight duties o Cash flow monitoring  Administration for UCI, e.g. o Registration function o NAV calculation and accounting function o Client communication function

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 46 Investment services  Reception and transmission of orders in relation to one or more financial instruments  Execution of orders on behalf of clients  Dealing on own account  Portfolio management  Investment advice  Underwriting of financial instruments and/or placing of financial instruments on a firm commitment basis  Placing of financial instruments without a firm commitment basis  Operation of an MTF  Operation of an OTF  Ancillary services: o Safekeeping and administration of financial instruments for the account of clients, including custodianship and related services such as cash/collateral management and excluding maintaining securities accounts at the top tier level o Granting credits or loans to an investor to allow him to carry out a transaction in one or more financial instruments where the firm granting the credit or loan is involved in the transaction o Advice to undertakings on capital structure, industrial strategy and related matters and advice and services relating to mergers and the purchase of undertakings o Foreign exchange services where these are connected to the provision of investment services o Investment research and financial analysis or other forms of general recommendation relating to transactions in financial instruments o Services related to underwriting ICT services  Application development  Web development/hosting  Application support/management  Technical support/help desk  Database development/management  Infrastructure  Cloud computing  ICT disaster recovery services  Telecommunications/Network Finance, Treasury, Accounting and Reporting  Liquidity management  Regulatory reporting Administrative services  Property management  Corporate communication  Document management & archiving  Legal services  HR services  Tax services  Pensions & benefits  Marketing & communications Customer services  Customer Relationship Management  Capturing/documentation of customer data  Processing customer inquiries/complaints

Guidance Note Outsourcing Register Template Central Bank of Ireland Page 47  Account handing/management  Product design/distribution/advice  Customer acquisition Internal control functions  Compliance function  Risk management function, e.g.: o Credit risk management o Internal model development and maintenance o Incident management o Internal audit function AML/CFT  Know You Customer  Customer and transaction screening Cash Management Services  Cash related activities (which refers to management of physical banknotes and coins): o ATM services and maintenance o Cash transportation o Cash vault services incl. security, forecasting and processing of cash like storage, inventory management, counting, validation, fitness sorting and counterfeit detection o Foreign banknote management Other

T: +353 (0)1 224 5800 E: publications@centralbank.ie www.centralbank.ie