Reserve Bank of New Zealand Revised Outsourcing Policy Regulatory Impact Statement

Regulatory Impact Statement Revised Outsourcing Policy February 2017

2 Contents ADEQUACY STATEMENT.....................................................................................................................3 EXECUTIVE SUMMARY ........................................................................................................................4 BACKGROUND AND CONSULTATION ...............................................................................................9 Policy review and consultation..........................................................................................................10 2014 Outsourcing stocktake..........................................................................................................10 First consultation ...........................................................................................................................11 Second consultation......................................................................................................................11 PROBLEM DEFINITION.......................................................................................................................12 Market failures associated with outsourcing .....................................................................................12 The status quo leaves some risks unaddressed...............................................................................14 OBJECTIVES .......................................................................................................................................15 DEFINITION OF OUTSOURCING........................................................................................................17 OPTIONS AND IMPACT ANALYSIS...................................................................................................17 High level option three ......................................................................................................................18 Strengthening trans-Tasman Legislation and the Memorandum of Co-operation........................18 Strengthening MSAs .....................................................................................................................20 Other alternatives to an outsourcing policy...................................................................................20 High Level option four .......................................................................................................................21 Options for the process of entering into outsourcing arrangements .............................................22 Materiality test ...............................................................................................................................24 Contractual provisions...................................................................................................................25 Separation plans ...........................................................................................................................26 How to ensure functionality continues after service disruption .....................................................27 Policy threshold.............................................................................................................................31 The level of service a bank should be able to provide after a failure-event..................................32 Compendiums ...............................................................................................................................34 Options for the transition period....................................................................................................36 COST-BENEFIT ANALYSIS (CBA).....................................................................................................36 General approach to CBA ..............................................................................................................37 OBR cost benefit estimation..........................................................................................................38 Costs of the proposals ...................................................................................................................41 Amendments to the 2012 OBR Cost-benefit Analysis ................................................................44 CBA Conclusion..............................................................................................................................45 CONCLUSION ......................................................................................................................................46 IMPLEMENTATION..............................................................................................................................48 Compliance .......................................................................................................................................48 Timing and transitional arrangements...............................................................................................49 MONITORING EVALUATION AND REVIEW ......................................................................................50 Appendix one: Policy evolution ........................................................................................................51 Appendix two: Key Features of Final Policy Proposal (as compared to current BS11)..............53

3 ADEQUACY STATEMENT

1. This Regulatory Impact Statement (RIS) provides an analysis of the options the Reserve Bank considered when reviewing the policy on outsourcing by registered banks (BS11). The document also provides a summary of the Reserve Bank’s preferred set of proposals. The RIS has been prepared by the Reserve Bank in accordance with the requirements of section 162AB of the Reserve Bank of New Zealand Act 1989 (the Act).
2. The analysis presented in this paper is based firstly on a 2014 review of the outsourcing arrangements of the five largest banks in New Zealand. Subsequently, when developing options for revising BS11, the Reserve Bank undertook two rounds of public consultation. This involved extensive bilateral engagement with banks and other stakeholders, and also an industry workshop. The Reserve Bank consulted with other agencies and foreign regulators on the proposals, too.
3. The analysis is based on first principles. Market failures (specifically externalities) associated with banks’ outsourcing arrangements have been identified and served as the basis for developing objectives and options. Quantitative cost-benefit analysis (CBA) has been used where appropriate.
4. There are significant costs for some banks arising from these proposals. However, a proportion of these costs can be attributed to misinterpretation and misapplication of the original BS11. That said, the Reserve Bank is mindful to minimise all costs where possible. The proposals are outcomes-focused and non-prescriptive where possible, and therefore should have more limited impact on economic efficiency. This includes limited impacts on consumers.
5. This paper has been subject to a high level of scrutiny. This includes presentation at one of the Reserve Banks’s internal decision making committees, peer review by an experienced banking consultant external to the Reserve Bank, and peer review against Treasury’s quality assurance criteria for RISs. In addition, the Reserve Bank’s analysis of banks’ cost estimates was reviewed by IT consultants with experience of the banking industry and familiarity with the current outsourcing policy.
6. The RIS provides a qualitative analysis of the pros and cons of the policy proposals as well as a quantitative cost benefit analysis of the preferred option. The main limitation of the CBA is that most cost estimates submitted in the consultations remained at a high level. Sometimes they included costs that arise due to the misapplication of the current outsourcing policy (as well as new costs arising from the proposed new policy). The Reserve Bank has had to make assumptions and use extrapolation methods to derive an industry representative cost estimate. The assumptions include appropriate levels of conservativeness to avoid the risk of overstating the net benefit. Sensitivity analysis was also carried out. The Reserve Bank’s central estimate suggests a gross cost to industry of $550 million and an expected net benefit of the revised outsourcing policy of $2.2 billion (all on a net present value basis). A higher cost estimate of $870 million, which is more closely based on banks’ own estimates, produces an expected net benefit of $1.9 billion. These benefits result from the revised outsourcing policy making the Reserve Bank’s OBR policy a viable resolution option in the event of a banking crisis. They should not be taken as scientifically accurate point estimates but as an indication only. That said, the Reserve Bank is confident that the expected benefits of these policy proposals to society significantly outweigh the costs.

4 EXECUTIVE SUMMARY 7. The Reserve Bank recognises that outsourcing by banks can have a positive impact on banks’ cost efficiencies and exposures to certain risks, and can allow banks to access specialist expertise that would otherwise not be available, or would be expensive to maintain internally. 8. However, there is a risk that current outsourcing arrangements may frustrate attempts to manage a failed bank, with the potential to increase costs through limiting the flexibility and the range of exit options available. Failure of outsourcing arrangements also has the potential to disrupt the provision of banking services in business-as-usual (BAU) situations and could increase the likelihood of a banking failure. Outsourcing by banks is therefore relevant to both limbs of section 68 of the Act. 9. Section 68 of the Act requires the Reserve Bank to exercise its banking supervision and registration powers under Part 5 of the Act for the purposes of: a. promoting the maintenance of a sound and efficient financial system; or b. avoiding significant damage to the financial system that could result from the failure of a registered bank. 10. The ability for New Zealand authorities to respond to a bank failure or crisis in a way that best limits disruption and social costs is a key part of meeting the section 68 objectives. 11. Banks do have incentives to mitigate the risks of outsourcing. In particular, banks have an incentive to mitigate the potential for outsourcing arrangements to cause BAU disruptions as these ultimately affect their profits. However, even in the case of BAU outsourcing disruptions, there will be wider costs to third parties that a bank may not account for. Therefore, their incentives to prevent such disruptions may not be fully aligned with social preferences. The costs to third parties that are not taken into account by banks are known as negative externalities and are a form of market failure. 12. The other two risks of outsourcing identified by the Reserve Bank are also associated with negative externalities. If a bank failed, there would be costs to the owners and managers of the banks (loss of investments, jobs and reputations). Owners and managers will take these costs into account in their risk management decisions. However, there are also wider costs to society from a bank failure that rationally acting owners and managers of a bank are unlikely to make allowances for. Such costs may include the public losing temporary or even permanent access to funds for transactions and the effect this would have on the wider economy, i.e. loss of economic activity. Another example is where the public lose confidence in the banking system as a whole, thereby harming other institutions which otherwise would be sound. Mitigating against these costs may require investment and planning, the benefits of which would not accrue to the current owners and managers of a bank since they would only materialise in a failure and accrue to society at large. 13. The potentially most severe externalities from outsourcing arrangements arise from their potential to frustrate the resolution of a bank or prevent it operating as a standalone entity (when separated from a larger banking group). Here the incentives for bank owners and management to prepare for how their bank, if failed, could re￾open and operate under statutory management are particularly limited.

5 14. In New Zealand the risks around outsourcing, particularly in how it relates to resolution of a failed bank, may be higher than in other jurisdictions. This is because a large proportion of the banking industry is part of foreign-based banking groups. 15. The Reserve Bank introduced BS11 in 2006. BS11 was applied to banks with over $10 billion in liabilities, net amounts due to related parties (defined in BS11 as “Large Banks”). The original BS11 emphasised the ability of a failed bank to provide and circulate liquidity, and to retain legal and practical control of core banking functions under both normal business conditions and in events of stress. However, the original BS11 also recognised the benefits of outsourcing and was largely non-prescriptive. 16. In 2013, OBR pre-positioning was implemented. OBR is a mechanism for providing bank customers continued access to liquidity and banking services after bank failure. OBR also allows for customers of a failed bank to continue to access a portion of their funds during resolution or wind-down without recourse to taxpayers. However, if it is to be a feasible option in the case of a bank crisis, it relies on a robust and correctly implemented outsourcing policy. 17. In 2014, the Reserve Bank undertook a stocktake of the outsourcing arrangements of the Large Banks. The stocktake found that interpretation and implementation of the current BS11 varied from what the Reserve Bank had intended. It also revealed that the original BS11 was perhaps too narrow in placing emphasis on a bank’s ability to provide and circulate liquidity. While one option was to require banks to fully comply with the current outsourcing policy, there was also a question as to whether the policy fully supports OBR. As a result of the stocktake and the OBR question, the Reserve Bank decided to undertake a complete, first-principles review of BS11. 18. The Reserve Bank considered options for a revised outsourcing policy on two levels. At a high level there were four options:

1. the status quo (continue with the current policy);
2. no outsourcing policy (i.e. removing BS11 altogether) and no other action;
3. replacing the outsourcing policy with changes to trans-Tasman legislation provisions and placing requirements on banks’ Master Services Agreements (MSAs); and
4. both clarifying and revising the current policy.
5. Option one, the status quo, provides the baseline for assessing the other options. Its main benefit would be that banks would not have to incur any new costs. They could continue with existing arrangements. Some banks that are not as integrated with their foreign parents would have the flexibility to change their operational structures over time to pursue a similar level of deeper integration.
6. However, this option would not achieve the Reserve Bank’s objectives. It would endorse inconsistent application of the current policy and leave New Zealand authorities with considerable uncertainty as to the viability of some of the resolution options in a crisis. This option has a high risk of undermining the feasibility of OBR, or any other resolution option that envisages the separation of a New Zealand subsidiary from its overseas parent, for some banks. This would expose the New Zealand financial sector to significant risk and cost in a crisis.

6 21. Likewise, option two would leave the identified market failures unaddressed and significantly increase the risk of undermining the viability of OBR and restrict the range of options available in a failure scenario. Moreover, it would also adversely affect the ability of banks to provide liquidity in a crisis, a key aim of the existing outsourcing policy. 22. Option three was proposed by industry as an alternative to the Reserve Bank’s outsourcing proposals. The first part of this option, strengthening existing legislation, envisages firmer commitments by Australian authorities to ensure financial stability in New Zealand. Existing legislative commitments require New Zealand and Australian regulators to have regard to the financial stability of each other’s jurisdiction when making decisions, and also with regards to trans-Tasman operational dependencies. These commitments are already world-leading and date back to the current outsourcing policy over a decade ago. 23. The benefit of this option would be a reduction in compliance costs for banks. The Reserve Bank has seriously considered the scope for further legislative enhancement and consulted its Australian counterparts. However, the Reserve Bank has concluded that strengthening the existing legislative provisions would be a lengthy process with no guarantee of success, and would not provide the same level or duration of assurance that a robust outsourcing policy achieves. Some of the key issues with this approach are that the New Zealand banking landscape could change through time, any legislative commitments could be amended by future governments when unwinding highly integrated banking arrangements could be even more costly, and it would not provide the same level of practical assurance that the ability of locally incorporated banks to operate independently does. It should also be borne in mind that the existing outsourcing policy was part of a package of policies that also included the local incorporation policy for systemically important banks. Pursuing the legislative proposal as an alternative to an outsourcing policy would potentially undermine the Reserve Bank’s local incorporation policy. Notwithstanding the importance of taking one another’s financial stability into account, it is also highly appropriate for two sovereign nations to have sufficient flexibility to act in their national interest in a crisis. This in no way diminishes the close ties that exist between the Reserve Bank and its Australian counterparts, but it recognises that incentives and preferred solutions could diverge in a severe crisis. 24. Strengthened MSAs are desirable and something the Reserve Bank will encourage banks to work on. However, strengthened MSAs similarly do not provide the necessary degree of assurance that systemically important foreign-owned banks in New Zealand would continue to operate post a crisis or a separation. 25. Under option four the Reserve Bank considered several sub-options: a. the process banks should follow with the Reserve Bank when entering into new outsourcing arrangements; b. whether there should be a materiality test for outsourcing arrangements; c. how to ensure functionality continues to be available after a service disruption; d. whether an outsourcing policy should prescribe terms and conditions for contracts between banks and external service providers; e. whether or not foreign-owned banks should be required to have separation plans;

7 f. what should the threshold of a revised policy be, i.e. what size of banks should it apply to; g. the level of service a bank should be expected to provide the day after a failure event and indefinitely afterwards; and h. whether or not affected banks should be required to have compendiums of all material outsourcing arrangements. 26. The Reserve Bank publicly consulted on its proposals for revising the outsourcing policy twice: once in August 2015 and again in May 2016. This included extensive engagement with banks and other interested parties throughout the review process. This included over 70 meetings and teleconferences, and an industry workshop. 27. Feedback from the consultations allowed the Reserve Bank to refine its proposals to reduce compliance and other efficiency costs where possible while still ensuring that the policy objectives will be met. 28. The Reserve Bank’s preferred high-level option is to clarify and revise the outsourcing policy, i.e. option four. The following proposals for a revised BS11 are of note: • a formal process for entering into new outsourcing arrangements and ensuring compliance has been designed; • an implicit materiality test by way of a white list (a list of functions that may be outsourced but are not considered material for the purposes of the policy) will be introduced; • banks will be required to make sure certain provisions are included in all contracts for outsourcing arrangements; • foreign-owned affected banks will be required to produce separation plans and share these documents with the Reserve Bank; • affected banks will be required to have robust-back up arrangements of functions outsourced to a related party (while back-up functionality was an existing part of the original policy, it does not appear to have been consistently understood and applied across the sector); • the existing policy threshold will be retained; • the level of service a bank should be able to provide to customers following a failure/separation event, and indefinitely afterwards, is more explicitly set out; • affected banks will be required to maintain compendiums recording basic information about all outsourcing arrangements; and • affected banks will have five years to plan for, and become compliant with, the revised policy. 29. Arguably, BS11 will be in substance largely unchanged from the policy that banks were first required to become compliant with over a decade ago. Most of the proposed changes clarify the Reserve Bank’s original expectations rather than extend the policy.

8 Appendix two maps out differences and similarities in the final proposals and the text of the original BS11. 30. In both consultations, some banks provided cost estimates for complying with the revised policy. In the second consultation, estimates ranged from $10 million to $300 million in upfront costs and $12.75 million to $52 million in on-going annual costs for individual banks. While the Reserve Bank acknowledges that a revised and clarified outsourcing policy would require some banks to make sizeable investments in order to comply, it should also be noted that most cost estimates lacked granularity and did not distinguish between new compliance costs and costs that arise due to a misinterpretation of the existing policy. 31. The Reserve Bank analysed the cost estimates in detail and sought out industry expertise to verify their reliability. Where more detailed estimates were available, the Reserve Bank was able to distinguish between new compliance costs, costs that arise due to the current policy being misinterpreted, costs that are not related to the policy requirements and costs that would only materialise post a separation. The Reserve Bank’s central cost estimate produces an industry cost figure of approximately $550 million in net present value (NPV) terms. This figure needs to be viewed in the context of helping to minimise the costs of a banking crisis. While a low probability event, the potential cost of a banking crisis can be very large. An effective outsourcing policy is necessary to make OBR viable as a resolution option which could significantly reduce the cost of a banking crisis in New Zealand. When the costs and benefits of the outsourcing policy are assessed in this context, an expected NPV benefit of approximately $2.2 billion is obtained. 32. A more conservative cost estimate that makes fewer changes to the high level estimates provided by banks produces a cost figure of $870 million and an expected net benefit of around $ 1.9 billion. 33. These net benefit estimates should be seen as indicative only. They do not include some potential benefits such as the reduction in the probability of a bank failing due to a failed outsourcing arrangement or a lower risk of disruption due to an outsourcing arrangement. Moreover, the cost estimates are based on achieving compliance via technical solutions. The revised policy would leave ample scope for more efficient, i.e. less costly, business solutions to be employed, thus potentially bringing down banks’ cost of compliance. 34. The Reserve Bank believes that the affected banks are in a position to absorb these costs over the five year transition period without a material impact on their profitability or on their ability to innovate. For example, the central cost estimate of $550 million represents around 2.8 percent of the affected banks’ cumulative after-tax profits over the last five years. 35. As such, there should not be a significant impact on bank customers or the cost and provision of credit to the economy. It should also be noted that compliance with the current policy varies across banks and those that have more independent New Zealand subsidiaries do not appear to have suffered in terms of their profitability compared to their less independent peers.

9 BACKGROUND AND CONSULTATION 36. The Reserve Bank first consulted on introducing an outsourcing policy in 2004, with a final version of the policy being introduced in 2006. The original policy development noted that the opportunities for outsourcing in banking had increased markedly in previous years as information technology (IT) had evolved and improved. More and more activities that were once traditionally conducted in-house by banks were now seen as candidates for commercially-viable outsourcing to specialist providers. At the same time, the increasing spread of major banks’ operations across multiple jurisdictions had led those banks to pursue opportunities to achieve efficiencies by centralising and consolidating a range of functions. In many instances, these arrangements allowed banks to realise economies of scale and obtain better technology to benefit both the quality and efficiency of their operations in a positive manner. But recognising that these trends also presented risks to the operation of banks and the financial system the Reserve Bank followed many other jurisdictions in introducing policy on outsourcing. 37. BS11 is currently applied to Large Banks. At the moment these are: ANZ, ASB, BNZ, Westpac and Kiwibank. 38. As in other jurisdictions, one concern of the Reserve Bank leading to the development of BS11 was the BAU risks associated with outsourcing. This includes any impact on a bank or the wider financial system from a supplier failure or where a supplier fails to provide an adequate service. 39. However, New Zealand is also unique internationally in that the four largest banks are owned by large foreign parent banks all from Australia. In 2006, these four banks made up around 89 percent of total bank assets in New Zealand. Today that number is close to 86 percent.1 Centralisation of banking operations within parent banks or related entities over which the New Zealand subsidiaries have no direct control could have the potential to undermine the ability of New Zealand authorities to manage failed banks and other financial system distress. 40. The original outsourcing policy sought to address the risks emerging from the growth in outsourcing by setting out a range of outcomes banks need to be able to deliver on an on-going basis. The policy put the onus on the management of banks to make sure that their banks retained practical and legal control of their core functions. The policy deliberately did not categorise or name particular systems or functions, and avoided referring to specific terms or concepts that may not fit well with a particular bank’s business model. This was intended to: • reflect the disparity among banks in terms of what their core functions are; • maintain the emphasis on the role of the bank’s directors in ensuring that the bank was managed prudently and effectively; and • provide flexibility to ensure that financial system efficiency was not overly constrained by policy. 41. The development of the original BS11 took place against the backdrop of a number of other material policy developments, including the local incorporation policy. This policy was also linked to a desire to strengthen the Reserve Bank’s ability to respond to a 1 Reserve Bank estimates.

10 bank failure. Significant work at the time was also undertaken on the development of the Bank Creditor Resolution policy (the forerunner to OBR). 42. OBR was introduced in 2013 against a background of an established outsourcing policy. OBR is a mechanism for providing bank customers with continued access to liquidity and banking services after a bank failure. It requires pre-positioning which means having the IT, payments, resource and process functionality in place ahead of a crisis, such that should a bank enter into statutory management, and access channels can be reopened for business by no later than 9.00 am the next business day enabling customers to have access to a portion of their funds. OBR pre-positioning is required of all locally-incorporated banks with over $1 billion in retail deposits. 43. For OBR to be successful a bank must be able to keep operating and stay within the financial system. This is how OBR prevents wider systemic fallout from a failure. Furthermore, OBR does not assume that the failed bank would go into wind down mode, but provides an option for the bank to continue operating while a resolution option is identified. This may include sale and continued operation of the bank. This means that the bank must have the capability to keep on operating and have practical and legal control of any outsourced functions relevant to its core operations. 44. The OBR policy was established on the premise that application of BS11 would provide this and that BS11 was being implemented by banks as the Reserve Bank intended. Hence, OBR specific requirements focused on what is required on the day that OBR is triggered and day one post the failure event i.e. the initial bail-in and re￾opening of a failed bank. Therefore, BS11 is critical in ensuring the orderly resolution of a failed bank. Policy review and consultation 2014 Outsourcing stocktake 45. In 2014, the Reserve Bank undertook a stocktake of the outsourcing arrangements of the five Large Banks. The purpose of the stocktake was to consider these banks’ general approach to compliance with the policy. The stocktake found those banks’ interpretations of what function should be defined as a “core function” for the purposes of the current policy varied. This is despite the Reserve Bank issuing further guidance to banks since 2006 on how to meet the objectives of the original policy. 46. The current BS11 lists a series of outcomes that banks are required to meet before or on the first value day after a fail of the bank or a service provider, and thereafter. The “and thereafter” was intended by the Reserve Bank to mean a bank would be required to meet the outcomes indefinitely. However, some banks have taken the phrase to mean for only a few days or weeks following a failure event. They have therefore implemented back-up systems that would not be sustainable in the longer-term (e.g. they require manual entry of data). 47. Therefore, while the stocktake highlighted that Large Banks may have adequate systems to maintain business continuity after a natural disaster or technology failure, and while the practical and legal controls in place are useful for these types of events, it is not clear how banks would continue to operate under a stress event occasioned by a complete supplier failure or a bank failure. It is also clear that OBR could not be part of a successful resolution strategy with incorrect implementation of BS11. This has serious implications for the ability of New Zealand authorities to contain the spillover effects of a distress or failure scenario.

11 48. Following the stocktake the Reserve Bank undertook a complete review of the existing outsourcing policy, including whether the current policy remains appropriate, whether the definition of “core function” should be retained, and what legal and practical controls banks should have over their outsourced functions. First consultation 49. The first of two consultation papers was released in August 2015 and the Reserve Bank received sixteen submissions in response.2 During both the consultation period, and following the submissions, the Reserve Bank also held discussions with a number of the submitters. This included around 15 bilateral working level meetings and teleconferences with affected parties, including banks and internationally active service providers. Overall, submitters welcomed the review of the outsourcing policy and being involved early in the policy development process. 3 Second consultation 50. In May 2016, the Reserve Bank published a second consultation paper. The paper provided a high level summary of submissions to the first round of consultation and set out further options on a number of matters that the Reserve Bank wanted to receive feedback on before finalising the outsourcing policy. 51. Eleven submissions were received on the second consultation paper4 . The Reserve Bank also held over 14 additional working level bilateral meetings and one industry workshop as part of the second consultation. Following the second consultation, the Reserve Bank continued to have a high level of engagement with stakeholders. 52. During the entire policy development process, there have been around thirty-four meetings with banks at a CEO/Chair level where outsourcing has been discussed with the Reserve Bank. This includes five meetings where outsourcing was the main agenda item and an industry dinner. In total the Reserve Bank has held over 70 meetings with banks on outsourcing since the beginning of the first consultation. The Reserve Bank has also engaged with the Treasury, Australian authorities other foreign regulators. 53. Feedback from the consultations on specific parts of the Reserve Bank’s proposals are discussed in more detail in the relevant areas of the ‘Options and Impact Analysis’ part. A description of how the policy proposals evolved is contained in appendices one and two. 2 The submitters were: Asia Cloud Computing Association, ANZ NZ, ASB, BNZ, Co-operative Bank, FIRST Union, Heartland Bank, IBM, ICBC NZ, Microsoft, NZBA, Rabobank NZ, Salesforce, SBS, TSB and Westpac NZ. 3 The decision to have two consultations was in part to involve stakeholders as early as possible in the policy development. This meant the first consultation often asked submitters for ideas on how to approach a problem rather than state their preferences on options already developed by the Reserve Bank. This approach to consultation was something requested by stakeholders in feedback to the 2015 Regulatory Stocktake. 4 The submitters were: Asia Cloud Computing Association, ANZ Bank New Zealand Ltd, ASB Bank Limited, Bank of New Zealand, Kiwibank Limited, Microsoft New Zealand, New Zealand Banker’s Association, Rabobank New Zealand Limited, Salesforce and Westpac New Zealand Limited. ANZ, ASB, Bank of New Zealand and Westpac also made an additional joint submission to the consultation. Some banks made additional submissions after the close of the formal consultation period.

12 PROBLEM DEFINITION 54. The basis for any prudential intervention by the Reserve Bank, and therefore any basis for an outsourcing policy, ultimately stems from section 68 of the Act (see paragraph nine). 55. Outsourcing arrangements are relevant to the first leg of section 68 in regards to both efficiency and soundness. Efficiency is an important objective and the Reserve Bank seeks to let banks operate without regulatory restraints where possible. This is y\ \true of outsourcing, which can open up access to cost savings and external expertise that can provide potential efficiency benefits for the system and which cannot be supported in-house. 56. In addition to these efficiency benefits, the external party may also be able to provide those services faster and to a higher standard, thus improving the quality of the service. Outsourcing may provide banks access to a much broader and specialised pool of talent, technology and infrastructure and allow banks to draw on international capability that may not otherwise be available to them, especially given the small size of the New Zealand financial system. 57. There is also the potential for some outsourcing arrangements to reduce operational risk thereby potentially increasing the soundness of the financial system as well as its efficiency. An example of this might be a specialist third party being able to provide IT services that are more secure than individual banks could provide in-house. 58. The Reserve Bank is very conscious of these benefits that New Zealand-based banks get from their outsourcing arrangements, including the benefits from being part of a larger foreign-owned banking group. However, there are also risks and social costs associated with outsourcing in that such arrangements could adversely affect the soundness of the financial system if disrupted. For example, a single supplier to several banks may increase concentration risk, or the failure of a service provider to one bank could have implications for that bank to provide liquidity to the financial system, thus leading to wider systemic disruption. Repeated outsourcing disruptions could also turn short term efficiency gains into long term efficiency costs, although banks should have a private interest in addressing this latter risk. 59. The potential for negative externalities is particularly relevant with respect to the second leg of section 68, which focuses on the costs of a banking failure once it occurs. Here there is a clear risk associated with outsourcing arrangements potentially frustrating attempts to manage the failure of a registered bank including the application of OBR or take over by a competitor. Market failures associated with outsourcing 60. The Reserve Bank uses a market failure framework for identifying situations where regulatory intervention may be justified. That is, there is a demonstrable risk that the incentives on individual institutions do not align with the broader public good. Furthermore, the Reserve Bank must show that any chosen intervention to address any identified market failures produces higher net benefits than any feasible alternative (including no intervention at all). 61. Outsourcing arrangements by banks potentially creates negative externalities which banks may not be properly incentivised to mitigate. Banks may be trading-off soundness and efficiency in ways out of line with society’s wider preferences e.g. small

13 reductions in spending on risk management but increased potential for extremely costly future scenarios. The externalities related to outsourcing by New Zealand banks are best described in three categories: • costs to third parties arising from service disruption under BAU conditions; • costs to third parties arising from outsourcing arrangements increasing the probability of a bank failing; and • costs to third parties arising from outsourcing arrangements frustrating the orderly resolution of a bank. 62. Each category is described below. Costs to third parties arising from service disruption 63. Under BAU conditions banks can be expected to have strong incentives to adopt arrangements that are robust in limiting the potential impact on their profits from supplier failure or failure of a supplier to provide adequate service. However, this does not necessarily mean that society’s costs are always the same as the private costs that a bank uses in its cost-benefit calculation. Firstly, the incentives on the bank may not lead it to have sufficient regard for the broader economic costs of service disruption (i.e. costs to third parties may exceed the reputation and/or direct costs to the bank). Secondly, there may be particular issues around concentration risks associated with a single supplier to many banks. In this scenario, economic costs could be substantial but the direct costs on individual institutions may be limited as all or many banks would be affected, limiting reputational damage at the individual bank level. 64. For this externality and the other two described below there is also an element of asymmetric information involved. Customers are unlikely to have the same information as a bank on outsourcing arrangements, and moreover most customers have likely never considered the risks of banks’ outsourcing. Therefore customers are unlikely to be able to provide pressure on banks to take outsourcing risks into account by say switching to banks with less outsourcing risk. Customers may also have misaligned incentives themselves even if they were fully knowledgeable. They may believe the government will cover any cost to them incurred through a bank’s outsourcing arrangements failing and therefore decide not to take mitigating action (moral hazard). The lack of a competitive mechanism and potential for moral hazard means there is likely no market solution to this externality and the others described. Costs to third parties arising from outsourcing arrangements increasing the probability of a bank failing 65. Conceptually the risk of bank failing entirely because of or in part due to outsourcing arrangements is an extreme version of the BAU risks of outsourcing. If a bank cannot undertake a critical function (e.g. settling accounts with other banks) because of a failed outsourcing arrangement for a sufficiently long enough period then either it may sustain enough direct losses to become insolvent (e.g. through being unable to monitor and adjust market positions) or become illiquid or insolvent because of reputational damage that causes a run on the bank. 66. Bank owners, staff and bank boards have incentives to reduce the risk of a bank failing. In the event of failure they would lose all or part of their investments, their jobs, and possibly suffer other financial or reputational damage. However, there are other

14 major external costs to the wider economy that do not directly fall on these parties. For example, the failure of a bank could result in the public losing temporary or even permanent, access to funds that they rely on to do basic transactions. This can cause widespread disruption in the economy and have flow on effects by affecting the ability of the bank’s customers to undertake transactions with third parties and therefore affect the ability of those third parties to undertake further transactions. Interconnectedness can also mean that the failure of one large bank can quickly put stress on others. To put these costs in quantitative terms, a previous Reserve Bank literature review found the cost of a banking crisis could be at least 10-20 percent of GDP.5 67. Any perception of an implicit guarantee that the government will bail-out a failed bank will mean bank owners, staff and the boards have less incentive to act prudently and this includes less incentive to carefully manage outsourced functions. A belief that the government may bail-out a failed bank also blunts investors’ and depositors’ incentives to consider the outsourcing risks of a bank which in turn means less pressure is placed on banks to consider the risks by way of competition. Costs to third parties arising from outsourcing arrangements frustrating the orderly resolution of a bank 68. Bank owners and managers may have little to no incentive to ensure outsourcing arrangements are robust past the point of failure of the bank as they are no longer in control of, or hold a beneficial ownership interest in the institution following the failure. 69. The costs of putting in place systems and procedures to allow a failed bank to continue to provide services, and therefore possibly be able to continue as a going concern or be wound-down orderly are likely minor compared to the potential benefits. If for example, contracts between a bank and a third party for a core function can be terminated by the third party on appointment of a statutory manager to the bank6 , then the bank’s financial position may erode even further. It could also mean that customers of the bank are locked out of their accounts for a much longer period than otherwise. The costs of outsourcing arrangements frustrating a bank’s orderly recovery or resolution could therefore be in the order of tens of billions of dollars or more. The status quo leaves some risks unaddressed 70. The Reserve Bank considers that these market failures that were already identified in 2006 remain relevant. Unfortunately, the policy requirements have, over time, been misunderstood by parts of industry, which means that the outcomes of the current outsourcing policy are not being consistently met. In addition, the negative externality of being prepared for a failure or a separation, i.e. the ability to continue operating after such an event, has not been fully addressed by the current outsourcing policy. 5 The literature reviewed by the Reserve Bank suggests the costs of a banking crisis could be a lot higher than 20 percent of GDP if it is associated with some other macroeconomic shock or if the crisis has a permanent effect on GDP, not simply a transitory effect as the 10-20 percent range assumes. One example is a Bank of England study which finds the expected cost of a banking crisis could be 43 percent of GDP in net present value terms. In this study the authors used data from the Global Financial Crisis to separate out the direct cost of a banking crisis from other macroeconomic shocks. Brooke, M., Bush, O., Edwards, R., Ellis, J., Francis, B., Harimohan, R., & Siegert, C. (2015). ‘Measuring the macroeconomic costs and benefits of higher UK bank capital requirements’. Financial Stability Paper, 35. http://www.bankofengland.co.uk/financialstability/Documents/fpc/fspapers/fs_paper35.pd , accessed 14 December 2016. 6 Even if the bank is still willing and able to pay for the service,

15 71. The 2014 stocktake identified Large Banks’ inconsistent interpretation and therefore inconsistent implementation of the current policy. While these banks appear to have systems in place to deal with BAU type disruptions it appeared that they have generally not been appropriately addressing the risks associated with complete supplier failure, whether it be a related party or external service provider. This lack of implementation creates doubt that the Reserve Bank’s OBR policy would work as intended and may also limit other resolution options for a failed bank. 72. The stocktake additionally identified that even a correct interpretation of the current BS11 potentially may be too narrowly focused on provision of liquidity. There may be net benefits in banks being able to provide a wider range of services post the failure of an outsourcing arrangement or the bank itself. 73. In summary, there is a three part problem definition. Fundamentally, there are market failures which the status quo seeks to address. These market failures have not changed since the introduction of BS11.The original policy would have largely addressed these failures had it been consistently interpreted as intended by the Reserve Bank. The second part of the problem definition is therefore ensuring a consistent interpretation of the policy. Then there is the need to change the policy to support OBR. 74. In order to fully address the problems and market failures identified by the Reserve Bank the objectives and outcomes have been updated. Since the Reserve Bank’s view on the market failures has not changed the new objectives and outcomes are similar to those of the original policy. Where updates have been made it is to ensure consistency of interpretation and to take alignment with OBR into consideration. OBJECTIVES 75. As stated above, section 68 of the Act requires the Reserve Bank to exercise its powers relating to the registration and prudential supervision of banks (Part 5 of the Act) for the purposes of: a. promoting the maintenance of a sound and efficient financial system; or b. avoiding significant damage to the financial system that could result from the failure of a registered bank. 76. The section 68 purposes are both broad and can be difficult to quantify. Therefore, the Reserve Bank has designed specific objectives that it hopes to achieve in respect of outsourcing consistent with section 68 of the Act. Also, given the particular emphasis the Reserve Bank’s prudential framework places on authorities having robust tools and processes to manage the failure of a bank and to mitigate any costs related to a failure, the Reserve Bank has ensured that the outsourcing objectives are consistent with enabling its crisis management tools, particularly OBR. 77. The specific objectives of the outsourcing policy are that outsourcing arrangements of a bank should not compromise the bank’s ability to:

1. be effectively administered under the statutory management for the purposes of maintaining the bank’s ability to continue to provide and circulate liquidity to the financial system and the wider economy;
2. be in a position to enable any new owner of all or part of the bank to carry on the basic business of the bank; and

16 3) address the impact that the failure of a service provider may have on the bank’s ability to carry on all or part of the business of the bank. 78. Objective 1) concerns how the bank will continue to provide and circulate liquidity to the financial system and economy if it were placed into statutory management. Particular outsourcing arrangements may make it harder for a statutory manager to ensure the continuity of functions that have been outsourced. 79. Objective 2) concerns the interest in a bank’s ability to carry on basic business following its transfer to new owners. This comes from a desire to maintain a range of viable exit strategies for authorities when seeking an exit from statutory management. 80. In order to effectively determine whether the Objectives 1) and 2) are being achieved, particularly in respect to enabling OBR, the Reserve Bank is proposing revisions to the existing outsourcing outcomes for banks. The new outcomes are therefore in part a restatement of the existing BS11’s outcomes with tighter language, but are also modified to align with OBR (although they are written with other forms of resolution in mind, too). The outcomes also provide a more granular and measurable exposition of these objectives. These outcomes are that banks should be operated in such a way that: (a) The bank is able to continue to meet its daily settlement and other time-critical obligations, before the start of the value day after the day of failure and thereafter, so as to avoid disruption and damage to the rest of the financial system; (b) The bank is able to monitor and manage its financial market positions, including credit and market risk positions, before the start of the value day after the day of failure and thereafter, thereby limiting further damage to the bank’s balance sheet; (c) The bank has at hand the systems and balance sheet data necessary for the New Zealand authorities to have available a range of options for managing the failed bank, on the first value day after the day of failure and thereafter; (d) The bank is able to provide basic banking services to existing customers, including, but not limited to, liquidity (both access to deposits and to credit lines as defined in basic banking services) and account activity reporting, on the first value day after the day of failure and thereafter; (e) Where a bank is part of an overseas banking group, the bank is able to meet outcomes (a)-(d) as a stand-alone entity in the event of separation from its parent, and every day thereafter. 81. Objective 3) focuses on the bank’s ability to carry on business following the failure of a service provider. There are three additional outcomes that for measuring whether objective 3) is being obtained alongside outcomes (a)-(e), which are relevant here too. Banks will be also expected to address matters such as:

1. the ability of the bank to bring the function back in-house or find a work-around;
2. the ability of the bank to provide basic banking services; and
3. the ability of the bank to meet regulatory and legal obligations.

17 82. These objectives and their associated outcomes; and also the efficiency, cost and risk￾reduction advantages that outsourcing may provide will be used when considering different options for an outsourcing policy. These additional considerations are already partly reflected directly in the objectives and associated outcomes themselves. The Reserve Bank is seeking a policy that out of all feasible alternatives provides the highest net benefit to society. DEFINITION OF OUTSOURCING 83. For the purposes of the policy development, the Reserve Bank used a definition of outsourcing, based on the definition provided by the Basel Committee, but modified slightly to provide better alignment with the Australian Prudential Regulatory Authority’s (APRA’s) own definition. The original BS11 did not have an explicit definition of outsourcing and this may have contributed to the inconsistent interpretation of the policy. Outsourcing is therefore defined as: “a registered bank’s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that could be undertaken by the registered bank, now or in the future.” 84. This definition of outsourcing is designed to not inadvertently fail to capture any function that may be relevant to the objectives. One option considered further in the paper is the form of a materiality test (explicit or implicit) for the outsourcing policy. A materiality test creates an implicit boundary on the definition of outsourcing. OPTIONS AND IMPACT ANALYSIS 85. The Reserve Bank considered a range of options for addressing the problems identified with the current outsourcing policy in order to meet the objectives listed in the previous section. 86. At a high level four options were considered:

1. The status quo (keeping the 2006 BS11 unchanged);
2. no outsourcing policy (i.e. removing BS11 altogether) and no other action;
3. replace the outsourcing policy with changes to trans-Tasman legislation and requirements on Master Services Agreements (MSAs); and
4. a clarified and revised outsourcing policy.
5. For the reasons set out in the problem definition, the Reserve Bank does not believe option one, the status quo, would achieve the policy objectives related to a bank being able to separate from its parent in a failure event. However, under the status quo the BAU-type risks of outsourcing may be adequately managed.
6. Likewise, the Reserve Bank’s view is that option two would not achieve the objectives either. Although such an option is useful to consider as no outsourcing policy provides a baseline to compare all other options too. The background and problem definition sections set out the market failures associated with outsourcing, and therefore the higher than socially optimal risks to the soundness and efficiency of the New Zealand financial system. While no formal policy would obviously be the cheapest option in

18 terms of compliance costs for banks it would leave the risks of outsourcing completely unaddressed. 89. Even with an outsourcing policy (and additionally a local incorporation policy) the Australian-owned banks generally remain heavily integrated with their Australian parents. Greater use of outsourcing would mean that the associated risks would likely grow, although there may be some cost savings to banks. The Reserve Bank’s supervisory experience since the early 2000’s, when outsourcing first became a significant concern, supports this proposition, as does experience with the implementation of the local incorporation policy. 90. The Reserve Bank is of the view that no other existing regulatory policy could address the specific risks of outsourcing if BS11 was removed. The absence of an outsourcing policy for banks in New Zealand would also be out of line with guidance from the Basel Committee.7 There would therefore be increased risk that authorities from other jurisdictions would see New Zealand as not having an equivalent regulatory regime for banks. This could lead to restrictions on firms in these jurisdictions conducting business in New Zealand which could have significant costs for consumers and other parties in New Zealand. 91. The next subsection of the ‘Options and Impact Analysis’ part discusses whether amendments to the Australian Prudential Regulatory Act (APRA Act) and the (Australian) Banking Act; and strengthening of the contracts between parent banks and their subsidiaries (MSAs) could meet the objectives and therefore replace the need for a formal outsourcing policy. 92. The third sub-section sets out the sub-options within the high level option of clarifying and revising the policy. This is the Reserve Bank’s preferred high level option. 93. The Reserve Bank did not consider any non-regulatory forms of intervention which are sometimes used to address market failures. Education was not an option given the fundamental problem is a misalignment of incentives. Similarly, industry self-regulation would likely be ineffective because it could not create a credible mechanism to align banks’ incentives with the rest of society’s. Industry self-regulation or co-regulation can also lead to perverse incentives. Taxation or subsidies, which are outside of the Reserve Bank’s purview, could again lead to perverse incentives and outsourcing is too heterogeneous in nature for taxes or subsidies to be feasible. High level option three 94. Some submitters to the Reserve Bank’s two consultations suggested that strengthened trans-Tasman legislation and changes to MSAs could alleviate the Reserve Bank’s concerns about outsourcing, thereby allowing other requirements to be relaxed. The Reserve Bank took on board these suggestions as it seeks to minimise the compliance costs of its policies where possible. Strengthening trans-Tasman Legislation and the Memorandum of Co-operation 95. During the consultation process, some Australian-owned banks asked the Reserve Bank to consider changes to the trans-Tasman cooperation provisions within the Act, the (Australian) Banking Act 1959 and the Australian Prudential Regulatory Authority Act 1998. 7 Joint Forum (2005) ‘Outsourcing in Financial Services’ http://www.bis.org/publ/joint12.pdf, accessed 19 October 2016.

19 96. In 2006, amendments to the above three Acts were made to provide a level of assurance that respective regulators would not, to the extent reasonably practicable, take action that is likely to have a detrimental effect on the financial stability in either jurisdiction. ‘Action’ specifically includes interference with any outsourcing arrangement. There is also a requirement that, to the extent reasonably practicable in the circumstances, authorities from each country consult with each other before taking any action that could be detrimental to the others’ jurisdiction. 97. The Reserve Bank considers that the current legislative provisions increase the likelihood of itself and APRA taking into account the interests of the other’s financial system when considering actions. This is particularly beneficial for New Zealand given the extent of Australian ownership of the New Zealand banking system and the degree of outsourcing. The Reserve Bank therefore considers the current legislative provisions world-leading. To the best of the Reserve Bank’s knowledge the only countries with stronger legislative arrangements are those in the European Union – where a supra-national governance structure is in place. 98. The legislative provisions somewhat reduce concerns about outsourcing to related parties domiciled in Australia to the extent that New Zealand and Australian authorities interests would be well-aligned in the event of a crisis or bank failure. This means that, to some extent the provisions allow a less restrictive outsourcing policy. If the legislative provisions were not in place the Reserve Bank’s judgements on the other options would have likely been different. 99. However, the legislative provisions leave gaps: • The first is that the provisions relate to actions by APRA not those of the Australian parent banks themselves. The provisions do not replace the need for a New Zealand bank to have robust back-up arrangements in the scenario that its Australian parent can simply no longer provide critical services or is unwilling to do so. • In a crisis, authorities may have to take action before they can consult with their counterparts because any delay could cause further damage to the financial system. • The interests of Australian and New Zealand authorities may diverge in times of crisis. An action that is beneficial for one jurisdiction may have adverse impacts of the other.8 • A legislative solution could be unwound in the future, at which point it may be significantly more costly to re-introduce an outsourcing policy than to revise the existing policy now (because of possible increased integration across banking groups). • Finally, an outsourcing policy should not necessarily focus on the trans-Tasman dimension. While at present all major overseas-owned banks in New Zealand have Australian parents, this has not always been the case and it should not be assumed that it will continue to be so. 8 The 2004 consultation preceding the original outsourcing policy stated: “In an extreme case, the stress affecting one or both parties may be so severe that one or both parties in statutory management. In the case of a service provider being in statutory management, the directors’ legal ability to control systems such that the bank can be operated in a stand-alone basis will need to be robust to the actions of the provider’s statutory manager, whose obligations and duties may directly conflict with the best interests of the New Zealand bank (especially if the service provider is itself a financial institution)”.

20 100. The Reserve Bank notes that extensive discussions have been held with New Zealand and Australian agencies on this proposal. Strengthening MSAs 101. During the consultation process, several submitters also suggested that strengthening the contracts between parent banks and their subsidiaries could provide sufficient comfort to ensure that outsourced services would continue in a separation. These submitters further suggested that strengthened MSAs could be a substitute for at least some of the Reserve Bank’s proposals. 102. The Reserve Bank explored the idea to see if more lenient back-up arrangements for functions outsourced to a related party could be traded-off for stronger MSAs in great detail. 103. MSAs are agreements between related entities (usually the parent and its New Zealand subsidiary) which set out the terms and conditions for the provision of services from one entity to another. 104. The MSAs, that the Reserve Bank has seen, both contain provisions that neither party would be liable to the other for the failure or delay in the performance of their obligations under the MSA if this is due to a force majeur event. These MSAs all contain in their definitions of a force majeur event a restriction of, requirement of or failure to act by a government or quasi-government entity. This means a parent could withhold a service provided to a subsidiary that is captured under the MSA if an Australian Minister or APRA direct them not to. 105. While the Reserve Bank would not expect APRA to ask for non-performance of a service in a failure, it may be that in a crisis the parent will likely be dealing with significant issues itself and may not have the resources to devote to the continuation of services to its subsidiary (or former subsidiary) without unduly putting itself at risk. Therefore the parent may be directed to focus only on its own survival. In such circumstances it would be imperative that the subsidiary can continue to provide basic banking services on its own and meet its obligations under OBR. 106. Stronger MSAs would only provide for a degree of increased legal control. Banks would still need to consider the risks that the parent may simply be unable to provide certain functions even if willing to do so. Therefore, banks still need to have robust back-up arrangements. Furthermore, court action which may be used if the parent breaks the MSA (which may be in their interest in a crisis), would likely take time to resolve, by which stage the damage to the New Zealand bank would already be done. 107. Therefore, while strengthening MSAs may be good idea it would only deal with part of the issue. For the most critical functions for providing basic banking services the Reserve Bank anticipates back-up arrangement under the control of the New Zealand subsidiary would still be required. MSAs could not be relied upon alone. The Reserve Bank’s preference is for MSAs to be strengthened where possible complete reliance on strengthened MSAs would create undue risk of OBR or other types of crisis resolution strategies being undermined. Other alternatives to an outsourcing policy 108. In the second consultation, the Reserve Bank received suggestions by some banks that it should fundamentally reconsider its approach to bank failure resolution as an

21 alternative to developing a revised outsourcing policy. These banks suggested that the Reserve Bank should adopt a coordinated approach to resolution of failed banks with Australia which focuses on Single Point of Entry (SPE), and keeps the group intact, as well as Multiple Point of Entry (MPE) resolution where “separation of the New Zealand Subsidies” could be considered. 109. The Reserve Bank has been explicit that an outsourcing policy supports OBR and that OBR envisages separation, but options for responding to a crisis are not being excluded. The Reserve Bank agrees that in a crisis situation separation may not be the best option. The best option may be for the parent bank to downstream capital to strengthen the New Zealand subsidiary. However, the Reserve Bank believes there is also a need to prepare for a scenario where there is distress in both the parent bank and the subsidiary and the SPE model may not be able to be used. This may because in a crisis the time delay needed to coordinate a response with Australian authorities may risk further deterioration. It may also be because New Zealand and Australian authorities come to different conclusions as to how a failed bank (whether the parent, a subsidiary or the group) should be resolved. Additionally, the suggestion only deals with the circumstance when a New Zealand bank’s parent is Australian owned which may not always be the case for the Large Banks. 110. The Reserve Bank does not believe this suggestion by some banks would adequately address enough of the identified risks for it to be considered as an alternative to an outsourcing policy. High level option four 111. This option is to revise BS11, but only to ensure that the policy is interpreted in the way the Reserve Bank had initially intended. The Reserve Bank considered sub￾options for the following under this option: a) the process for banks to enter new outsourcing arrangements; b) whether there should be a materiality test for outsourcing arrangements; c) whether an outsourcing policy should prescribe terms and conditions for contracts between banks and external service providers; d) whether or not foreign-owned banks should be required to have separation plans; e) how to ensure functionality continues after service disruption; f) what should the threshold of a revised policy be, i.e. what size of banks should it apply to; g) whether or not affected banks should be required to have compendiums of all material outsourcing arrangements; h) the level of service a bank should be expected to provide the day after a failure event and indefinitely afterwards; and i) how long banks should have to produce plans on how they would become compliant with the revised policy, and then how long banks would have to become compliant.

22 Options for the process of entering into outsourcing arrangements 112. Currently banks are required to satisfy the Reserve Bank that their outsourcing arrangements are substitutable by other non-outsourced functions, or are not relevant to the outcomes, but how the bank goes about satisfying the Reserve Bank is unclear. At present there is no formal process under BS11 that banks are required to follow when entering outsourcing arrangements. This has led to variable compliance across the industry. Therefore, the Reserve Bank believes a more prescriptive approach would be a better option. 113. The Reserve Bank considered three options in detail. The first was for banks to obtain Reserve Bank non-objection before entering into any outsourcing arrangement. Under this option banks would be required to prepare detailed submissions for the Reserve Bank to consider all proposed outsourcing arrangements and consider whether the proposals are appropriate. A bank would need to demonstrate to the Reserve Bank that, in assessing the option for outsourcing a function, among other things, it has: a. considered all the risks associated with the outsourcing proposal have been identified and demonstrate that any risks arising are appropriately managed; b. developed realistic contingency plans that would enable the outsourced function to be provided by an alternative service provider or brought in-house if required. These contingency plans should be tested by the bank if the outsourcing proposal is approved; and c. involved the Board, a Board committee, or a senior manager with delegated authority from the Board, in approving the agreement. 114. The second option is that the Reserve Bank would firstly require banks fill out a prescribed template outlining the key information on any proposed outsourcing arrangement. This template would be completed before entering into the agreement. The template would contain, among other things, the following: a. information on the name and locations(s) of the service provider and the value and expiry or renewal date of the contract; b. if the arrangement is with or through a related party, how the requirements under the separation plan have been considered; c. the function or system that is proposed to be outsourced; d. a summary of the substitutable arrangements; e. how the bank has considered the implications of the failure of the services provider, or the failure of a related party providing the function; and f. information on the proposed internal control and risk management requirements of the outsourcing arrangement (including contractual agreements). 115. The Reserve Bank would still need to consider whether the arrangement will require non-objection before it is entered into. If it does require non-objection then the process outlined in option one would need to be followed by the bank. If, however, the Reserve Bank assesses the information and decides it does not require a full non-objection process then the bank will be notified and the bank may enter in to the arrangement.

23 The bank will then be required to notify the Reserve Bank within 20 working days of entering into the arrangement. 116. A third option is not to require banks to engage with the Reserve Bank on outsourcing applications but instead require as part of their compliance with conditions of registration (CoRs) that: • banks obtain annual reviews from an external party on whether they are complying with the policy during the five year transition period (discussed further down); • within the transition period the reviews would also check the bank’s progress towards compliance with the policy; • after the transition period banks would be required to have external reviews by a third party once every three years; • reviews would be paid for by the bank in question and the external reviewer, including the terms of reference for their appointment, would need to be approved by the Reserve Bank; • in addition to the above, the Reserve Bank may from time to time undertake checks of a few outsourcing arrangements of each bank at random and review them to ensure compliance, using the application process set out in option two above. 117. On balance the Reserve Bank’s considers a combination of options two and three would achieve the desired policy outcome. The Reserve Bank would make use of external reviewers for the transition period towards compliance although the Reserve Bank would oversee such reviews closely. After the five-year transition period, banks would be required to undertake the process outlined in option two for all outsourcing arrangements with related parties. Additionally, banks would be externally reviewed once every three years for compliance with the policy. This combination of options strikes a balance between ensuring the Reserve Bank has oversight of the outsourcing arrangement that banks are entering into where those arrangements have the potential to affect the objectives of the policy, whilst allowing banks to enter into arrangements that have little impact on the objectives with relative ease. This option will also assist in expediting the process. 118. The Reserve Bank’s thinking in this area evolved over time partly due to the consultation feedback. Initially, the Reserve Bank believed that ex-post notification of entering into outsourcing arrangements could not meet the objectives given the importance of many outsourcing arrangements in a bank’s resolution and also that outsourcing arrangements may be difficult to unwind once entered into. The initial proposed process was also designed to rectify the issues with the inconsistent interpretation and therefore application of the policy. However, some banks raised concerns about the work involved in assessing outsourcing applications, noting that this could become quite onerous. These efficiency concerns led to the preferred option. The preferred option does involve continued Reserve Bank oversight of the process to ensure that the problems of inconsistent interpretation of the policy which affected the original BS11 do not re-appear. 119. The proposed engagement process itself is new and may add some additional compliance costs for banks but it does not represent an expansion of the scope of the

24 outsourcing policy. The approach would help ensure compliance with the policy but should not unduly hold-up banks as they enter into new commercial arrangements. While banks will have to pay for the external reviews, under the old policy banks could have been required to seek approval from the Reserve Bank for all outsourcing arrangements and the level of detail required when making applications was not specified. Therefore, while there will be new compliance costs, banks will have more assurance that they are compliant with the policy thereby reducing uncertainty. Materiality test 120. Earlier in this paper, outsourcing for the purposes of reviewing the policy and developing any new policy was defined as: “Outsourcing is defined in this policy as a registered bank’s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that could be undertaken by the registered bank, now or in the future.” 121. The intention here was to provide a wide definition of outsourcing to avoid inadvertently failing to capture particular arrangements that could be relevant to the objectives. The above definition of outsourcing is based on the Basel Committee’s report on Outsourcing in Financial services.9 It is modified (“…basis that would be undertaken…” is changed to “…basis that could be undertaken…”) to achieve more consistency with APRA’s definition of outsourcing.10 122. However, it would not be useful or even feasible for an outsourcing policy to cover every third-party arrangement banks make. Many outsourcing arrangements have insignificant effects on the policy objectives. This has led the Reserve Bank to consider whether there should be an explicit materiality test for outsourcing (possibly embedded in the definition) or whether an implicit materiality test, in the form of a “white list”, should be adopted. 123. There are several options in this regard. Firstly, an explicit materiality would generally include a number of factors that would be taken into account for assessing whether an activity or function is material. Regulatory requirements such as compendium and/or notification would apply when a bank considers that an outsourcing proposal is “material” when assessed under through a credible internal assessment process. Several other regulators have explicit materiality tests, although their focus tends to be more on costs when determining materiality and do not usually appear to appropriately consider other factors such as the impact that outsourcing this function may have on the ability of the bank to provide services, and whether the service provider is a related party.11 That is, these other materiality tests may not be useful in the unique New Zealand context. 124. The second option is to have an implicit materiality test in the form of a “white list”. This list would set out the types of functions that the Reserve Bank considers should not be classified as outsourcing for the purposes of the policy. Two examples of the included 9 http://www.bis.org/publ/joint12.htm, accessed 19 October 2016. 10 APRA’s definition of outsourcing is contained in Prudential Standard CPS 231. http://www.apra.gov.au/CrossIndustry/Documents/CPS-231-Outsourcing-August-2014.pdf, accessed 19 October 2016 Their definition is: ‘Outsourcing’ involves an institution entering into an arrangement with another party (including a related body corporate) to perform, on a continuing basis, a business activity that currently is, or could be, undertaken by the institution itself.” 11 APRA do explicitly consider related party arrangements under their policy, however it is only stated as a matter they will have regard to and there is no guidance beyond that.

25 functions are: temporary help and contract personnel, and market information services (e.g. Moody’s or Bloomberg). 125. The Reserve Bank would ensure that any “white list” would be a live document. This recognises that it may be impossible to construct an exhaustive list of possibly outsourced functions and also the types of functions that banks outsource could change in the future. Therefore, under this option the Reserve Bank envisages having periodic reviews of the list based on the outsourcing applications being received and any other developments in the area. 126. The Reserve Bank carefully considered inclusion of an explicit materiality test both before the finalisation of the 2015 consultation document and during the analysis of the submissions received. The Reserve Bank agrees with some submitters who pointed out that an explicit materiality test could be consistent with the objectives. However, after reviewing the types of materiality tests that many other regulators have, the Reserve Bank continues to be of the view that an assessment based on similar test would be overly subjective and likely lead to a wide range of interpretations. The Reserve Bank therefore considered whether having an up-to-date and extensive “white list” would essentially serve the same purpose, as it would exclude functions that are not relevant for regulatory purposes, and prioritise both banks and the Reserve Bank’s resources to the types of outsourced functions that might be of concern. The Reserve Bank also believes that over time as entries on white list grow an implicit boundary on the definition of “outsourcing” will be created. 127. Option two will potentially have some limited efficiency costs compared to option one. Banks would be required to send in applications for outsourcing arrangements that are immaterial but not already on the list. However, as the “white list” will be live this should be an increasingly rare occurrence. Additionally, having a materiality test which is open to interpretation may not only undermine an outsourcing policy but also create efficiency costs. Some banks may take a conservative reading of a materiality test and send in unnecessary applications. The certainty of the “white list” avoids this. 128. Under option two, a bank would not have to apply the remainder of a revised outsourcing policy (beyond possibly recording them in a compendium and submitting a short form template for new or amended arrangements and entering into contracts with certain provisions). The Reserve Bank does not believe such requirements would be particularly onerous, given that banks generally already keep a repository for all their outsourced functions as part of their regulatory compliance frameworks, and both a compendium12 and form template would only require basic information. 129. By itself the “white list” does not extend the outsourcing policy, it provides clarification only. Contractual provisions 130. Given the importance of ensuring that outsourcing arrangements are robust and that arrangements made through the parents or a related party will remain available following a failure the Reserve Bank considered the option of requiring all outsourcing arrangements involving third parties address certain matters in their contracts. These matters include: a. a contractual provision to ensure continuing access to services on normal commercial terms to services when the bank enters statutory management; 12 Having a compendium is an option described below.

26 b. parallel rights for arrangements made through a parent or related party to ensure continuing access to the services where the bank is separated from its parent; and c. the ability for the Reserve Bank to have access to documentation and information related to the outsourcing arrangement. 131. The alternative option in this area would be having no explicit requirements in contracts of outsourced arrangements. 132. To some extent the option of requiring certain matters be addressed in contracts for outsourcing arrangements is a clarification of the current BS11 with its discussion on what is meant by “legal and practical ability to control and execute” However, BS11 is silent on what contractual terms should be included in outsourcing arrangements, leading to inconsistent practice across the industry. Some banks explicitly include terms that include the New Zealand subsidiary as a party to a contract in the event of separation from the parent (“parallel rights”) while others do not. 133. The importance of outsourcing arrangements being robust to failure of the bank or one of its related parties and the current inconsistent practices across industry are the two reasons that have contributed to the Reserve Bank preferring the option of requiring the above matters be addressed in all outsourcing contracts. 134. The Reserve Bank is also of the view that this option would have minor to no efficiency impact on banks affected by the outsourcing policy. In regards to a), the requirement that a service provider continue to provide the service in question to a bank if it enters statutory management is conditional on the bank continuing to pay for the service. Therefore, the contractual provision does not increase risk to the service provider and therefore should not affect the BAU rate charged to the bank. It merely avoids a common situation where contracts between banks and service providers have clauses to become void if a bank enters statutory management. 135. In regards to b), the incremental cost of this requirement would be increased legal costs to the bank for preparing additional or extended contracts. That is, where a banking group may have previously had a single contract with a service provider, a New Zealand subsidiary would be required to have a separate contract or (equivalently) have parallel rights to the service (in case of separation from the group) written into the original contract. The Reserve Bank has not heard any reason why matter b) would impact on a banking group’s ability to negotiate with a service provider as a whole. There will also be a five year transition path (discussed below) which will allowing banks to make many of the required changes to contracts at times when the contacts would have been up for re-negotiation anyway. Separation plans 136. Both the current BS11 and the revised objectives would require that a bank can separate from its parent following a failure event and continue to operate as a standalone entity. Therefore there is an existing implicit requirement that banks plan and prepare for the possibility of separation. The Reserve Bank considered whether the existing requirement should be made more explicit. 137. The separation plans would assist OBR, and work with the other likely requirements such as robust-back up arrangements, by requiring banks to set how they will separate

27 process from their parent banks as well as the timeframes in the event the parent banks fails, or that the New Zealand bank is separated from its parent. 138. Separation plan requirements would only apply to foreign-owned banks. Currently there are no New Zealand banks that are subsidiaries of other New Zealand owned banks but, if this were to change the Reserve Bank would have a full suite of powers over such a parent bank, which would include the power to direct the bank to continue to provide services. This reduces any need for separation plans in this case. 139. Separation plans would need to contemplate a range of scenarios such as OBR, wind￾down, sale, and not assume a particular form of resolution. This is to leave a full range of options available to authorities in a crisis. 140. The separation plan would be required to set out how the bank will, from the day of being placed into statutory management and indefinitely thereafter: a. execute its clearing, settlement and payment obligations; b. monitor and manage its financial risk positions; c. manage the operational responsibilities for the separation; d. ensure parallel rights for the New Zealand bank are available for functions outsourced through the parent or a related party; e. set out robust alternative arrangements for systems that are owned or controlled by the parent or a related party; and f. set out how the back-up capability will be switched over, including the timeframes for doing so. 141. Under the option for requiring separation plans, the plans should set out how all the outcomes of the outsourcing policy would be achieved, not simply the provision of basic banking services (set out below). 142. The Reserve Bank will require testing of the separation plan on an annual basis. For clarify this means once every 12 months, not once within a calendar year. 143. The preferred option is to require separation plans from foreign-owned Large Banks. There is some additional cost to banks in requiring them to fully document procedures they should be planning for anyway under the existing BS11. The extension of regulation here is the requirement that the Reserve Bank agree to a bank’s separation plan. This creates potential moral hazard but it should be mitigated by the further requirement that a bank have its board’s sign-off on their separation plans before submission to the Reserve Bank for agreement. How to ensure functionality continues after service disruption 144. Given the objectives’ focus on the ability of banks to provide basic banking services, and whether the outsourcing of particular functions may frustrate OBR or other resolution options, the Reserve Bank considered whether a revised outsourcing policy should prohibit particular core functions from being outsourced to a related party altogether. The two options that were considered were: • prohibiting the outsourcing of critical functions to a parent or related party; and

28 • no prohibition on outsourcing to a related party, instead banks would be required to have robust back-up arrangements in place for any key functions that are outsourced to a related party. 145. The Reserve Bank identified three examples of functions that may be appropriate to prohibit banks from outsourcing to the parent. These functions are: • the ability of a bank to calculate its financial position; • a bank’s access to SWIFT; and • a bank’s regulatory reporting. 146. The basis of these considerations is due to the fact that a number of banks are reliant on their parent for undertaking these functions. While some business continuity plan (BCP) work-arounds have been put in place for these functions by banks, many of these are focused on disaster recovery (DR) rather than parental separation and may not be a sustainable option in the immediate term. For example, many of the systems require manual entry of data rather than running it automatically. Now that OBR is a live-policy option it is worth considering whether banks should have the ability to undertake these calculations in-house. 147. The three functions listed above should be read as examples of key or core banking functions. What exactly is core to a bank will depend on the structure of its business (although the examples given may be core functions for all banks). The Reserve Bank would work with banks to determine what functions may be core for them and would regularly review these lists. 148. Prohibition of outsourcing core functions to third parties was not considered as such providers would be expected to provide DR and back-up capabilities. Banks would however still be expected to consider the risks of outsourcing to a third party and how to mitigate these risks (see for example the option on contractual provisions). 149. The current BS11 requires banks to not outsource core functions unless there is a proper back-up capability or substitutability. Therefore, arguably compliance costs associated with prohibition of core functions are not new if back–up capability or substitution is not possible. Nevertheless, this requirement would be an extension in the sense that there is currently no explicit list of functions a bank may not outsource at all. 150. The Reserve Bank is cognisant of the potential compliance costs for banks to establish new arrangements on those functions, and additional functions that would need to be re-established due to their connections with core functions. After discussions with banks, the Reserve Bank began to consider a second option where instead robust￾back up arrangements of any functions key to meeting the outcomes and that are outsourced to a related party would be required. Consistent with the current BS11 banks would be required to demonstrate they have legal and practical control and execute an outsourced function. 151. For the objectives and desired outcomes to be achieved under this option, functions that are related to the required outcomes would need to be robust and sustainable. Where a bank outsources a function to its overseas parent or a related party it will be required to have a robust back-up arrangement for these outsourced functions. Based

29 on submission feedback from the consultations the Reserve bank has defined this as follows (changes have been highlighted): • There is no capability to permanently lose transactions. The timeframe on what is meant by “permanently” will be consulted as part of the exposure draft. • The switch over would be expected to be delivered within 4 – 6 hours and a bank must be able to meet its obligations under OBR including settlement – for functions related to outcomes (a), and (b) (plus (e) to the extent that it is applicable). • The switch over would be delivered before 9am the day the bank is due to reopen (i.e. the value day after being placed into statutory management) – outcomes (c) and (d) (plus (e) to the extent that it is applicable). • The contingency arrangement is sustainable, in that it could be deployed as the primary mechanism, on an on-going and fully automated basis, to deliver the outsourced function with minimal impact and disruptions to both the bank’s customers and the bank’s own business operation. • Testing is conducted on an annual basis in a live simulation environment that mirrors the live environment to ensure that the back-up arrangement will work as intended. Separate to this, banks are required to ensure that changes made to the live environment will also be made in the simulation environment. • External review is conducted at least every three years to ensure the arrangement remains robust. However, an annual external review is required during the five-year transitional period. • The bank must have direct ownership and/or control over the standby system. This does not necessarily mean that the system needs to be located in New Zealand, but that the NZ locally incorporated bank should have the legal and practical ability to control the standby system (i.e. that they own the system and/or have a direct relationship with the third party provider for that system and the data that is required to use it). This backup arrangement cannot be provided by a parent or a related party of the parent. 152. While the back-up capability requirements have certain timeframes set around them to ensure that a bank will be able to reopen at 9am the day after being placed into statutory management, it is important for banks to recognise that these timeframes do not affect the timeframes for OBR and banks must ensure that they can meet the requirements of that policy. 153. However, the Reserve Bank will also consider alternative arrangements to the back-up capability requirements where a New Zealand bank has an arrangement with a related party that is not the parent bank or a related party of the parent. In considering these arrangements, the Reserve Bank will look at matters such as: • whether the New Zealand bank has legal and practical control over the arrangement; • whether the parent, another related party, or any overseas authorities may be able to frustrate the arrangement;

30 • the relationship between the New Zealand bank and the related party; • what functions or activities the related party will be undertaking on behalf of the New Zealand bank; and • whether the related party will also be providing services to any other related parties. 154. For arrangements with independent third parties banks will be able to rely on the robust DR/BCP requirements provided by the independent service provider. 155. In the second consultation paper, the Reserve Bank proposed banks being required to make switch overs to back-up systems within sixty minutes. However, in discussions with banks it became apparent that a shift away from a one hour switch-over would significantly reduce banks associated compliance costs. The banks’ feedback also indicated that having longer than four hours to switch systems would not yield further significant cost reductions. The Reserve Bank is of the view that achieving outcomes (a) to (c) within four to six hours and outcome (d) by nine a.m. the next business day would sufficiently minimise disruption to the banking system while keeping compliance costs relatively low. 156. Banks that have agency arrangements for their SWIFT capability with independent third party banks are still able to continue to rely on these arrangements. 157. The general ledger, regulatory reporting and SWIFT capability is not an exhaustive list of what functions that Reserve Bank may require robust back-up arrangements for. Other functions that require equally robust back-up arrangements will be identified during the implementation phase with banks. It is also conceivable that there are functions for a particular bank where a standby arrangement is not feasible or would expose the bank to too much risk in terms of it being able to operate on a standalone basis. Therefore, under this option, there may still be some circumstances where a bank may be required not to outsource that particular function. It is likely that arrangements with independent third parties would be acceptable. 158. Several banks raised concerns about lost cost efficiencies for both the prohibition and robust-back up proposals. On prohibition, some banks argued that the requirements would force them to forgo any potential future cost efficiency gains from using their parent’s system. Although no examples were provided, we agree that this is a distinct possibility. However, under normal business conditions New Zealand banks would still be able to access the expertise housed with their parent banks, which limits potential efficiency impacts. Also, if a parent’s system was improved, under normal business conditions the New Zealand subsidiary would still access the associated benefits. The costs of having back-up arrangements available to be able to operate independently are more of a set or fixed nature. 159. Overall, the preferred option is to require robust back-up arrangements. It would provide a more cost-efficient way to achieve the outcomes and objectives. During the implementation phase of the new policy the Reserve Bank will work with banks to develop a list of functions that require robust-back up arrangements. These functions will differ somewhat among banks.

31 Policy threshold 160. As discussed above, the current outsourcing policy applies only to all locally incorporated banks whose New Zealand liabilities, net of amounts due to related parties, exceeds NZ$10 billion. At the time the original outsourcing policy was introduced it was focused on “systemically important banks” given that they presented the greatest risk of causing significant damage to the financial system if they failed. 161. Since the introduction of BS11 in 2006, the Reserve Bank has implemented the OBR policy. The threshold for OBR is lower, applying to any locally incorporated bank with retail funding over NZ$1 billion. This threshold reflects the fact that smaller institutions would likely benefit from pre-positioning on the grounds that a more orderly resolution of a failure event is preferable even in scenarios where systemic concerns are limited. There could be cases where a small bank has a strong position in specific markets, or where it is concentrated in a particular region. In such circumstances there may be a need for the bank to continue to provide basic banking services when placed under statutory management as it is unlikely that all existing customers would be able to immediately develop relationships with other banks. 162. Therefore, the Reserve Bank considered two options for the threshold. Option one is to maintain the status quo. This approach would continue to focus on systemically important banks, being those banks that present the greatest risk of causing significant damage to the financial system if they were to fail. The existing threshold currently applies to the five Large Banks. 163. Option two would be to lower the threshold to any locally incorporated bank with retail funding above NZ$1 billion. This would align with the threshold for OBR pre￾positioning, and would extend the boundary of the outsourcing policy to include five further banks. 13 This approach would require that all banks captured by the OBR policy were capable of continuing to provide basic banking services, beyond simply providing access to unfrozen funds, and would ensure that authorities and the statutory manager retain access to the full suite of potential options in an OBR event. 164. A third option would be to retain the current threshold but subject all locally incorporated banks to BCP requirements to ensure the continuity of services as well as the contractual terms set out in the paper. This acknowledges that the degree of intervention should be proportionate to the size of a market failure. There may be outsourcing externalities associated with smaller banks but they will represent smaller risks therefore justifying less intervention. To subject all locally-incorporated banks to the full suite of the outsourcing policy may have serious effects on efficiency as it could become an effective barrier to entry. 14 165. The Reserve Bank’s preferred option is option three. The current threshold would be retained under a revised policy and the Reserve Bank will consult on BCP requirements for all locally-incorporated banks next year. If a BCP policy is put into place some aspects of a revised outsourcing policy may be migrated over. 166. In terms of BS11, however, there is no increase in regulation from this option. 13 Co-op, Heartland, Rabobank NZ, SBS and TSB. 14 Arguably the $10 billion dollar threshold is a barrier to becoming a Large Bank. However, it is a much smaller barrier to entry than a $1 billion threshold particularly given that some regulatory compliance costs for banks will be fixed. It is also not obvious that there would be significant welfare differences in having multiple smaller banks compared to fewer larger ones.

32 The level of service a bank should be able to provide after a failure-event 167. The Reserve Bank considered what level of service a bank should be able to provide the day after a failure event (whether that failure be of an outsourcing arrangement directly, the bank, a related party to the bank, or some combination of all three) and indefinitely afterwards. That is, what should “basic business of a bank” or “basic banking services” in the objectives and outcomes refer to? Three options were considered. The first two were: 1) liquidity only; and 2) full service. A third option was for the Reserve Bank to develop its own definition and criteria. 168. On the first option, objectives (a) and (b) suggest that the ability of a failed bank to continue provide and circulate liquidity is the bare minimum required to ensure soundness and efficiency are promoted. What is meant by continuing to provide and circulate liquidity is that existing customers can continue to use existing transactional accounts and credit lines.15 The knock-on effects of a bank failure would be significantly higher if existing customers lose access to their accounts. Customers to the bank may not be able to conduct other transactions leading to other persons having liquidity problems and meaning transactions that would have taken place in the real economy cannot. 169. The ability of a bank to re-open the day after a failure for the purposes of providing access to at least part of customers transaction accounts and existing credit lines (and pre-existing knowledge among the public that this is possible) likely reduces probability of future bank runs. 170. However, the provision of liquidity may not be enough to sufficiently minimise the negative impacts of a failure event. First, if a bank is only able to provide liquidity after a failure event and no other services, this significantly reduces its franchise value. This increases the probability of the government facing costs from resolution or liquidation of the bank. Second, the exit of a bank, especially a large bank, could have long-term economic efficiency implications. Competitive pressures and incentives to innovate would be reduced. Exit of the bank is more likely if significant time and monetary investment would be needed to return the business to a going concern. Third, for some customers there may not be a substitute bank for particular services. This may be due to geographical concentration of the failed bank or its previous dominance in particular markets. This again could mean significant economic losses beyond just the effect of customers losing access to their deposits. 171. The shortcomings of the liquidity-only option suggest that perhaps the Reserve Bank should require banks to be prepared to continue to offer a full range of services the day after a failure event. Indeed, if a bank can continue to fully operate the day after failure, its full franchise value would be preserved and any efficiency effects would be likely minimised as the bank would be more likely to continue as a going-concern. A full range of resolution options is preserved. 172. However, there may be little benefit to soundness and efficiency for some of the services that would be provided by a full service bank post failure, at least relative to the costs the bank would incur to be able to provide them. One example is the ability to offer sophisticated products to institutional customers. The Reserve Bank would expect banks to give institutional customers access to their transactional accounts and other basic products following the use of OBR.16 However, the continued offering of 15 Of course under OBR customers may only have immediate access to a portion of their accounts. 16 There is no distinction between types of customers under the OBR policy.

33 other bespoke services is not required given that institutional customers are likely to have relationships with other banks. 173. It may also be reasonable that banks are not required to offer services to new customers post a failure event. This would reduce the costs of complying with the rest of the policy proposals for them as they would not need to strengthen arrangements for outsourced product approval services to the same extent. 174. In considering what services are essential to promote soundness and efficiency post a failure event while minimising unnecessary compliance costs, the Reserve Bank developed its own definition of basic banking services as a third option. Under this option basic banking services are defined as: “The key retail and business services that bank customers typically rely on, where the disruption or sudden discontinuation of the function would be likely to have a material negative impact on a significant number of third parties that rely on such services and lead to contagion effects, including significant adverse effects on market confidence.” 175. In determining whether a service should be classified as a basic banking service, banks would need to assess how critical the provision of the service is to its end customers, taking into consideration the following: • what elements of the customers’ operations would be affected; • the knock-on effects of this disruption to other customers, suppliers, counterparties, etc.; • the speed at which disruption would have an impact; • the speed, costs and hurdles of substitution; and • the expected willingness and ability of the other banks to provide the services of a failing bank. 176. The Reserve Bank put together a list of services considered to constitute basic banking services. Given the different ways banks arrange their business the Reserve Bank focused on the types of services and not the types of products when it comes to specifying what constitutes basic banking services. The following services are considered to fall under the definition of basic banking services: • Transactions accounts or similar products used by individuals and businesses for their transactional, every day banking needs. A bank must be able to continue to provide ATM services, given the importance of cash in times of a crisis, e.g. a major earthquake. In addition, customers should be able to access their accounts through at least two other of the most commonly used channels. • Savings accounts and term deposits accounts, which are usually held by individuals and entities who also engage in transactional banking. These deposits are either on-call or mature on a regular basis and are an integral part of individuals and businesses’ common banking needs. • Lending services to individuals and businesses, such as credit cards, overdraft facilities, revolving credit facilities, existing mortgage commitments (including pre-approvals) and mortgage facilities.

34 • Account activity reporting for the relevant accounts individuals and businesses hold. • Payments, clearings and settlement services, such as credit card/merchant acquiring services and agency arrangements (including financial market infrastructure (FMI) access for smaller banks). 177. The Reserve Bank’s preferred option is option three. The provision of liquidity only by a failed bank does not go far enough in limiting the potential impacts on the rest of the economy. However, requiring full service may go too far as there are some services where there would be little impact for customers to switch banks, particularly in regards to accepting new customers. 178. The definition of basic banking services provides clarification of the Reserve Bank’s expectations in regards to providing customers with access to payment facilities and the intent of the OBR policy and therefore does not represent an extension of the policy. 179. Submitters to the Reserve Bank’s second consultation were supportive of the majority of the proposed basic banking services. Although banks noted that their service offerings post parental separation would be more akin to smaller, domestic focused bank given the likelihood of some degree of customer attrition. The Reserve Bank made some changes the definition of basic banking services based on submitter feedback including the removal of requirements to provide existing bank customers new foreign currency transactional and savings accounts and term deposits, as well as trade finance and letters of credit. The Reserve Bank expects that existing arrangements for these products will be run-off. The Reserve Bank is also likely to require banks demonstrate they can migrate transactional accounts for institutional customers offer to systems used for retail and small-to-medium enterprise banking. Banks will not be required to continue to provide bespoke services for institutional customers but they must provide robust definitions of what these services are. Compendiums 180. If a bank were to fail and be placed in statutory management, it is imperative that the authorities and the appointed statutory manager understand what functions and processes have been outsourced by the bank. This information will need to be provided rapidly as some outsourcing arrangements may relate to time-critical functions. 181. Therefore, the Reserve Bank considered whether banks should be required to keep formal records of all outsourced functions. Such compendiums would include basic factual information about each outsourced functions. This information would include: • the name and locations(s) of the service provider and the value and expiry or renewal date of the contract; and • an overview of the function or system that has been outsourced. 182. Under this option, the Reserve Bank would require an affected bank to update their compendium within twenty working days of an outsourcing arrangement being entered into or modified and that the bank has the processes in place to ensure this takes place. The Reserve Bank would also require a bank’s compendium be subjected to

35 internal audit once a year, and that the compendium is maintained in a form that can be shared with the Reserve Bank again at least once a year. These requirements would be imposed by using a CoR along the lines of: That the registered bank has appropriate processes in place to maintain a compendium of its outsourcing arrangements in a form that is available to be sent to the Reserve Bank on request, and that include, in particular — a) Arrangements for the compendium to be updated within twenty working days of an outsourcing arrangement being effective; and b) Annual review of the compendium by the bank’s internal audit function to ensure it is up to date. 183. In the consultations banks generally supported the compendium idea but some do not want to see it implemented using a separate CoR. A CoR for the compendium would mean directors of the bank would have to attest that banks have in place the process to meet the relevant requirements. Some banks worried that a CoR for the compendium would lead to breaches of CoR of a technical and trivial nature. This appears to be an over-interpretation of the proposed requirements. The current drafting of the CoR emphasises that banks have appropriate processes in place. A situation where a bank has not entered a few contracts within twenty working days would not necessarily result in the bank being in breach of this condition. 184. Submitters to the consultations also felt that the Reserve Bank initial proposal that banks send the Reserve Bank revised versions of the compendium after each update and quarterly internal audit were too burdensome. On reflection, the Reserve Bank believes a less restrictive version of the compendium requirement can meet the objectives. Under normal supervisory practice the Reserve Bank envisages requesting each bank’s compendium once a year. Banks would be required to have the compendium audited annually once a year as well. 185. The obvious alternative option to requiring a compendium would be to not do so. One argument as to why banks should not be required to maintain compendiums is that banks already keep track of their outsourcing agreements, and at least two Australian￾owned banks already maintain compendiums. 17 However, the Reserve Bank believes that requiring compendiums, and setting out how they should be maintained, is not particularly onerous for banks (and the fact that some banks already voluntarily have compendiums of outsourced arrangements confirms this). This requirement is common in other jurisdictions. 186. The Reserve Bank’s preference is to require compendiums be maintained by affected banks. A compendium may mean the bank can return to providing basic banking services sooner. Compendiums could also help banks’ management and Board manage and monitor BAU outsourcing risks. They will also help the Reserve Bank identify concentration risk and ensure consistency of application of the outsourcing policy among banks. 17 Additionally, advanced internal ratings-based approach (AIRB) banks maintain compendiums in respect to their credit models; and so have a regulatory compliance framework in place that supports regular maintenance and reporting to senior management and the Board.

36 Options for the transition period 187. In the August 2015 consultation paper the Reserve Bank proposed that banks have six months to plan for compliance with a revised policy, with a further two years to become compliant for the new policy. While some submitters to the first consultation supported the proposed timeline, some banks suggested that due to the complexity of the policy proposal that they would need longer to become compliant ranging from five to twenty years. 188. In deciding what the timeframe for banks to plan for and become compliant with a revised policy the Reserve Bank is trying to strike the right balance between risks and efficiency. Allowing longer timeframes to become compliant may allow compliance costs to be reduced but also increases risks to the soundness of the financial system given that it will take banks longer to meet the proposed outcomes and therefore the objectives. 189. The Reserve Bank’s preferred option is for a five-year transition as consulted on in the 2016 consultation paper. Given the potential complexities with complying with the new policy a five year transitional period for compliance is desirable. It will allow banks to take make use of their normal technology cycles (make changes to systems at times when the systems would be replaced anyway). COST-BENEFIT ANALYSIS (CBA) 190. The qualitative analysis above makes the case for the benefits from the proposed option (of clarifying and revising the existing outsourcing policy). The purpose of this section is to provide a quantitative (or monetised analysis) of costs and benefits of the preferred policy option. In doing this analysis, the Reserve Bank has had to rely on the cost estimates submitted by the affected banks. Given the strong support the outsourcing policy provides to OBR, the approach adopted in the following CBA builds on the Reserve Bank’s 2012 RIS that accompanied the OBR policy.18 191. Before proceeding with the CBA, it is worth pointing out a few qualifiers. As with any CBA, there are costs and benefits that do not lend themselves to quantification. Only those costs and benefits that are quantifiable are captured in this RIS. Second, in order to make quantification possible, the Reserve Bank has had to make a number of assumptions. The Reserve Bank has made these assumptions transparent and believes that they are appropriate to use for this purpose, not least because they err on the side of caution. Sensitivity analysis is used to test the robustness of the assumptions and of the cost estimates. 192. The Reserve Bank notes that a CBA of an outsourcing policy is inherently difficult and the quantitative net benefit should be taken as indicative only, rather than as a literal point estimate. It appears that a quantitative CBA of an outsourcing policy is also somewhat unusual. To the best of the Reserve Bank’s knowledge, there is no publicly available CBA of any other jurisdiction’s outsourcing policy. 18 http://www.rbnz.govt.nz/-/media/ReserveBank/Files/regulation-and-supervision/banks/policy/5014272.pdf?la=en

37 General approach to CBA 193. The main benefit from a properly implemented outsourcing policy is that is makes OBR a viable and credible policy option in a bank failure situation. The net benefit of the OBR policy was calculated to be $1,294.5 million in the 2012 RIS. That RIS did not consider the costs of the existing outsourcing policy given that the existing policy had been in place since 2006 and the Reserve Bank believed it was being properly implemented. As discussed above, the 2014 outsourcing stocktake showed that this belief was not correct. 194. There are two approaches that the Reserve Bank took to undertake a CBA of the outsourcing policy. Both approaches make use of the 2012 RIS’s CBA (updated for changes in any relevant variables) and adjust the calculated net benefit from OBR by including the costs related to the revised outsourcing policy. The reader should be aware that the Reserve Bank has had to make some assumptions in the CBA presented here. Instead of interpreting the resulting cost estimates as accurate point estimates, it would be better to understand them as illustrating a range. Indeed, there are reasons to believe that the true resulting costs could be below the range of costs estimated in this CBA. 195. The Reserve Bank uses two approaches, giving a low and a high cost estimate. The first approach relies on an assessment of the cost estimates provided by industry that focuses only on those costs that banks have to incur because of the revised policy. Any costs that are not due to the new policy, for example costs that arise because of system changes banks are already putting in place or were going to put in place anyway, changes that are not required as a result of the new policy, or costs that a bank should not have to incur at this stage given that the current outsourcing policy has been in place since 2006, are eliminated from this cost calculation. Under this approach, bank costs of the outsourcing policy are estimated to be $550 million in NPV terms and the expected net benefits of the outsourcing policy are approximately $2.2 billion in NPV terms. This cost estimate is equivalent to approximately 2.8 percent of industry profits over the last five years. 196. The second approach takes all costs banks have submitted, irrespective of whether they result directly from the revised policy or not, and adds them up. Insufficient data meant that a small assumption had to be made regarding on-going compliance costs for industry. This approach yields an industry cost estimate of $870 million in NPV terms ($ 670m capital costs and $ 200m in on-going costs). This would reduce the expected net benefits of the outsourcing policy to approximately $1.9 billion in NPV terms. This cost estimate is equivalent to approximately 4.4 percent of industry profits over the last five years. 197. Arguments can be made for both approaches; however, the Reserve Bank believes the true industry cost figure is likely to be towards the lower end of the $550-$870 million range. In fact, due to the conservatism built into the calculations, and the availability of more cost efficient compliance options that some in industry refer to as business solutions, there is reason to believe that industry costs could turn out to be significantly lower.

38 198. The next sections provide more detail as to how this cost range of $550 to $870 million has been calculated. They start with a brief overview of the 2012 OBR RIS and its key assumptions. That is followed by a discussion of the cost estimates the Reserve Bank received in the two rounds of consultation and in the numerous meetings it held with stakeholders. The final section updates the 2012 OBR RIS and calculates an updated net benefit that takes into account the revised outsourcing policy and other developments since 2012. OBR cost benefit estimation 199. The benefit from OBR is represented by the reduction in the cost of a bank failure compared to a world in which OBR is not available. In 2012, this produced an expected net benefit in NPV terms of $ 1,294.5 million. A full explanation of what this net benefit is based on is available in the 2012 RIS. Here we set out its key features and underlying assumptions. Table 3: Expected costs of a banking crisis (2012 assumptions and inputs) ($ million) Factor OBR not available OBR available Difference Economic cost 5,492 4,764 7,28 Bailout cost 1703 693 1010 Government debt service cost 413 172 241 Bank funding cost 282 936 -653 Maintenance cost 0 10 -10 Build cost19 0 20 -20 Overall expected NPV 1,294.5 200. Economic cost represents the cost of a serious bank failure on economic growth and the resulting GDP loss. As a simplifying assumption, the underlying model for the CBA assumes there is a single bank (or equivalently the banking system is homogenous). Therefore, there is no distinction between a bank failure and a banking crisis. However, to make the model equivalent to a heterogeneous banking system one could scale the costs and benefits by the proportion of banks in a failure situation.20 Especially since 2008, there have been a number of estimates – by academics and supranational bodies – of the GDP impact of a banking crisis. These range from 10-20 percent of GDP to over 100 percent of GDP. This wide range is largely due to the assumption made as regards the return to trend growth. If one takes trend growth as the average of the period immediately prior to a banking crisis, one tends to get a higher GDP loss estimate. However, since that GDP growth might have been unsustainably high, a lower figure for long term trend growth would be a better and more cautious estimate. The Reserve Bank’s GDP central cost estimate 20 percent of GDP. A higher GDP cost estimate would produce a higher benefit from OBR, thus making this a conservative assumption. 19 Costs specific to OBR pre-positioning. 20 The sign on the expected net benefit outputted by the CBA will be invariant to such scaling.

39 201. Another key assumption concerns the probability of a bank failure. Empirical data from the Basel Committee on Banking Supervision (BCBS) member countries suggests that the long term probability of a bank failure in any given year is about 4 to 5 percent.21 The Reserve Bank does not believe that this accurately reflects the risk of a bank failure in New Zealand. Instead, the analysis assumed a probability of 0.75 percent, or once every 133 years. The lower the probability, the lower the expected benefit from OBR. 202. The next key parameter is the cost of bailing out foreign creditors. It should be stressed that only foreign creditors are relevant here. A bailout from the New Zealand taxpayer to New Zealand creditors would be a transfer payment and therefore not relevant to an overall economic welfare analysis, assuming no transaction costs or other distortions. However, a bailout of foreign creditors represents a transfer payment from New Zealanders to foreigners, and therefore is welfare-reducing to New Zealand. 203. The parameter “Government debt service cost” captures the effect on government borrowing costs that could occur following a bailout. It is assumed the money to fund a bailout would be borrowed offshore22, resulting in an additional external debt burden going forward with a marginal increase in the government’s borrowing rate to reflect the risk associated with an increase in indebtedness. This creates a benefit of OBR in the model due to reduced probability that bailout will be adopted as the policy response when OBR is a feasible alternative. 204. The 2012 OBR RIS noted that there had been no observable increase in bank funding costs that can be directly associated with the implemented of the OBR policy. However, theory suggests that banks’ funding costs should increase slightly to reflect the increased expected losses being borne by investors due to lower probability of bailout and a higher chance of losses under OBR. This is modelled by making a judgement on the increased expected losses that investors might face as a result of the lower probability of bailout, which can be expected to be priced into bank funding costs and captured by the parameter “Bank funding cost”. 205. In any bank failure, there are a number of options the relevant authorities can draw on in finding a resolution. In practice, it will not be known ex-ante whether any given option will be successful of not. For example, in a particular failure event a bank may only need a single taxpayer bailout to be able to continue as going concern indefinitely. Alternatively, a single bailout of this bank may not be enough and further intervention (possibly additional bailouts) may be required at some later date. At the point when authorities decide whether or not to use a bailout strategy they are likely to, at most, only know the probabilities of either of these two scenarios playing out. Indeed, for both bailouts and OBR, authorities will face entire distributions of possible outcomes (in terms of ultimate costs) ex-ante. More complex models could account for this, but for simplicity, only binary distributions are considered in this model (although this 21 Basel Committee on Banking Supervision (2010) ‘An assessment of the long-term economic impact of stronger capital and liquidity requirements’ http://www.bis.org/publ/bcbs173.htm , accessed 24 November 2016. 22 The base scenario assumes a very small increase of 0.5 basis points. Adopting a higher figure would have the effect of increasing the benefit of implementing OB under the model.

40 simplification does not meaningfully change any results). I.e. there is a probability of a “good” bailout and probability of a “bad” bailout. Similarly there is a probability of a “good” OBR and “bad” OBR. The prototypical “bad” and “good” bailouts are as described above. The prototypical “good” OBR would be where it forms part of a successful resolution strategy thereby limiting recourse to taxpayers and the systemic effects of the bank failure. The prototypical “bad” OBR may be when it fails to stem the crisis (i.e. there is still a run on the bank when it re-opens the following day). 206. There are other options for resolving a failed bank too. Without OBR, the options comprise a market recapitalisation, a good bailout, a bad bailout and statutory management. OBR adds two more scenarios: “good OBR” and “bad OBR”.23 The following table, taken from the 2012 OBR RIS, shows the judged probabilities for each of the resolution options and their respective GDP impacts. Table 4: Crisis resolution options Outcome Probability GDP impact (%)24 No OBR Market recapitalisation 0.30 12.5 Bailout (Good) 0.20 17.5 Bailout (Bad) 0.40 20 Statutory management 0.10 25 With OBR Market recapitalisation 0.40 12.5 Bailout (Good) 0.15 17.5 Bailout (Bad) 0.10 20 OBR (Good) 0.275 20 OBR (Bad) 0.075 25 207. The reduction in economic cost when OBR is available is largely driven by changes to two probability parameters. OBR reduces the probability of a bad bailout by offering decision-makers another option that can be used to avoid such a costly scenario. Secondly, OBR increases the probability of a market recapitalisation – the least cost outcome for society. The availability of OBR provides investors with a heightened incentive to recapitalise a distressed bank as the probability of a bailout being used is reduced. 208. At the same time, OBR reduces moral hazard and provides banks with an incentive to act more prudently. This reduces the probability of a crisis. The Reserve Bank’s modelling reflects this by reducing the probability of a crisis by 0.05 percent from 0.75 to 0.7 percent when OBR is available. 23 In reality, there would be entire distributions of possible outcomes for when there is a bailout or OBR is used, not simply “bad” and “good” outcomes. A more complex model could account for this, but it would not meaningfully change the results of the exercise. 24 The model multiplies the economic cost of a failure by a factor which is intended to reflect society and government’s risk aversion, whereby increased protection against deep economic downturns can be seen as a form of insurance which society is prepared to purchase even when the premium exceeds the expected dollar payout because of the risk reducing impact of those payouts. Worse outcomes are multiplied by a higher factor as they represent more disruptive events. This is consistent with the revealed preference in the New Zealand life insurance market where average premiums are over twice expected payouts to policyholders for low probability but high impact events.

41 209. As mentioned above, when the Reserve Bank undertook this analysis in 2012 it was assumed that the outsourcing policy was being fully understood and correctly applied. Without an outsourcing policy that allows banks to operate independently when in distress, the viability of OBR as a resolution option is undermined. 210. Banks will have to incur costs to correctly apply the revised outsourcing policy. This is the topic of the next section. Costs of the proposals 211. The Reserve Bank stressed the importance of reliable and detailed cost estimates from the beginning of the policy consultation process. Banks submitted high-level cost estimates in the first round of consultation that ranged from $10 million to $400 million in upfront (capital) costs and up to $60 million on-going (annual) costs. The estimates were useful input for helping Reserve Bank consider how to reduce compliance costs for the proposals. However, the following are reasons why Reserve Bank believed the true compliance costs would likely be lower than what some banks stated: • Some banks included the costs of in-house functions which were not included in the list of prohibited functions in the August 2015 proposals. The rationale was that if some currently outsourced services are required to be brought back in￾house under a new BS11, then it is more cost effective for them to also bring back other outsourced functions not captured by the prohibition. In the Reserve Bank’s view, such additional costs are due to business decisions previously taken that may not always have been aligned with the policy intentions of the current outsourcing policy and that they are therefore not regulatory compliance costs. • Some banks also appeared to have assumed that some functions would be brought in-house and did not consider potentially more efficient third-party solutions. • At least some of the cost estimates appeared to be gross cost estimates rather than costs net of benefits. For example, some banks, when they considered the policy would require them to in-house functions currently provided by their parent, did not account for the reduced fees they would then pay to their parent.25 To the extent that there are currently marginal costs to the parent for providing these services to subsidiaries reductions in fees should be included in net cost estimates. • Most cost estimates were at a high level and could probably be reduced following a more granular assessment of the requirements. • The estimates appeared to include the costs of arrangements that are already captured under the current BS11 or OBR policies. 25 All cross-border transactions between associated parties for services are for tax, and other regulatory compliance, purposes on an arm-lengths basis.

42 212. Most banks revised their cost estimates in the second round of consultation. While there was some more detailed breakdown of cost estimates, most remained at a high level, with one bank in discussions with the Reserve Bank describing theirs as “orders of magnitude” that included some conservative assumptions because IT projects tend to have cost overruns. Estimates of upfront costs now ranged from $10 million to $300 million and estimates of on-going costs from $12.75 million to $52 million. 213. One bank submitted a more granular breakdown of its costs, making theirs the most useful cost estimate. The two banks that sent in the least granular estimates were also the two with the highest cost estimates. 214. Most cost estimates made it difficult for the Reserve Bank to determine what functionality or systems the suggested costs related to. This complicated the Reserve Bank’s analysis because it was often not possible to tell what proportion of the cost estimates related to true incremental costs of the proposed changes to BS11. 215. The Reserve Bank had its judgements on banks’ cost estimates verified by external IT and banking consultants. The consultants equally struggled to obtain a better understanding of banks’ cost estimates given their high-level nature. However, similar to the Reserve Bank’s observations, the consultants confirmed that the majority of banks’ cost estimates seemed to be due to misinterpretation of the existing BS11 and were therefore not new, incremental compliance costs. The consultants also observed that banks’ estimates were overly focused on technical solutions and did not consider more efficient business solutions that may exist. An example of such a business solution may be a restructuring of arrangements with a parent so that the New Zealand subsidiary has full legal and practical control of the service. 216. As mentioned, one bank did provide a fuller breakdown of their cost estimates that set out what individual systems would be affected alongside the associated upfront costs. This allowed the Reserve Bank to look at each of these system changes individually and determine whether or not they represented costs that are incremental to the policy proposals or something that the bank should have already been doing. 217. A large fraction of the costs the representative bank included were for functions it would not be required to provide under the new policy. Additionally, the bank attributed some of its cost estimate for complying with the revised BS11 to systems and functions it had previously begun work on for compliance with the existing BS11 policy (and to the best of the Reserve Bank’s knowledge this work started before the review of BS11 began). 218. Eliminating those costs that relate to systems not required to be amended due to the policy proposals leads to a significantly lower cost estimate for this bank. In doing so, the Reserve Bank made conservative assumptions. If it was not clear whether a system was covered by the policy or a cost was new, the Reserve Bank erred on the side of caution and included those costs. 219. This approach led to that particular bank’s upfront cost estimate being reduced by 65 percent. The bank did not provide a breakdown of its total on-going costs but the

43 Reserve Bank thought it would be reasonable to scale the estimate of on-going costs by the same factor, i.e. a reduction of 65 percent.26 220. To the extent that the Reserve Bank was able to carry out similar analysis on other banks’ cost estimates the results indicated that it would be reasonable to apply similar reductions. Similar to the representative bank, other banks appear to have included costs for functionality outside the scope of the revised policy or for functionality that they themselves stated was for meeting existing BS11 obligations. 221. Given that the bank that provided the better breakdown is fairly representative of the sector, its incremental compliance costs were taken as representative for the other affected banks, too. Hence they were multiplied by five. Using this kind of extrapolation gives a NPV figure of $550 million for the costs to industry as a whole.27 There is significant conservatism built into this approach since two of the banks’ cost estimates were significantly below those of the other three banks. 222. One could argue that when extrapolating the revised cost figures of the representative bank to the other banks one might want to scale them for differences in size (e.g. if a bank has say a balance sheet higher or lower than the size of the representative bank, one should scale the estimate accordingly). It was found that this would not change the overall conclusions industry estimate. It should also be noted that much of the outsourcing policy costs are likely to be of a fixed nature and may not vary greatly by balance sheet. 223. The Reserve Bank further assumed that the upfront costs for banks would be evenly spread over the five-year transition period and used a discount rate of 0.0628. Furthermore, and again to err on the side of caution, it was assumed that banks would incur the full on-going costs immediately (which is conservative). 224. This industry cost estimate of $550 million in NPV terms compares with an estimate of costs by banks of around $870 million calculated under the second approach. This consists of approximately $670 million in upfront costs and a $200 million allowance for on-going costs. Due to the lack of reliability and detail on the two widely differing on-going cost estimates that were submitted, the Reserve Bank had to make an assumption to reflect a compliance cost figure in NPV terms. The Reserve Bank’s reasons for questioning the reliability or accuracy of some of these high-level cost estimates are stated above. Nevertheless, the Reserve Bank acknowledges that banks view the revised outsourcing policy as having significant cost implications. The sensitivity analysis around the Reserve Bank’s central net benefit scenario includes a high end estimate of costs based on banks’ estimates taken at face value. 26 The scaling factor is 0.3541 27 To calculate the net present value of costs the following formula was used: 𝑁𝑁𝑁𝑁𝑁𝑁 𝑝𝑝𝑝𝑝 𝑝𝑝 𝑒𝑒 𝑣𝑣𝑣𝑣𝑣𝑣𝑣𝑣 𝑜𝑜𝑜𝑜 𝑐𝑐 = $550 𝑚𝑚𝑚𝑚 𝑚𝑚 = 5�1 5 𝑟𝑟 𝑐𝑐 1.06𝑡𝑡 𝑡𝑡=4 𝑡𝑡=0

• 5 𝑟𝑟 𝑜𝑜 𝑜𝑜𝑜𝑜 𝑜𝑜 𝑐𝑐 0.06 28 Treasury’s suggested default discount rate as of October 2016. Source: http://www.treasury.govt.nz/publications/guidance/planning/costbenefitanalysis/currentdiscountrates , accessed 24 November 2016.

44 225. Arguably, the Reserve Bank should have revised the $870 million figure downwards to account for the inclusion of out of scope systems/functionality in banks’ cost estimates. However, it was decided to make as few adjustments to the numbers as possible given the inconsistency in the level of granularity of banks’ estimates and to calculate a conservative upper band of the range of cost estimates. Amendments to the 2012 OBR Cost-benefit Analysis 226. The Reserve Bank re-estimated the 2012 OBR CBA, however this time including industry’s full cost estimate of $870 million in NPV terms. Other inputs into the model were also updated with 2016 figures. This includes for example: New Zealand GDP, the amount of Government debt and the total size of New Zealand banks’ balance sheets. These changes affected the model outputs such as the economic cost (described above) of a banking crisis with and without OBR and therefore the estimated net benefit of OBR being feasible. Another critical change was to use a discount rate of 0.06 within the model rather than the 0.1 figure used in the 2012 estimation. This is consistent with Treasury guidance for CBA. The Reserve Bank also used it for calculating its estimate of industry costs.29 227. The revised OBR CBA produces a point expected net cost estimate of $2,181 million in NPV terms. Table 5: Cost of a banking crisis with high end estimate of costs ($ million) Factor OBR not available OBR available Difference Economic cost 11441 9926 1516 Bailout cost 2778 1122 1655 Government debt service cost 968 403 565 Bank funding cost 418 1386 -968 Maintenance cost 0 17 -17 Build cost Additional outsourcing cost 0 0 20 870 -20 -870 Overall expected NPV 15605 13744 1861 228. If instead banks’ cost estimates are adjusted to eliminate those costs that are unambiguously not required by the policy and discounted (using the extrapolation method explained above) the industry cost estimate falls to $550 million. This increases the estimated net benefits to $2181 million. 29 http://www.treasury.govt.nz/publications/guidance/planning/costbenefitanalysis/currentdiscountrates

45 Table 6: Cost of a banking crisis (2016 central estimate of costs) ($ million) Factor OBR not available OBR available Difference Economic cost 11441 9926 1516 Bailout cost 2778 1122 1655 Government debt service cost 968 403 565 Bank funding cost 418 1386 -968 Maintenance cost 0 17 -17 Build cost Additional outsourcing cost 0 0 20 550 -20 -550 Overall expected NPV 15605 13424 2181 229. To check the robustness of the model’s estimate of expected NPV the Reserve Bank undertook a host of sensitivity checks. For example, the positive sign on overall expected NPV is invariant to reasonable changes to each of the input variables where there is either a degree of uncertainty or judgement (e.g. estimated probability of a bank failure or probability of a “good” OBR outcome but not GDP) and where all other variables are held constant (i.e. partial sensitivity analysis). 230. It should be re-iterated that the quantitative net benefit produced by the CBA should be taken as indicative only, or of an order of magnitude, rather than as a literal point estimate. A number of assumptions have been made to make such an exercise tractable. Where possible, the Reserve Bank has erred on the side of caution when making assumptions. CBA Conclusion 231. The cost benefit analysis corroborates the conclusion from the qualitative assessment. The expected net benefit of having OBR available is significant at around $2.2 billion based on the Reserve Bank’s central estimate. This benefit is reduced to around $1.9 billion when banks’ own, unadjusted, cost estimates are used. Moreover, there may be some benefits of the revised outsourcing policy which are not captured in this exercise. For example, stronger contractual provisions between banks and third party suppliers will reduce the probability of service disruptions and therefore BAU-type disruptions in banking services. 232. Nevertheless, the Reserve Bank fully appreciates that some banks will have to incur significant costs to come into compliance with the new policy. At the same time, the Reserve Bank considers that banks are in a good position to absorb these costs which account for around 2.8 percent of banks’ cumulative profits over the last five year period. This also suggests that it would be surprising if these costs had material flow through consequences for customers or banks’ ability to keep innovating, particularly given the competitive pressures that prevail in the industry.

46 CONCLUSION 233. The Reserve Bank will clarify and revise the current BS11. Changes of note include: • outsourcing for the purposes of the policy will be defined; • a formal engagement process with the Reserve Bank on new proposed outsourcing arrangements has been designed; • an implicit materiality test by way of a white list will be introduced; • banks will be required to make sure certain provisions are included in all contracts for outsourcing arrangements; • foreign-owned affected banks will be required to produce separation plans and share these document with the Reserve Bank; • affected banks will be required to have robust-back up arrangements of functions outsourced to a related part; • the level of service a bank should be able to provide to customers following a failure event and indefinitely afterwards is more explicitly set out; • affected banks will be required to maintain compendiums recording basic information about all outsourcing arrangements; and • banks will have five years to become compliant. 234. Throughout the policy development process the Reserve Bank has had extensive engagement with stakeholders. Their feedback has significantly refined the Reserve Bank’s proposals in order to minimise costs to banks while still ensuring the policy objectives will be met. Some of the more significant changes include: • The Reserve Bank originally proposed that certain critical functions could not be outsourced to a parent or a related party. Following stakeholder feedback, instead the Reserve Bank will be requiring that the New Zealand bank have robust back-up functionality for functions that are outsourced to a parent or a related party. This was a part of the 2006 outsourcing policy, but the Reserve Bank’s expectations of what was expected from back-up capability were not explicitly stated; • The Reserve Bank then proposed that all back-up capability must be able to be up and running from 60 minutes after a separation. Following stakeholder feedback this was extended to 4 hours, or 9am the next morning, depending on which outcome is affected; • The Reserve Bank considered an option of lowering the threshold outsourcing to align with OBR given the interaction of the two policies. Stakeholder feedback

47 was mixed on this, however the Reserve Bank decided on balance to maintain the existing threshold; and • The transitional path to compliance with the requirements of the updated policy was originally proposed to be conducted over a two and a half year period. Following feedback, this has been extended to five years which will provide better alignment with the regular rollover of contracts so the renegotiation is not done outside of normal business practices. 235. Appendix one sets out the full evolution of the policy proposals. 236. The Reserve Bank is aware that a regulatory intervention is justified when: 1) it mitigates an identified market failure that would otherwise impinge on the soundness and efficiency of the financial system; and 2) the specific intervention in question is expected to produce both positive net benefits and higher net benefits than any other feasible intervention (including none at all). The Reserve Bank is satisfied that its proposed changes to BS11, summarised in the section above, meet these two conditions. 237. In the case of outsourcing by banks, the market failures in question are negative externalities. Bank owners and senior management do have incentives to mitigate the risks of outsourcing arrangements. However, because they do not bear all of the costs of failed outsourced arrangements or of outsourcing arrangements frustrating resolution of a bank, their incentives may be out of line with society’s preferences. This means they may engage in outsourcing arrangements where the expected social costs exceed the expected social benefits. 238. The market failures unaddressed could impose immense costs on bank customers and other third parties (including taxpayers) as customers may be unable to access transactional facilities for significant periods of time. Due to banks’ interconnectedness this would have flow-on affects. Those who would have otherwise transacted with the bank’s customers would also be affected and so forth. Finally, the cost to society of a bank failure may be significantly greater if, for example, a statutory manager cannot manage and monitor the failed bank’s risk position and if customers cannot access payment facilities. Outsourcing arrangements may also limit the resolution options for a failed bank, therefore increasing the probability of recourse to the taxpayer. 239. Thus, if the costs of not addressing the market failures adequately are significant the benefits of addressing them would be equally large. 240. If a Large Bank is still able to meet its clearing and settlement obligations on the day of a failure event (whether it be of an outsourcing arrangement, the bank itself, or a related party to the bank), monitor its financial positions on that day and re-open the following day to provide continued access to payment facilities indefinitely the risks of outsourcing would be largely addressed. Such failure events may still create costs for bank owners and management but any impact on the soundness and efficiency of the financial system would be reasonably limited. 241. The original BS11 if correctly implemented would have reduced the risk of BAU outsourcing disruptions and the risk of a bank failing primarily because of outsourcing arrangements. These would have also led to large benefits as even the loss of banking services for one or two days can have significant effects on customers’ ability to transact and therefore the wider economy.

48 242. Because of the problems with the interpretation of the policy, the Reserve Bank has proposed changes such as requiring separation plans and compendiums which are more prescriptive, but will ensure that banks meet the now decade-old expectations. Other changes to the policy, such as widening the focus from the provision of liquidity to the provision of basic banking services, will mitigate the identified market failures further still while still providing net benefits. The changes proposed will also align BS11 with OBR. 243. Indeed, for the most part the proposals clarify expectations about how BS11 should work rather than extend the scope or extent of the regulation. For example, the preferred options for basic banking services, engagement, and robust back-up arrangements represent clarifications of existing expectations. The contractual requirements and requirement for separation plans contain aspects of both a policy extension and clarification. The compendium requirement is an extension, albeit a relatively minor one. Appendix two compares the text of the original BS11 to the proposals. 244. A clarified and revised outsourcing policy will impose significant costs on industry. However, for several reasons, the cost estimates from banks for complying with the proposals appear overstated, including because they seem to include costs attributable to the original BS11. This is consistent with feedback received from IT consultants who noted that the proposal only made minor changes to the scope and breadth of BS11. 245. That said, the Reserve Bank’s quantitative modelling of the costs and benefits of a revised outsourcing policy produces a central estimate of the net benefit of around $1.9 billion when a cost figure based on gross costs estimated by the banks is used. This increases to around $2.2 billion when those costs are discounted based on reasonable assumptions. Although this exercise relies on a host of assumptions to make calculation tractable, where possible the assumptions have been conservative. 246. That said, the Reserve Bank is acutely conscious of the sizeable investments some banks will have to make to become fully compliant with the policy and therefore allow society to realise the full benefits of the proposals. The Reserve Bank concludes that the impact on the competitive landscape will be limited. Some banks are already much better aligned with the requirements of the revised outsourcing policy than others and appear to be as profitable as their relatively more dependent peers. Furthermore, banks which do have to incur significant costs should be in a good position to absorb these costs. The central industry cost estimate of $550 million makes up around only 2.8 percent of the after tax profits of the Large Banks over the past five years. IMPLEMENTATION Compliance 247. Section 74 of the Act permits the Reserve Bank to impose CoRs on banks that relate to, among other things, the ability of the applicant to carry on business in a prudent manner. As with the current outsourcing policy, the revised policy will be implemented by imposing CoRs on Large Banks. There is likely to be specific outsourcing CoR requiring banks to meet the outcomes of the revised policy. There will be additional CoRs for compliance with specific parts of the policy such as the compendium. 248. Compliance with the outsourcing policy will be managed through the use of CoRs as directors of a registered bank are required to regularly attest that CoRs are being met,

49 and the Act provides the Reserve Bank a series of powers to respond to a bank breaching a CoR. This framework is well supported by banks existing regulatory compliance frameworks. 249. The graduation in severity of the powers and offenses associated with CoRs, and the Reserve Bank’s practice of first seeking a non-punitive solution, means the Reserve Bank will be able to take fairly proportionate enforcement actions against breaches. This should create an incentive structure which encourages Large Banks to invest the optimal level of resource into compliance. When drafting the CoRs and the revised outsourcing policy, care will be taken to write them in a way that minimises the potential for trivial breaches of CoRs as suggested in the 2015 Regulatory Stocktake summary of submissions30. Timing and transitional arrangements 250. Implementation of the revised policy will take part in two stages. 251. Firstly, before the revised policy is implemented, an exposure draft of the policy will be released to the public. However, this final round of consultation will not revisit the high￾level questions the Reserve Bank has already extensively analysed and previously consulted on. It will instead ensure that any drafting problems are picked up so the text of the revised policy is interpreted in the same way as the policy proposals are outlined in this document. This will reduce implementation risks by ensuring the policy is consistently understood. This also reduces compliance risks as banks will be less able to offer misinterpretation of the policy as grounds for not meeting the policy outcomes (and thereby breaching their CoRs). The Reserve Bank expects to release the exposure draft for consultation on the wording in Q1 2017. Once the consultation closes a final policy can be expected to be released Q2 2017. 252. As set out in the “Options and Impact Analysis” part, the Reserve Bank envisages Large Banks having a period of five years to become fully compliant with the revised outsourcing policy. Banks will be required to be periodically audited on their progress. Bank directors will be required to periodically re-attest that they will be compliant after the transition period. If problems with bank transition plans are identified, the Reserve Bank may require banks to rectify these plans accordingly. 253. Although full compliance with the policy will not be required until the transition period ends, the Reserve Bank will likely impose a “no backsliding” requirement. Existing arrangements that support compliance with the revised policy will not be allowed to be unwound during the five-year transition period. 254. A five-year period for Large Banks to become fully compliant will allow these banks to take advantage of normal technology cycles (e.g. replacing arrangements to bring them into compliance with the revised policy can happen when previous arrangements reach the end of their life cycle). This will reduce compliance costs to banks significantly. Many banks were concerned about price inflation if banks are competing for similar expertise to help become compliant. A five-year transition period reduces risk of this. 30http://www.rbnz.govt.nz/-/media/ReserveBank/Files/regulation-and-supervision/stocktake/feedback￾statement.pdf?la=en

50 MONITORING EVALUATION AND REVIEW 255. The Reserve Bank expects a significant amount of monitoring of the new policy will take place. Some of this is as detailed in the above implementation section. As mentioned, the exposure draft of the revised BS11 will give an opportunity for technical problems for the policy to be picked up before it is introduced. It will also give the Reserve Bank and industry a chance to ensure that there are no competing interpretations of the policy, as this would otherwise reduce the policy’s effectiveness. 256. The development of plans by banks for becoming compliant and regular checking of the progress of these plans will provide the Reserve Bank with significant ability to monitor the implementation of the policy. More accurate data on the costs of the policy will also come available with time and this may allow adjustments to the policy to be made to minimise later costs. Other proposed requirements for a revised BS11 such as annual testing of the separation plan, reporting of the compendium and external audit of robust back-up arrangements will provide the Reserve Bank an ability to monitor the policy to ensure the desired outcomes are being met. 257. The Reserve Bank regularly reviews the regulatory regimes it operates and the associated polices. The Reserve Bank envisages a full review of the revised outsourcing policy would take place five years from the time banks have to be in full compliance with the policy. Given the five-year implementation period, during which the Reserve Bank will receive feedback from the banks, this would mean a review by 2027. Any review would be consistent with the requirements under section 162AB of the Act. 258. Issues with the new policy that occur are likely to be documented as they would be discussed at the Reserve Bank’s internal committee that considers outsourcing arrangements (if not at higher level committees too). This stock of matters would likely inform any review of the policy alongside any matters raised by industry. If a sufficiently significant problem with the policy is identified the Reserve Bank would look to undertake an immediate review.

51 Appendix one: Policy evolution The changes listed below are based on direct feedback from banks and provide lower cost alternatives to the original proposals, but still allow the objectives of the outsourcing policy to be met. The changes are as follows: • The Reserve Bank originally proposed that certain critical functions could not be outsourced to a parent or a related party. Following stakeholder feedback the policy will instead be requiring that the New Zealand bank have robust back-up functionality for functions that are outsourced to a parent or a related party. This was a part of the 2006 outsourcing policy, but the Reserve Bank’s expectations of what was expected from back-up capability were not explicitly stated; • The Reserve Bank then proposed that all back-up capability must be able to be up and running from 60 minutes after a separation. Following stakeholder feedback the Reserve Bank has extended this to 4 hours, or 9am the next business day, depending on which outcome is affected; • The policy proposals had originally proposed to have monthly testing on back-up capability. Following stakeholder feedback the Reserve Bank will be amending this to annual testing; • An option of lowering the threshold outsourcing to align with OBR given the interaction of the two policies was included. Stakeholder feedback was mixed on this, however it was decided on balance to maintain the existing threshold; • The Reserve Bank had proposed to include new trade finance, letters of credit and foreign currency transactional, savings and term deposit accounts from the definition of basic banking services. It was decided not to include these services in the definition; • One submitter asked for institutional customers to be excluded from the definition of basic banking services on the basis that they either have, or are able to get, services from other banks. Having weighed this up the Reserve Bank decided to exclude the bespoke services used by those customers from the definition of basic banking services, meaning that these customers would have access to the same services as other customers, but not anything further; • The consultation originally proposed on a limited white list of functions that are not relevant for the outsourcing policy. Having considered submission feedback it was decided that the policy will have an extended the list, including adding in certain categories of software to the white list; • The policy had proposed to require banks to seek Reserve Bank non-objection on all outsourcing proposals that were not on the white list. Following submission feedback the policy will now requiring notification for arrangements that are with or through the parent or a related party; • Originally banks would have been required to submit their compendiums whenever a new function is added to them. Following feedback the policy will instead require that banks send in an updated compendium of outsourced arrangements before meetings on operational risk (which are generally conducted annually);

52 • Instead of making a condition of registration for updating the compendium within a required time, the policy will now set the condition of registration against the process for updating the compendium; • The transitional path to compliance with the requirements of the updated policy was originally proposed to be conducted over a two and a half year period. Following feedback this was extended to five years, which will provide better alignment with when contracts normally rollover so the renegotiation is not done outside of normal business practices.

53 Appendix two: Key Features of Final Policy Proposal (as compared to current BS11) Final proposal for the outsourcing policy Existing Outsourcing policy 1 Threshold Large banks - NZ$10 billion in liabilities, net of amounts owed to related parties Large banks - NZ$10 billion in liabilities, net of amounts owed to related parties 2 Definition of outsourcing A registered bank’s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that could be undertaken by the registered bank, now or in the future No explicit definition for outsourcing, although paragraph A3 refers to outsourcing arrangements as those specified in section 78(1)(fb) in the RBNZ Act, i.e. “arrangements for any business, or functions relating to any business, of the applicant or registered bank to be carried on by any person other than the applicant or the registered bank. 3 Objectives The outsourcing policy would require a bank to ensure the outsourcing would not compromise the ability of the bank to: a. Be effectively administered under statutory management for the purposes of maintaining the bank’s ability to continue to provide and circulate liquidity to the financial system and the wider economy; b. Be in a position to enable any new owner of all or part of the bank to carry on the basic business of the bank; and c. Address the impact that the failure of a service provider may have on the bank’s ability to carry on all or part of the business of the bank. Not explicitly stated. However - In paragraph B10, it states that “the outsourcing policy … requiring that a Large Bank’s outsourcing arrangements do not create risk that the operation and management of the bank might be interrupted for a material length of time. In particular, any outsourcing arrangements for bank functions must not create risk to the bank’s ability to continue to provide and circulate liquidity in the economy, under normal business conditions or circumstances of stress or of failure of the bank or of a service provider to the bank. Para B13 also states that “…the most time￾critical, “core” bank functions…must be continued under normal business conditions in order to maintain the soundness and efficiency of the financial system. In the event of a failure of a bank or of a service provider to a bank, these functions must also be continued without material interruption, in order to avoid significant damage to the financial system”. 4 Outcomes a) The bank is able to continue to meet its daily settlement and other time-critical obligations, before the start of the value day after the day of failure and thereafter, so as to avoid disruption and damage to the rest of the financial system; b) The bank is able to monitor and manage its financial market positions, That the bank has legal and practical ability to control and execute any business, and any functions relating to any business, of the bank that are carried on by a person other than the bank, sufficient to achieve, under normal conditions and in the event of stress or failure of the bank or of a service provider to the bank, the following: a) that the bank’s clearing and settlement obligations due on a day can be met on

54 including credit and market risk positions, before the start of the value day after the day of failure and thereafter, thereby limiting further damage to the bank’s balance sheet; c) The bank has at hand the systems and balance sheet data necessary for the New Zealand authorities to have available on the day of the failure a range of options for managing the failed bank, on the first value day after the day of failure and thereafter; d) The bank is able to provide basic banking services to existing customers, including, but not limited to, liquidity (both access to deposits and to credit lines as defined in “basic banking services”) and account activity reporting, on the first value day after the day of failure and thereafter; e) Where a bank is part of an overseas banking group, the bank is able to meet outcomes (a) – (d) as a stand-alone entity in the event of separation from its parent every day thereafter that day (before the start of the value day after the day of failure and thereafter) b) that the bank’s financial risk positions on a day can be identified on that day (before the start of the value day after the day of failure and thereafter); c) that the bank’s financial risk positions can be monitored and managed on the day following any failure and on subsequent days (first value day after the day of failure and thereafter); d) that the bank’s existing customers can be given access to payments facilities on the day following any failure and on subsequent days (first value day after the day of failure and thereafter) 5 White list – functions not relevant for the outsourcing policy See the 2016 consultation paper. An extended white list will be consulted on when the exposure draft is released in Q1 2017 No white list 6 Definition of basic banking services The key retail and business services that bank customers typically rely on, where the disruption or sudden discontinuation of the function would be likely to have a material negative impact on a significant number of third parties that rely on such services and lead to contagion effects, including significant adverse effects on market confidence Services captured by the definition include: • Transactions accounts or similar products used by individuals and businesses for their transactional, every day banking needs. A bank must be able to continue to provide ATM services, given the importance of cash in times of a crisis, e.g. a major earthquake. In addition, customers No definition of basic banking services except in Table 1, required outcome (d) refers to “the bank’s existing customers can be given access to payments facilities on the day following any failure and on subsequent days”.

55 should be able to access their accounts through at least two of the most commonly used channels. • Savings accounts and term deposits accounts, which are usually held by individuals and entities who also engage in transactional banking. These deposits are either on-call or mature on a regular basis and are an integral part of individuals and businesses’ common banking needs. • Lending services to individuals and businesses, such as credit cards, overdraft facilities, revolving credit facilities, existing mortgage commitments (including pre-approvals) and mortgage facilities. • Account activity reporting for the relevant accounts individuals and businesses hold. • Payments, clearings and settlement services, such as credit card/merchant acquiring services and agency arrangements (including financial market infrastructure (FMI) access for smaller banks). Bespoke services for Institutional customers, once clearly defined, are also likely to be excluded from this definition. 7 Back-up capability Banks would need to have robust and sustainable back-up arrangements for their core functions, should they decide to outsource them to a parent or related party. The requirements are: • There is no capability to permanently lose transactions. The timeframe on what is meant by “permanently” would be consulted as part of the exposure draft. • The switch over would be delivered within 4 hours – for functions related to outcomes (a), and (c) (plus (e) to the extent that it is applicable). • The switch over would be delivered by No specific requirement, except in paragraph D31 it states that “the Reserve Bank’s presumption is that a core function … will not be outsourced, unless the bank can satisfy the Reserve Bank that the function is not material to the achievement of the required outcomes, or is substitutable by other functions that are not outsourced. Para D32 states that “for some core functions, an outsourcing arrangement with an independent party might be acceptable, provided that the arrangement featured strong mitigants to the risks to the bank’s legal and practical ability to control and execute the function. Such mitigants might include contractual mechanisms which mimic to the extent possible the substance of an in-house arrangements (e.g. with rights for the bank to “step-in” in the event of technical or financial

56 9am the day the bank is due to reopen (i.e. the day after being placed into statutory management) – outcomes (b) and (d) (plus (e) to the extent that it is applicable). • The contingency arrangement is sustainable, in that it could be deployed as the primary mechanism, on an on￾going and fully automated basis, to deliver the outsourced function with minimal impact and disruptions to both the bank’s customers and the bank’s own business operation (for example, a quick switch over and transactions are lost). • Testing is conducted on annual basis in a live simulation environment that mirrors the live environment to ensure that the back-up arrangement would work as intended. Separate to this, banks are required to ensure that changes made to the live environment will also be made in the simulation environment. • External review is conducted at least every three years to ensure the arrangement remains robust. However, annual external audit is required during the five-year transitional period. • The bank must have direct ownership and control over the standby system. This does not necessarily mean that the system needs to be located in New Zealand, but that the NZ locally incorporated bank should have the legal and practical ability to control the standby system (i.e. that they own the system (or have a direct relationship with the third party provider for that system) and the data that is required to use it). This backup arrangement cannot be provided by a related party if the system is outsourced. failure of the provider, BCP and regular testing requirements on the provider, explicit exclusion of statutory management of the bank from the definition of default events for the purposes of the contract, requirements that the provision of service be conducted from a location within or close to New Zealand, etc.). Para D35 states that “for core functions, the Reserve Bank’s presumption is that the relevant staff and data would be maintained in-house, whereas it might be acceptable for certain systems to be outsourced if the Reserve Bank were satisfied that the systems would not be needed in the aftermath of a failure, 8 Engagement Process A more explicit engagement process where • Banks are required to submit short form applications to the Reserve Bank that are with or contracted through Para D31 allows outsourcing of core functions to the extent that “the bank can satisfy the Reserve Bank that the function is not material to the achievement of the required outcomes, or is substitutable by other functions that are not

57 their parent or a related party; • For all arrangements with an independent party banks must ensure that they comply with the policy requirements, but they will not require Reserve Bank non-objection before entering into an arrangement; and • On the external review: i. Banks obtain a yearly external review to ensure that the bank is complying with the outsourcing policy and (for the first five years) is meeting the agreed deadlines for compliance; and ii. After the first five years banks will then be required to have a three-yearly external review (where the terms of the review are set by the Reserve Bank). outsourced.” No non-objection or process is set out for the engagement. 9 Compendium A new condition of registration for banks: That the registered bank has appropriate processes in place to maintain a compendium of its outsourcing arrangements in a form that is available to be sent to the Reserve Bank on request, and that include, in particular a) Arrangements for the compendium to be updated within 20 working days of an outsourcing arrangement being entered into; and b) Annual review of the compendium by the bank’s internal audit function to ensure it is up to date. No requirement for compendium. Monitoring of outsourcing arrangements managed through banks regulatory compliance frameworks. 10 Separation Plans Banks are required to prepare a separation plan that set out how the bank would, from the day of being placed into statutory management and, if necessary, indefinitely thereafter: a) Meet the required outcomes of the outsourcing policy; b) Manage the operational responsibilities for the separation; c) Ensure that the contractual obligations (discussed in the next section) are The current policy assumes that a bank can operate independently from its parent which would assume a plan for operating separately, however it was not an explicit requirement.

58 included in all functions that are outsourced through the parent or a related party; and d) Set out how the alternative arrangements for backup arrangements would be operationalised following a separation 11 Contractual Terms A number of matters such as the following are required to be included in outsourcing arrangements to both third and related parties: • a contractual provision to ensure continuing access on normal commercial terms to services when the bank enters statutory management; • parallel rights for arrangements made through the parent or a related party to ensure continuing access to the services where the bank is separated from its parent; and • the ability for the Reserve Bank to have access to documentation and information related to the outsourcing arrangement. Para D36 states that “a Large Bank would be expected to manage and document any outsourcing arrangement for the provision of a function (or for supporting systems, staff or data) according to commercially reasonable “arm’s length” practice, whether the service provider is a related party or not. In general, the Reserve Bank would expect documentation to be clear on the rights and obligations of each party to the contract and on service levels and pricing, to a level commensurate with the function’s time-criticality, materiality and substitutability. Para D32 states that “for some core functions, an outsourcing arrangement with an independent party might be acceptable, provided that the arrangement featured strong mitigants to the risks to the bank’s legal and practical ability to control and execute the function. Such mitigants might include contractual mechanisms which mimic to the extent possible the substance of an in-house arrangements (e.g. with rights for the bank to “step in” in the event of technical or financial failure of the provider, BCP and regular testing requirements on the provider, explicit exclusion of statutory management of the bank from the definition of default events for the purposes of the contract, requirements that the provision of service be conducted from a location within or close to New Zealand, etc.).