Decision amending the Decision on Managing Outsourcing and Outsourcing-Related Risks

[unofficial translation] Pursuant to Article 44 paragraph (2) item 3) of the Central Bank of Montenegro Law (OGM 40/10, 6/13, 70/17, 125/23) and Article 116 paragraph (6) of the Law on Credit Institutions (OGM 72/19, 8/21, 24/25), the Council of the Central Bank of Montenegro, at its meeting held on 30 September 2025, passed the following DECISION AMENDING THE DECISION ON MANAGING OUTSOURCING-RELATED RISKS Article 1 In the Decision on Managing Outsourcing-Related Risks (OGM 127/20) the title of the decision shall be amended to read: “DECISION ON MANAGING OUTSOURCING AND OUTSOURCING-RELATED RISKS” Article 2 In Article 1, the words: “risks related to outsourcing” shall be replaced by the following: “outsourcing and outsourcing-related risks, as well as the content of information, the structure and maintenance of the registry of outsourcing arrangements.”. Article 3 In Article 3 paragraph (2) in the introductory sentence, the words: “of this Decision” shall be replaced by the following: “of this Article”. In item 7), the words: “delivery services”, the space and a comma shall be deleted. Article 4 In Article 5 paragraph (1), the words: “credit institution’s” shall be deleted. Paragraph (2) shall be amended to read: “(2) A credit institution shall ensure that their responsibility to third parties, as well as responsible persons in credit institutions may not be transferred by outsourcing to the service provider”. Article 5 In Article 6 paragraph (1) item 2) and Article 7, the words: “on Credit Institutions” shall be deleted. Article 6 In Article 8 paragraph (1) item 3), after the words: “termination of outsourcing” a comma shall be added, and the words: “and determine feasibility” shall be replaced by the following: “and to assess the feasibility of those activities”. In paragraph (2) the word: “activities” shall be replaced by the following: “requirements”.

[unofficial translation]

---

Decision amending the Decision on managing Outsourcing-Related Risks (OGM 112/25) 2 Article 7 In Article 11 paragraph (1) item 2) the changes have been made in Montenegrin version with no relevance to the English translation. In paragraph (2) the changes have been made in Montenegrin version with no relevance to the English translation. Article 8 In Article 15 paragraph (2) item 2) the words: “critical and important” shall be replaced by the following: “the criticality and the importance of”. Article 9 In Article 16 paragraph (3) after item 3) a new item shall be added, worded as follows: “3a) the contractual parties’ financial obligations;”. In item 10) changes have been made in Montenegrin version with no relevance to the English translation. Article 10 In Article 17 paragraph (1), changes have been made in Montenegrin version with no relevance to the English translation. Article 11 In Article 18 paragraph (1) in the introductory sentence, changes have been made in Montenegrin version with no relevance to the English translation. After paragraph (1), a new paragraph shall be added, worded as follows: “(2) When developing an exit strategy, a credit institution shall:

1. define the objectives of the exit strategy;
2. perform a business impact analysis that is commensurate with the risk of the outsourced processes, services or activities, with the aim of identifying what human and financial resources would be required to implement the exit strategy and determine the time limit for the implementation of the strategy;
3. assign roles, responsibilities and sufficient resources to manage the exit strategy and the transition of outsourced activities to a new service provider or a credit institution;
4. define success criteria for the transition of outsourced functions and data to a new service provider or a credit institution;
5. define the indicators to be used for the monitoring of the outsourcing arrangement, in accordance with Article 12 of this Decision, including indicators based on unacceptable service levels that should trigger the exit strategy.”. Article 12 In Article 19 paragraph (1) after item 2) a new item shall be added, worded as follows: “2a) the type of the outsourcing arrangement that reflects the nature of the outsourced function (e.g., IT outsourcing, control function, etc.);”.

[unofficial translation]

---

Decision amending the Decision on managing Outsourcing-Related Risks (OGM 112/25) 3 In item 3), after the words: “subject to outsourcing”, a comma and the following shall be added: “including, where applicable, a brief summary of the reasons why the outsourced function is considered critical or important”. At the end of item 10), a full stop shall be replaced by a semicolon and two new items shall be added, worded as follows: “11) in the case of outsourcing to a cloud service provider, the cloud service type and deployment model (e.g., public/private/hybrid/community); 12) the date of the most recent assessment of the criticality and importance of the outsourced function.”. In paragraph (2) item 2), changes have been made in Montenegrin version with no relevance to the English translation. In item 4) changes have been made in Montenegrin version with no relevance to the English translation. In item 7) changes have been made in Montenegrin version with no relevance to the English translation. After item 7), a new item shall be added, worded as follows: “7a) an outcome of the assessment referred to in Article 8 paragraph (1) item 3) of this Decision, as well as the assessment of the impact of credit institution’s discontinuing of the critical or important function;”. Article 13 This Decision shall enter into force on the eighth day following that of its publication in the “Official Gazette of Montenegro”. THE COUNCIL OF THE CENTRAL BANK OF MONTENEGRO CHAIRPERSON Decision number: 0101 - 7590 - 4 /2025 G O V E R N O R Podgorica, 30 September 2025 Irena Radović, m.p.