CBFA Communication on its Policy Regarding Outsourcing of Retail Client Portfolio Management Services to a Service Provider Located in a Non-EEA State

Prudential Policy for Banks and Insurance
Brussels, 6 November 2007

Communication from the CBFA on its policy regarding outsourcing of retail client portfolio management services to a service provider located in a State not a member of the European Economic Area (EEA)

Madam,
Sir,

Introduction

Pursuant to Article 20bis of the Law of 22 March 1993 and Article 62bis of the Law of 6 April 1995¹, the CBFA must publish on its website a communication regarding its policy on the outsourcing of retail client portfolio management services to a service provider located in a State not a member of the European Economic Area (EEA) when one or both of the following conditions, set out in Article 22, §1, of the CBFA Regulation of 5 June 2007 on organizational rules applicable to establishments providing investment services (hereinafter, the CBFA Regulation of 5 June 2007), are not met²:

• The service provider must be authorized or registered in its home country for the provision of this service and must be subject to prudential supervision;
• There must be an appropriate cooperation agreement between the CBFA and the supervisory authority of the service provider.

These articles stipulate, in their §4, that when a credit institution (Article 20bis of the Law of 22 March 1993) or an investment firm (Article 62bis of the Law of 6 April 1995) "entrusts a third party with the execution of essential operational tasks to ensure the provision of its investment services and the exercise of its investment activities in a continuous and satisfactory manner, it takes adequate measures to limit the operational risk associated therewith.

The outsourcing referred to in the first paragraph may not be carried out in a manner that substantially impairs the adequacy of the company's internal control procedures and prevents the Banking, Financial and Insurance Commission from controlling whether the company complies with its legal obligations.

The Banking, Financial and Insurance Commission publishes a communication in which it sets out the policy it follows regarding the outsourcing of portfolio management services provided to retail clients." ²

Article 22, §3, of the CBFA Regulation of 5 June 2007. This Article 22 transposes into Belgian law Article 15.3 of Commission Directive 2006/73/EC of 10 August 2006 implementing Directive 2004/39/EC of the European Parliament and of the Council as regards organizational requirements and operating conditions for investment firms and the definition of certain terms for the purposes of the said Directive (hereinafter, Directive 2006/73/EC).

Indeed, if one or both of these conditions "are not met, an establishment may not outsource portfolio management services by entrusting them to a service provider located in a third country without first notifying the CBFA of the contract and the outsourcing regime, as well as all other useful information, and provided that the CBFA has not raised objections to this contract and regime within a period of one month following receipt of the notification."

Through this communication, the aim is, for regulatory transparency and to ensure an appropriate degree of legal certainty⁴ for establishments, to provide examples of cases in which the CBFA will not, or will probably not, raise an objection to an outsourcing, even though one or both of the conditions set out in Article 22, §1, of the CBFA Regulation of 5 June 2007 are not met.

This communication specifies:

• the CBFA's approach in this matter; as well as,
• the elements that an establishment considering such outsourcing is invited to notify to the CBFA.

It concerns credit institutions and investment firms under Belgian law, as well as Belgian branches of investment firms subject to the law of States that are not members of the EEA.

In the context of this communication, by "portfolio management services," it is understood to mean only the investment service of portfolio management, as defined in Article 46, 8°, of the Law of 6 April 1995. As for the notion of "appropriate cooperation agreements," it covers not only Memoranda of Understanding (MoU) concluded by the CBFA but also all modes of collaboration governed otherwise than by a formal MoU (such as, for example, cooperation regulated by exchange of letters).

1. Principles regarding the outsourcing of portfolio management to a service provider subject to a State not a member of the EEA

1.1. Approach followed

The two conditions referred to in Article 22, §1, of the CBFA Regulation of 5 June 2007 can be considered to aim, on the one hand, at ensuring that the interests of the Belgian establishment's clients (concerned by the outsourcing) are adequately protected and, on the other hand, at enabling the CBFA to access the necessary information in the exercise of its duties.

It is in light of these objectives that the CBFA will examine outsourcing cases covered by Article 22, §2, of the CBFA Regulation of 5 June 2007 and decide whether or not to raise objections to the proposed outsourcing.

Article 22, §2, of the CBFA Regulation of 5 June 2007.
See in this sense Recital 22 of Directive 2006/73/EC.

From the moment the establishment wishing to outsource has previously demonstrated – for example by adopting measures such as those set out in points 1.2. and 1.3. below – that these objectives will be met despite the non-compliance with one or both of the conditions referred to in Article 22, §1, of the CBFA Regulation of 5 June 2007, and that it will be able to comply with the obligations incumbent upon it under Articles 17 to 21 of the CBFA Regulation of 5 June 2007 as well as the principles set out in Circular PPB 2004/5, the CBFA should in principle not raise an objection to this outsourcing project.

Regarding the measures thus set out in points 1.2. and 1.3. below, it should be noted that they are cumulative and not exhaustive: it is indeed not excluded that in the context of examining a specific file, the CBFA may consider that other measures than those listed prove necessary for the sought-after objectives of protecting client interests and accessing necessary information to be achieved.

1.2. Situation where the service provider is neither authorized nor registered and is not subject to prudential supervision

The CBFA should in principle raise an objection to a project to outsource to a service provider that is not authorized or registered and is not subject to prudential supervision, unless the outsourcing establishment demonstrates that appropriate measures exist or have been taken to ensure that the provider operates in a manner similar to that of an authorized or registered entity subject to prudential supervision. The following measures may in particular be considered in this regard:

• The establishment demonstrates that the service provider is subject to a control regime resembling the existing prudential control regime in Belgium;

• The establishment demonstrates that the service provider has and commits to maintaining, for the duration of the outsourcing contract, sufficient and adequate resources for the provision of the outsourced service, including appropriate supervisory oversight (internal control, compliance, risk management, and internal audit);

• The establishment demonstrates that the service provider has taken the necessary measures to enable the establishment to comply with its obligations towards its clients, in particular those defined in Articles 27 and 28 of the Law of 2 August 2002, and that it can verify compliance with these measures and impose necessary corrective measures if applicable;

• The establishment has obtained from the service provider that it will inform it not only of any event that could have a significant impact on its ability to fulfill its obligations under the outsourcing contract but also:

  • of any negative effect that a new law or regulation introduced in the provider's home State could have on the execution of its tasks under the outsourcing contract;
  • of any significant change in its structure, shareholding, effective management, own funds, or prudential risk profile;

• The establishment has reserved the right to terminate the outsourcing contract in the event of a change in the service provider's structure, shareholding, effective management, own funds, prudential risk profile, insolvency, bankruptcy, or concordat or any equivalent procedure in the State concerned, or if the provider fails to fulfill its obligations under the outsourcing contract;

• The establishment has reasonable certainty that the service provider has the financial capacity necessary to assume its responsibility under the outsourcing contract in the event that it is called upon;

• The establishment has obtained from the service provider:

  • that it will prepare its annual accounts in accordance with its national law, which – for all significant aspects – is similar or identical to internationally accepted accounting standards, and that these accounts will be subject to independent audit, conducted in accordance with its national law, which must be similar or identical to internationally recognized audit standards;
  • that it will transmit to it annually a copy of its audited annual accounts and will inform it as soon as it becomes aware of any issue raised in the context of the audit of its accounts;

• The establishment demonstrates that it has provided for appropriate measures, such as the following, regarding confidentiality (these measures must comply with privacy protection rules to which the establishment is otherwise subject):

  • the outsourcing contract imposes on the service provider to take the necessary measures to ensure the protection of confidential information it becomes aware of in the context of executing this contract and provides for the possibility for the establishment to verify compliance with these measures and to impose necessary corrective measures if applicable;
  • the outsourcing contract provides that the provider must not only protect any confidential information relating to the establishment or its clients but also inform the establishment without delay of any breach of this confidentiality obligation;

• the outsourcing contract is subject to the law and jurisdiction of an EEA Member State, knowing that the outsourcing cannot prejudice the establishment's compliance with the rules to which it is subject in Belgium (including those regarding privacy protection) and cannot further result in rules other than those agreed upon applying to its relationship with clients.

1.3. Situation where no appropriate cooperation agreement exists

When the service provider to which the establishment intends to outsource portfolio management services is subject to a supervisory authority located in a State not a member of the EEA with which the CBFA has not concluded an appropriate cooperation agreement, the CBFA should in principle not raise an objection to the outsourcing project if the establishment demonstrates that appropriate measures have been taken to ensure that the CBFA and the establishment's auditor have access to the information necessary for the exercise of their respective duties.

This could be the case, among others, when the following measures are provided:

• the outsourcing contract authorizes the establishment to access and communicate to the CBFA and the establishment's auditor any information regarding the outsourced activity that may be requested by the CBFA and/or the auditor in the context of the exercise of their supervisory duties. This implies in particular that the establishment should previously verify that the service provider's supervisory authority and/or local law or regulation do not limit access to information regarding the outsourced activities. Any restriction should be previously described to the CBFA;
• the outsourcing contract imposes on the service provider to communicate to the establishment all information necessary to enable it to meet its legal and regulatory obligations. The contract also recognizes the establishment's, the CBFA's, and the establishment's auditor's right to access, at any time and without hindrance, data related to the outsourced activities and the service provider's business premises.

2. Notification Procedures

If one or both of the conditions mentioned in Article 22, §1, of the CBFA Regulation of 5 June 2007 are not met, an establishment may not outsource portfolio management services by entrusting them to a service provider located in a State not a member of the EEA without first notifying the CBFA of the contract and the outsourcing regime, as well as all other useful information related to this outsourcing project.

Such a notification should in particular include the following information:

• a justification for the decision to outsource;
• the name of the envisaged service provider and the reasons why the establishment wishes to resort to it;
• the draft outsourcing contract that the establishment intends to conclude with the service provider and the expected entry into force date (unless the CBFA objects);
• details regarding the condition or conditions set out in Article 22, §1, of the CBFA Regulation of 5 June 2007 that are not met;
• the measures proposed by the establishment to meet the obligations incumbent upon it under Articles 17 to 21 of the CBFA Regulation of 5 June 2007, the principles set out in Circular PPB 2004/5 of 22 June 2004, and the objectives set out in point 1.1. above throughout the execution of the outsourcing contract;
• if applicable, details regarding the authorization or registration enjoyed by the provider as well as proof of this authorization or registration, the contact details of the person or persons within the authority that issued this authorization or carried out this registration, a summary of the legislation and/or regulation governing the status and/or activities of this provider.

Regarding compliance with the obligations provided by Article 17, b), of the Regulation of 5 June 2007, the establishment's attention is drawn to the fact that it must take all necessary measures to continue to fulfill its obligations towards its clients as defined in Articles 27 and 28 of the Law of 2 August 2002, notwithstanding the outsourcing.

Please accept, Madam, Sir, the expression of our distinguished sentiments.

The President,
Jean-Paul SERVAIS.