Circular Letter No. CC/2019/00000065

Circular Letter No. CC/2019/00000065 2019-10-15 Sent to: Credit Institutions; Payment Institutions; Electronic Money Institutions and Investment Firms. Mod. 40000375/T – 01/14 Subject: New European Banking Authority (EBA) Guidelines on Outsourcing (EBA/GL/2019/02)

The EBA published on February 25, 2019, the document titled “Guidelines on Outsourcing” (EBA/GL/2019/02), addressed to credit institutions, investment firms, payment institutions and electronic money institutions, which contains a wide range of guidelines and recommendations related to the implementation of mechanisms and processes regarding the management of outsourced functions, with a view to strengthening and harmonizing the outsourcing practices of the recipient entities.

These guidelines enter into force on September 30, 2019, and can be consulted on the EBA website: https://eba.europa.eu/documents/10180/2761380/EBA+revised+Guidelines+on+outsourcing_PT.pdf/627ff30d-c7fe-41e5-8ee6-5d1c210ad987

The Bank of Portugal communicated to the EBA its intention to comply with these Guidelines from May 31, 2020, in order to allow the institutions included in its scope of application to adapt duly and in good time to the new provisions.

The Bank of Portugal emphasizes the importance of institutions adopting robust outsourcing practices, particularly at the level of outsourcing essential or important functions, which include, among others, the obligation to provide timely and complete information to the Bank of Portugal regarding the outsourcing of such functions that is planned, and of functions that have been reassessed as essential or important. The Bank of Portugal further reinforces the importance of institutions maintaining a comprehensive record of information on outsourced functions and the need to ensure contractual rights of access, information and audit that allow for adequate control by them and, if necessary, the provision of information to the Bank of Portugal.

In this context, the Bank of Portugal, in the exercise of the competence attributed to it by Article 17 of its Organic Law, approved by Law No. 5/98 of January 31, and without prejudice to the attributions and competences attributed to the European Central Bank, of April 16, 2014, within the framework of the Single Supervisory Mechanism Regulation (EU) No. 468/2014 of the European Central Bank of April 16, 2014, intends to transmit the following:

1. Credit institutions, investment firms, payment institutions and electronic money institutions subject to the supervision of the Bank of Portugal under the General Regime of Credit Institutions and Financial Companies, approved by Decree-Law No. 298/92 of December 31, in its current wording, must, from May 31, 2020, observe the requirements provided for in the Guidelines.

2. From May 31, 2020, the recipient entities of the Guidelines must inform the Bank of Portugal in a complete and timely manner of the outsourcing of functions considered essential or important and of functions that have become essential or important, with a minimum advance notice of 15 business days prior to such outsourcing, via the BPnet Portal, for which effect they must send, as minimum documentation, the information required in paragraph 58 of the aforementioned Guidelines.

3. The Bank of Portugal may, if it deems necessary, request additional information, as provided for in the Guidelines.

4. With the exception of paragraph 63(b) (applicable from December 2021), the aforementioned Guidelines enter into force from September 30, 2019 and revoke from that date the previous “Guidelines on Outsourcing” of the Committee of European Banking Supervisors on external outsourcing dated December 14, 2006 and the “Recommendations on external outsourcing to cloud computing service providers” (EBA/REC/2017/03), issued on December 20, 2017.

BANCO DE PORTUGAL Head Office: Rua do Comércio, 148 • 1100-150 Lisbon • Portugal T +351 213 130 000 • www.bportugal.pt Taxpayer No. 500792771 • Share Capital: € 1,000,000 • Registration at the Lisbon Commercial Registry, No. 51 Mod. 40000375/T – 01/14