Circular NBB_2019_19 / Implementation of EBA Guidelines on Outsourcing (EBA/GL/2019/02)

NBB_2019_19 – 19 July 2019 Circular – Page 1/4 boulevard de Berlaimont 14 – BE-1000 Brussels tel. +32 2 221 24 33 company number: 0203.201.201.340 RPM Brussels www.bnb.be Circular Brussels, 19 July 2019 Reference: BNB_2019_19 your contact:
Thomas Bodequin tel. +32 2 221 53 65 thomas.bodequin@nbb.be Guidelines of the European Banking Authority (EBA) of 25 February 2019 on outsourcing (EBA/GL/2019/02) Scope Belgian credit institutions and investment companies Branches established in Belgium by credit institutions and investment firms subject to the law of a non-EEA State (hereinafter 'non-EEA branches') Belgian payment institutions1 and electronic money institutions Summary/Objective This circular implements the guidelines of the European Banking Authority (hereinafter 'EBA') on outsourcing (EBA/GL/2019/02) 2 and will apply from 30 September 2019. On 31 December 2021, when this circular applies to all outsourcing agreements, circulars PPB_2004/5 and NBB_2018_20, communication NBB_2012_11, and the CBFA communication of 5 November 2007 will no longer apply. This circular clarifies the NBB's approach regarding less significant institutions (LSI). Significant institutions subject to direct ECB supervision are recommended to follow this circular to the extent that the ECB does not publish guidelines on this matter. 1 Excluding account information service providers providing the services listed in Annex I, paragraph 8, of the Law of 11 March 2018. 2 Cf. https://eba.europa.eu/regulation-and-policy/internal-governance/guidelines-on-outsourcing-arrangements.

Circular – Page 2/4 NBB_2019_19 - 19 July 2019 Madam, Sir, Pursuant to Article 21 of the Law of 25 April 2014 (hereinafter 'the Banking Law'), each institution must have an adequate corporate organization device to ensure effective and prudent management of the institution. Article 66 of the Banking Law further specifies that, in this context, each institution is required to take appropriate measures to limit operational risk related to outsourcing and to not substantially impair the adequacy of the institution's internal control procedures, nor prevent the supervisory authority from verifying whether the institution complies with its legal and regulatory obligations. Under Article 168 of the Banking Law, these requirements also apply on a consolidated basis to parent credit institutions and Belgian credit institutions controlled by a financial company or a mixed financial company. In this context, Belgian financial companies and mixed financial companies are also expected to apply this circular on a consolidated basis. Pursuant to Article 21 of the Law of 11 March 2018 (hereinafter 'the Payment Services Law'), any payment institution or electronic money institution must have an adequate corporate organization device to ensure effective and prudent management of the institution. Article 38 of the Payment Services Law further specifies that a payment institution or electronic money institution that outsources operational functions, activities, or tasks retains full responsibility for complying with all obligations incumbent upon it under the Payment Services Law or implementing measures of Directive (EU) 2015/2366. The aforementioned outsourcing cannot lead to any of the following consequences: compromising the quality of the organization, and in particular affecting the quality of internal control; unduly increasing operational risk; compromising the ability of the NBB to verify that the payment institution complies with its obligations under or by virtue of the Payment Services Law or implementing measures of Directive (EU) 2015/2366. In what follows, the term 'institutions' refers to the entire scope of this circular, as described above. By this circular, the NBB indicates that the EBA guidelines on outsourcing are integrated into its supervisory practice. Furthermore, it clarifies practical arrangements regarding reporting to the supervisory authority. This circular will apply from 30 September 2019. This implies that all outsourcing agreements concluded, renewed, or adapted by institutions from this date must comply with this circular. Regarding existing and ongoing outsourcing agreements, institutions have until 31 December 2021 to comply with the circular. Until this date, these outsourcing agreements remain subject to circulars PPB_2004/5 and NBB_2018_20, communication NBB_2012_11, and the CBFA communication of 5 November 2007. Circulars PPB_2004/5 and NBB_2018_20, communication NBB_2012_11, and the CBFA communication of 5 November 2007
will no longer apply from 31 December 2021 for all institutions. A. Reporting to the supervisory authority The EBA guidelines include the following reporting obligations regarding institutions:

1. reporting of all or part of the outsourcing register upon request by the supervisory authority;
2. communication to the supervisory authority of planned outsourcing of critical or important functions;
3. communication to the supervisory authority that an outsourced function becomes critical or important;
4. communication to the supervisory authority of cases of significant changes and/or critical incidents concerning existing outsourcing.

NBB_2019_19 – 19 July 2019 Circular – Page 3/4 This chapter clarifies the NBB's approach regarding less significant institutions (LSI) 3, non-EEA branches, payment institutions, and electronic money institutions. Significant institutions subject to direct ECB supervision are recommended to follow this circular to the extent that the ECB does not publish guidelines on this matter 4.
1. Reporting of all or part of the outsourcing register upon request by the supervisory authority
Although the outsourcing register may be requested at any time by the supervisory authority, the NBB intends to clarify how it plans to use this possibility for less significant institutions, investment companies, non-EEA branches, payment institutions, and electronic money institutions. These institutions can expect the register to be requested in the following cases:
1. in the first half of 2022, following 31 December 2021, when documentation must be completed pursuant to paragraph 16 of the EBA guidelines;
2. subsequently, at least every three years, and, for less significant institutions and non-EEA branches, concurrently with and as part of the Supervisory Review and Evaluation Process (SREP);
3. in cases where the supervisory authority explicitly requests it in the context of outsourcing a critical or important function or if an outsourced function has become critical or important (cf. paragraph 58 of the EBA guidelines).
Institutions are recommended to use the table in Annex 1 to communicate the register to the supervisory authority. Further instructions for completing this table can be found in Annex 2. Institutions may extend this table, for example by adding columns, for both the institution's internal use and reporting to the supervisory authority.
2. Communication to the supervisory authority of planned outsourcing of critical or important functions
Before outsourcing a function, the institution is required to verify whether the function in question is critical or important. If so, it must inform the supervisory authority in a timely manner 5 and adequately. The information shared by the institution with the supervisory authority must at least contain the elements listed in paragraph 54 of the EBA guidelines. Institutions are recommended to use the form in Annex 3 to inform the supervisory authority, completed with relevant documents to assess the risk related to outsourcing. The outsourcing agreement should not be included in this information file; it will be requested by the supervisory authority if necessary.
3. Communication to the supervisory authority that an outsourced function becomes critical or important
A function that is initially not critical and not important may nevertheless become so after a certain period. The institution is required to notify the supervisory authority 6. It should be noted that a function may become critical or important for various reasons, not limited to modifications to the outsourcing agreement. For example, circumstances may change, or an outsourcing under an existing agreement may see its scope or scale intensify more than expected. 3 Less significant institutions as defined by Council Regulation No 1024/2013. 4 Significant institutions remain fully subject to the EBA guidelines. 5 For indicative purposes, it is considered that the institution informs the supervisory authority in a timely manner if it does so within a period of two months before the outsourcing. Institutions are, however, invited to inform the supervatory authority as soon as possible regarding specific outsourcing projects, even if this implies that not all information is yet available. 6 Cf. paragraph 58 of the EBA guidelines (EBA/GL/2019/02).

Circular – Page 4/4 NBB_2019_19 - 19 July 2019 Institutions are recommended to use the form in Annex 3 to inform the supervisory authority, completed with relevant documents to assess the risk related to outsourcing.
4. Communication to the supervisory authority of cases of significant changes and/or critical incidents concerning critical or important outsourced functions
Institutions are also required to inform the supervisory authority in a timely manner in the event of significant changes and critical incidents concerning critical or important functions they have outsourced 7.
In both cases, it is useful to voluntarily attach to the communication addressed to the supervisory authority the information points described in paragraphs 54 and 55 of the EBA guidelines. For this purpose, the form in Annex 3 or, for example, an extract from the outsourcing register can be used. B. Application to branches established in Belgium by credit institutions and investment firms subject to the law of a non-EEA State (non-EEA branches) Non-EEA branches are also expected to comply with the EBA guidelines on outsourcing, including the reporting arrangements defined in this circular. As is the case for Belgian institutions, non-EEA branches are expected to comply with the EBA guidelines regarding outsourcing to other legal entities part of the group (intra-group). However, outsourcing within the same legal entity (intra-entity), i.e., the outsourcing of a function by the branch to the head office or another branch of the legal entity to which it belongs, is not considered as outsourcing. This also applies to outsourcing agreements concerning the branch in Belgium but concluded by the head office or another branch of the same legal entity as the branch in Belgium. A copy of this circular is sent to the auditor(s) and statutory auditor(s) of your institution. Please accept, Madam, Sir, the expression of my distinguished sentiments. Pierre Wunsch Governor Annexes - only available via www.nbb.be:

1. Belgium Register
2. Instructions for register reporting
3. Outsourcing form
   7 Cf. paragraph 59 of the EBA guidelines (EBA/GL/2019/02).