Decision on the manner and conditions for transferring important operational functions to outsourcing companies by payment institutions, electronic money institutions and payment system operators

Pursuant to Article 47 paragraph 1 item 6 of the Law on the National Bank of the Republic of North Macedonia (Official Gazette of the Republic of North Macedonia No. 158/10, 123/12, 43/14, 153/15, 6/16, 83/18 and Official Gazette of the Republic of North Macedonia No. 110/21), and Article 40 paragraph 9 and Article 149 of the Law on Payment Operations (Official Gazette of the Republic of Macedonia No. 90/22), the National Bank of the Republic of North Macedonia Council has adopted the following DECISION on the manner of and the conditions for transferring the execution of important operational functions to outsourcing companies by the payment institution, the electronic money institution and the payment system operator
I. GENERAL PROVISIONS

This Decision shall prescribe the manner of and the conditions for transferring the
execution of important operational functions to outsourcing companies by the payment institution, the electronic money institution as a payment service provider (hereinafter:
electronic money institution) and the payment system operator.
The terms used in this decision shall denote the following:
− Function shall represent a service, process or activity.
− Subcontracting shall represent a procedure in which the outsourced function is being partially or fully transferred to another outsourcing entity (sub-contractor). − Cloud computing shall represent services in the field of information technology, provided on a basis of a model, that enables a network access to a joint set of configuration information assets (networks, servers, data storage devices, applications and services).
When using outsourcing services, the payment institution, the electronic money institution
and the payment system operator shall establish:

conditions for outsourcing services, establishing important operational function and
management, by applying the provisions of section II of this Decision;
defining the manner and procedure to be applied while using outsourcing services
by applying the provisions of sections III, IV, V of this Decision and
reporting procedure to the National Bank of the Republic of North Macedonia
(hereinafter: the National Bank) in the attempt of the payment institution, electronic money institution or the payment system operator to transfer important operational function, by applying the provisions of section VI of this Decision.
II. OUTSORCING TERMS AND CONDITIONS AND THEIR MANAGEMENT

The payment institution, the electronic money institution or the payment system operator
shall determine whether the transfer of the execution of operational functions to outsourcing entity represents outsourcing.
For the purposes of this Decision, the outsourcing services shall not include:

functions that according to the law must be outsourced,
Services related to market information and interbank communication services and
trade, such as services provided by Bloomberg, Moody’s, Standard & Poor's”, Fitch, Reuters,
global electronic payment networks, such as visa, mastercard,
global financial telecommunication infrastructures, such as SWIFT,
correspondent banking services,
Services that are not independently performed by the payment institution,
electronic money institution, or the payment system operator (for example advertising, receiving legal opinion/ advice, representation before judicial and administrative bodies, hygiene maintenance services of business premises, horticulture, health services, servicing official vehicles, catering, vending machines, office services, transport services, delivery services, reception services, secretarial services, services of sending, receiving, transfer and/or storage of electronic documents and/or electronic invoices and trust services defined under the Law on Electronic Documents, Electronic Identification and Trust Services used in electronic transactions),
procurement of goods (for example: cards, card terminals, office materials and
furniture, personal computers) and
utility services (for example electricity, water, gas, telecommunication services).
Important operational function

For the purposes of this Decision, important operational function shall denote operational
function related to provision of payment services or payment system operations the malfunction or interruption of which would cause a significant impact on the ability of the payment institution, electronic money institution or the payment system operator to meet the conditions for obtaining an operating license in accordance with the law, on fulfillment of its other obligations pursuant to the Law on Payment Services and Payment Systems (hereinafter: The Law), on its financial results or on the adequate performance or continuity of payment services, or payment system operation.
Important operational function shall also denote the operational performance of the control
functions in the payment institution, the electronic money institution or the payment system operator. Important operational function shall also refer to activities that require permit or other type of approval from a competent authority in the country, in accordance with law.
To determine the importance of the operational function, the payment institution, the
electronic money institution and the payment system operator shall take into consideration the results of the risk assessment analysis in accordance with the provisions set in items 25,26 and 27 of this decision, as well as at least the following:

whether the outsourcing service is directly related to the provision of payment
services or payment system operation that require administrative approval,
whether any interruption of the operational function outsourced in accordance with
the agreed service level would have an impact on: the short-term and long-term financial resilience and sustainability of the payment institution, the electronic money institution or the payment system operator, including, where applicable, the impact on assets, capital, costs, funding sources, liquidity, profit and loss;
business continuity and operational sustainability and reputational and operational
risk;
the possible impact of the function on: the risk management process; the
compliance with the legislation and the possibility of conducting an audit;
the possible impact of the function on the quality of the service,
total exposure to the same outsourcing entity and the possible cumulative effect of
the concentration risk on the same outsourcing entity,
the size and complexity of the business activity for which the outsourcing services
are used,
the possibility to change the outsourcing entity to whom the operational function
has been transferred in case it needs to be replaced with another outsourcing entity,
the possibility to reinstate the function with the payment institution, the electronic
money institution or payment system operator,
data protection and possible impact of the disrupted confidentiality, availability or
integrity, including the compliance with the legislation, The assessment of the impact of operational function transfer shall include at least: the risk profile of the payment institution, the electronic money institution or the payment system operator; the possibility to supervise the outsourcing entity by the payment institution, the electronic money institution or the payment system operator or the authority in order to assess the management of risks that arise from the outsourcing service; measures for ensuring business continuity and quality of the business activities. In case of a significant risk change, the nature or the scope of the function that is transferred to outsourcing entity, payment institution, electronic money institution or payment system operator shall reassess whether that function according to the changes is still valid. Organizational structure

The payment institution, the electronic money institution and the payment system
operator shall provide:

clear, transparent and documented decision-making process for outsourcing
services,
clear distribution of authorizations and responsibilities of organizational units or
employees responsible for documentation, management and utilization of outsourcing services and
adequate resources that provide continuous compliance with the legislation that
regulate the outsourcing area.

The payment institution, the electronic money institution or the payment system operator
shall appoint a chief outsourcing officer in order to control the service-related risks and quality.
When using outsourcing services, the payment institution, the electronic money institution
or the payment system operator shall provide at least the following:

adoption and implementation of decisions for own business activities related to
important operational functions,
to regularly and timely perform payment services i.e. payment system operations,
appropriate identification, assessment and risk management which arise from the
utilization of outsourcing services,
concluding appropriate agreements for data confidentiality and other information,
establishing and maintaining permanent exchange of relevant information with
outsourcing entities,
to ensure, within a defined time frame, implementation of at least one of the
measures: function transfer to other outsourcing entities; taking over the function for independent execution by the payment institution, the electronic money institution or the payment system operator or termination of business activities that depend upon the function.
if the personal data are outsourced in third countries, to ensure personal data
processing in accordance to the Law on Personal Data Protection.

The payment institution, the electronic money institution or the payment system operator
shall ensure in a contract with the outsourcing entity that the outsourcing will not lead to delegation of responsibilities to the management bodies of the payment institution, the electronic money institution or the payment system operator of the outsourcing entity. Using outsourcing services within the group of payment institution, the electronic money institution or the payment system operator
If the payment institution, the electronic money institution or the payment system
operator use outsourcing service within the group the payment institution, the electronic money institution or the payment system operator belongs to, the managing bodies of the payment institution, the electronic money institution or the payment system operator shall be responsible for the service, its compliance with the legislation and the provisions of this Decision.
If, for the execution of the control functions, the payment institution, the electronic money
institution or the payment system operator use services from outsourcing that is used within the group the payment institution, the electronic money institution or the payment system operator belong to, they shall ensure efficient implementation of control functions by receiving reports on monitoring and revision of outsourcing services.
If, within the group the payment institution, the electronic money institution or the
payment system operator belong to, each outsourcing service is being monitored centrally, the payment institution, the electronic money institution or the payment system operator for important operational functions shall ensure:

independent monitoring and proper supervision of the outsourcing entity, including
the report from the centralized group-level monitoring, at least once a year. The report shall include at least information on the risk assessment and monitoring of the transfer of the outsourcing and
centralized function for group-level monitoring to obtain the aggregate part of the
supervisory reports on the use of outsourcing services for important operational functions, and the entire audit report, upon request.

In case of planned significant changes in outsourcing entities that conduct centralized
group-level monitoring, the payment institution, the electronic money institution or the payment system operator shall ensure that the managing bodies of the payment institution, the electronic money institution or the payment system operator are timely notified of the possible impact of these changes on the important operational functions. The notification shall include an aggregate part of the conducted risk analysis, the risk of compliance with the regulatory requirements, as well as the possible impact of the changes on the level of service.
If the payment institution, the electronic money institution or the payment system
operator plan to use an exit plan from outsourcing for important operational functions determined within the group they belong to, they shall ensure its successful execution. Outsourcing policy
The payment institution, the electronic money institution or the payment system operator
that use outsourcing shall have an outsourcing policy.
The managing bodies of the payment institution, the electronic money institution or the
payment system operator shall approve and regularly update the policy referred to in item 18 of this Decision.
The policy referred to in item 18 of this Decision shall include at least the following
elements:

decision-making process for outsourcing,
basic principles and guidelines for outsourcing risk management
identifying, assessing, reducing or preventing current and possible conflicts of interest,
especially when they belong to the same group, as well as their appropriate management,
due diligence of potential outsourcing entities,
method of selecting outsourcing services,
criteria for defining significant outsourcing operational functions,
method of constant check and assessment of quality of outsourcing and conditions for
efficient monitoring of their operation for the payment institution, the electronic money institution or the payment system operator
method of reporting on the changes in the use of outsourcing or their changes,
method of approving new outsourcing entity,
contract extension procedure,
Method of ensuring outsourcing continuity, important for the operation of the payment
institution, the electronic money institution or the payment system operator,
independent control and revision of the compliance with the legislation and the
regulatory requirements,
necessary documentation and manner of maintaining a registry and
exit strategy, i.e. contract termination procedures, including a request for
documented exit plan from each important operational function transferred to outsourcing.
III. PROCEDURES IN THE PROCESS OF UTILIZATION OF OUTSOURCING SERVICES
FOR THE PERFORMANCE OF IMPORTANT OPERATIONAL FUNCTIONS Analysis before establishing a process of utilization of outsourcing services

Before making a decision on utilization of outsourcing services, the payment institution,
the electronic money institution or the payment system operator shall be obliged to:

assess whether it refers to the transfer of the performance of an important operational
function,
assess whether the requirements for the utilization of outsourcing services stated in
items 22 and 23 of this Decision have been met,
identify and assess all relevant risks associated with the utilization of outsourcing
services in accordance with the provisions of items 25, 26, 27 and 28 of this Decision,
carry out an appropriate due diligence of the potential outsourcing entity in
accordance with the provisions of items 29, 30, 31 and 32 of this Decision and
identify and assess the conflicts of interest arising from the utilization of outsourcing
services, especially in the cases when they belong to the same group.

If the payment institution, the electronic money institution or the payment system operator
transfer an important operational function directly related to the provision of payment services or the operations of the payment system to an outsourcing entity from the country or a European Union Member State, one of the following requirements needs to be met:

the outsourcing entity to have an approval for the performance of that function or to
be registered in an appropriate registry by a competent authority or
the outsourcing entity to be authorized for the performance of that function if such
authorization is defined by the legislation.

If the payment institution, the electronic money institution or the payment system operator
transfers an important operational function directly related to the provision of payment services or the operations of the payment system to an outsourcing entity from third countries, the following requirements need to be met:

the outsourcing entity to have an approval or to be registered in an appropriate
registry by a competent authority for the performance of that function in third countries and to be under the supervision of a competent authority,
an appropriate contract or a memorandum of cooperation to be concluded between
the National Bank and the supervisory authority of the outsourcing entity from that country.

The payment institution, the electronic money institution or the payment system operator,
at any time in addition to the possibility to use the outsourcing services and to have the necessary service level, shall ensure:
− that at any moment they meet all the requirements in accordance with the work permit, − the management bodies efficiently carry out the activities for which they are responsible and competent, − that a clear and transparent organizational structure which guarantees the compliance with the prescribed requirements, has been established; − that it conducts the necessary supervision and manages the risks which arise from the provision of the important operational functions in case when the control functions are provided by an outsourcing entity and − that it has sufficient resources for the implementation of the provisions referred to in indents 1, 2, 3 and 4 of this item. Assessment and management of the risks which arise from the utilization of outsourcing services
The payment institution, the electronic money institution or the payment system operator
shall be obliged to appropriately manage the risks they are or may be exposed to, taking into account the nature, volume and complexity of their business activity, as well as the risks characteristic of the business model, and which arise from the utilization of outsourcing services.
The payment institution, the electronic money institution or the payment system operator
before concluding a contract with the outsourcing entity and during the monitoring of its work shall be obliged to assess the risks, to establish an appropriate system of management of the operational risk, the concentration risk and the other risks arising from the utilization of outsourcing services.
If the contract with the outsourcing entity provides for subcontracting or transfer of the
performance of an undertaken important operational function of subcontractors, the payment institution, the electronic money institution or the payment system operator in the risk assessment, shall take into account at least the following:

if the location of the subcontractor is in a third country or is in a country that is different
from the country of the outsourcing entity, to take into account the risks associated with the subcontracting process;
that the quality of supervision of the important operational functions conducted by the
payment institution, the electronic money institution or the payment system operator and the National Bank can be limited due to the risk of complex relations, i.e. connections of several subcontractors.

The payment institution, the electronic money institution or the payment system operator
shall be obliged, in the process before concluding the contract for utilization of outsourcing services, to take all the measures to avoid the unnecessary operational risks.

Due diligence
29. The payment institution, the electronic money institution or the payment system operator
before concluding the contract for utilization of outsourcing services within their procedures for assessment and selection of an outsourcing entity shall be obliged to take into account the operational risks which arise from the function for which they plan to use services from an outsourcing entity.
30. The payment institution, the electronic money institution or the payment system operator,
when assessing the adequacy of a service provider of important operational functions, shall be obliged to assess whether it has:

business reputation and experience in the activity,
appropriate abilities, professionalism, resources (staff, IT, finances) and appropriate
organizational structure and
if necessary an approval for the performance of that function or an evidence of
registration in the registry by an appropriate competent authority.

The payment institution, the electronic money institution or the payment system operator,
when carrying out due diligence of the potential outsourcing entity of important operational functions, shall be obliged to further review:

the business model of the outsourcing entity, their nature, size, complexity, financial
status, ownership structure, and if the outsourcing entity belongs to some group and the structure of the group they belong to,
the long-term relations with outsourcing entities that have already been subject to
assessment and provide services to the payment institution, the electronic money institution or the payment system operator,
whether the outsourcing entity is part of a group of the payment institution, the
electronic money institution or the payment system operator, i.e. whether they are included in accounting consolidation and
whether they are subject to supervision by a competent supervisory authority.

If the utilization of outsourcing services also includes processing of personal or confidential
data, the payment institution, the electronic money institution or the payment system operator shall be obliged to ensure that the outsourcing entity conducts the technical and organizational measures for data protection in accordance with the legislation. Manner of establishing a relationship between the payment institution, the electronic money institution or the payment system operator and the outsourcing entity
The payment institution, the electronic money institution or the payment system operator,
when concluding a contract with the outsourcing entity, shall adjust the provisions in the contract by scope and contents to the volume and complexity of the functions that are used as outsourcing services, as well as the risks associated with the utilization of outsourcing services.
The payment institution, the electronic money institution or the payment system operator
shall be obliged to conclude a contract with the outsourcing entity in writing which will contain at least the following:

a detailed description of the service that is subject of the contract,
date of start of fulfillment of the contractual obligations and period of duration of the
contractual relations, with reference that if it is a contract whose duration is not specified, it shall be stated accordingly,
financial liabilities of the contracting parties,
provisions that regulate the manner in which the payment institution, the electronic
money institution or the payment system operator will constantly monitor the provision of the transferred service that is subject of the contract, including the types of reports they will receive from the outsourcing entity and the dynamics of their submission,
an obligation for the outsourcing entity for timely reporting to the payment institution,
the electronic money institution or the payment system operator on all the facts and changes that significantly affect or could affect the fulfillment of the contractual obligations,
an agreed level and quality of the service including qualitative, if applicable also
quantitative indicators of the success of carrying out the function for which outsourcing services are being used, defined levels for taking timely measures by the payment institution, the electronic money institution or the payment system operator,
an obligation for keeping a business secret, as well as an obligation for storage and
protection of confidential and personal data, including provisions for the access, availability, integrity, confidentiality and security of data,
the location where the performance of the function will be transferred to the
outsourcing entity that is subject of the contract, the location of storing and processing the data, as well as the obligation for the outsourcing entity for timely reporting on the purpose of changing the location,
a provision which regulates the subcontracting process,
the obligation for the outsourcing entity when providing the service to act fully in
accordance with the legislation,
an obligation for the outsourcing entity to grant the National Bank an access right and
a right of on-site supervision of the manner stated in the provisions from item 42 of this Decision,
a provision which, in case of termination of the cooperation contract, provides a right
of access to data held by the payment institution, the electronic money institution or the payment system operator,
if applicable the coverage level that is required, a provision which defines the need
for concluding an insurance policy for professional responsibility,
a description of the conditions for termination of the contract with defined notices of
the payment institution, the electronic money institution or the payment system operator and the outsourcing entity,
a provision which provides for a right for the payment institution, the electronic money
institution or the payment system operator to terminate the contract with the outsourcing entity at request of the National Bank,
manner of settlement of disputes, and
choice of applicable law and competent court.

If the payment institution, the electronic money institution or the payment system operator
conclude a contract with an outsourcing entity for transferring an important operational function, they shall be obliged, in addition to the requirements from item 34 of this Decision, to include in the contract the following:

an obligation for the outsourcing entity to grant the payment institution, the electronic
money institution or the payment system operator an access right and a right of review of the manner stated in the provisions of this Decision,
provisions for implementing and testing the business continuity plans,
the obligations of the outsourcing entity in case of transfer of the service they provide
to another outsourcing entity or in case of return to the payment institution, the electronic money institution or the payment system operator, including the obligations for managing data,
definition of an appropriate transitional time period in which the outsourcing entity
after the termination of the contract, will continue providing the service and
an obligation for the outsourcing entity, in case of termination of the contract for
utilization of outsourcing services, to provide the necessary support to the payment institution, the electronic money institution or the payment system operator in the transfer of the performance to another outsourcing entity or the return of the service to the payment institution, the electronic money institution or the payment system operator.

If a contract for utilization of outsourcing services for a service treated as an important
operational function for the payment institution, the electronic money institution or the payment system operator envisages subcontracting, in addition to the requirements referred to in items 34 and 35 of this Decision, the contract shall necessarily include at least the following:

obligation for the outsourcing entity to notify the payment institution, the electronic
money institution or the payment system operator of any planned subcontracting or significant changes, within which the payment institution, the electronic money institution or the payment system operator will be able to perform a risk assessment related to the proposed changes, in order to obtain the opportunity to timely submit an objection to the planned subcontracting or to the significant changes,
obligation of the outsourcing entity to request written consent from the payment
institution, the electronic money institution or the payment system operator for the planned subcontracting or significant changes or the right to object in relation to the above,
the right to terminate the contract if, due to subcontracting, the risks to the payment
institution, the electronic money institution, or the payment system operator increase, or when the outsourcing entity performs subcontracting without notifying the payment institution, the electronic money institution, or the payment system operator,
obligation of the outsourcing entity to obtain written consent from the payment
institution, the electronic money institution or the payment system operator, if the processing of personal data is transferred to another outsourcing entity,
the obligation of the outsourcing entity to supervise the services the execution of
which it has transferred to another outsourcing entity,
the conditions to be met in case of subcontracting,
types of services for which subcontracting is not permitted and
obligation of the outsourcing entity with the subcontractor to agree provisions for
right of access, right of audit and on-site supervision in accordance with items 42, 43, 44, 45, 46 and 47 of this Decision.

The payment institution, the electronic money institution or the payment system operator
may only approve subcontracting if the subcontractor undertakes to act in accordance with the legislation, fulfill all its contractual obligations and enable the payment institution, the electronic money institution or the payment system operator and the National Bank, the same rights of access and right of audit or direct supervision, which is performed on the outsourcing entity, and is in accordance with item 42 of this Decision. Security of data and systems
The payment institution, the electronic money institution or the payment system operator
shall ensure that the outsourcing entity shall adhere to the applicable industrial IT safety standards.
When using cloud services or other outsourcing services in the field of ICT (information
and communication technologies), the payment institution, the electronic money institution or the payment system operator shall be obliged to define in the contract the requirements related to data and systems security and constantly monitor the compliance with them.
Before concluding the contract with the outsourcing entity in the cloud and other contracts
that include the processing of personal or confidential data and their transfer, the payment institution, the electronic money institution or the payment system operator shall make an assessment of the risks related to the location where the data will be will kept, processed and stored, in order to ensure that they are within the acceptable level.
The payment institution, the electronic money institution or the payment system operator
shall be obliged, when using the outsourcing services, to take into account the differences in national legislation in the area of data protection, especially when the outsourcing entity comes from a third country. Access right and on-site supervision or audit
The payment institution, the electronic money institution or the payment system operator
shall be obliged in the contract with the outsourcing entity to enable the authorized persons from the National Bank the following:

timely and unrestricted access to the work premises including access to the devices,
information systems and network, information and data used to provide outsourcing services, as well as all financial information related to the service, the employees of the outsourcing entity and the external auditors of the outsourcing entity and
for the purpose of monitoring the compliance of the outsourcing entity with the
legislation and contractual requirements, the possibility of conducting on-site supervision over their operation, and that in the area that has or can be brought in

connection with the utilization of outsourcing services, the manner it is provided, and it is in accordance with the concluded agreement.
43. The payment institution, the electronic money institution or the payment system operator
shall be obliged in the contract with the outsourcing entity the performance of an important operational function has been transferred to, to allow the external audit, as well as other authorized persons from the payment institution, the electronic money institution or the payment system operator:

timely and unrestricted access to the work premises including access to the
devices, information systems and network, information and data used to provide the service by third party, as well as all financial information related to the service, the employees of the outsourcing entity and the external auditors of the outsourcing entity and
for the purpose of monitoring the compliance of the outsourcing entity with the
legislation and contractual requirements, a possibility to audit the operations, especially in the area that has or can be brought in connection with the utilization of outsourcing services, the way in which it is provided, while it is in accordance with the concluded contract.

When enabling the right of access and external audit referred to in item 43 of this Decision,
as well as when determining the cycles for conducting the audits and the areas that will be covered by the audit, the payment institution, the electronic money institution or the payment system operator shall be bound to perform it in accordance with the risk assessment.
Pursuant to item 43 paragraph 1 indent 2 of this Decision, the payment institution, the
electronic money institution or the payment system operator may:

use certificates or audit reports issued by third parties or internal audit reports, which
the outsourcing entity has put on disposal and
conduct individual or participate in joint audits together with other payment
institutions, electronic money institutions or payment system operators of the same outsourcing entity.

The payment institution, the electronic money institution or the payment system operator
shall assess whether the certificates and audit reports referred to in item 45, paragraph 1 indent 1 are appropriate, sufficient and relevant for inspecting the area that includes the important operational functions the execution of which was transferred to the outsourcing entity. The payment institution, the electronic money institution or the payment system operator must not rely only on the reports referred to in item 45, paragraph 1 indent 1, but shall occasionally act in accordance with the provisions referred to in item 45, paragraph 1 indent 2 of this Decision.
If the utilization of outsourcing services implies a complex technical infrastructure, the
payment institution, the electronic money institution or the payment system operator shall ensure:

whether the responsible persons referred to in item 45 of this Decision who carry out
the audit and/or assessment have the necessary knowledge and skills to carry out the audit and/or assessment with quality and
whether the employees of the institutions that verify the certificates and/or reports
referred to in item 45 of this Decision have enough quality knowledge and skills to perform the necessary verification.
IV. EXIT STRATEGY

The payment institution, the electronic money institution or the payment system operator
shall define and document an exit strategy for each important operational function the execution of which has been transferred to outsourcing entities, in accordance with the policy referred to in items 18, 19 and 20 of this Decision, taking into account at least the following scenarios:

cancellation or termination of the contract with the outsourcing entity,
open liquidation or bankruptcy proceeding against the outsourcing entity,
deterioration of the quality of the service used by the outsourcing entity and real or
possible operating omissions caused by irresponsible or unsuccessful execution and
occurrence of significant risks that may affect the quality and timely performance of
the function transferred to the outsourcing entity.

The payment institution, the electronic money institution or the payment system operator
shall enable cancellation or termination of the contract with the outsourcing entity without unnecessary interruption of business activities, limitation in the compliance with legislation and without harmful consequences on the continuity and quality of the service it provides to its customers.
In order to fulfill the conditions referred to in item 49 of this Decision, the payment
institution, the electronic money institution or the payment system operator shall:

develop and implement plans that will be fully documented and properly tested and
identify back-up solutions and develop transition plans for taking over the service and
data from the outsourcing entity and transferring it to another outsourcing entity or transferring back the performance to the payment institution, the electronic money institution or the payment system operator or take other measures that will ensure constant performance of the important operational function and
ensure during the transition period uninterrupted operation, in a manner that is
controlled and properly tested, taking into account the problems that may arise due to the data location.

When developing the exit strategy, the payment institution, the electronic money
institution or the payment system operator shall:

define the objectives of the exit strategy,
analyze the effects on the operation, in proportion to the risk of the outsourced
services, in order to determine which resources (human resources and financial resources) are needed to implement the exit plans, as well as the required time,
assign adequate roles, tasks, responsibilities and resources to manage exit plans and
transfer activities,
define criteria for success in the transfer of services and data and
define indicators that will be used to monitor the contract with the outsourcing entity,
including indicators of unacceptable service levels that should trigger an exit from the contract.
V. KEEPING REGISTER OF OUTSOURCING ENTITIES TO WHICH IMPORTANT
OPERATIONAL FUNCTION HAS BEEN TRANSFERRED

The payment institution, the electronic money institution or the payment system operator
shall maintain and regularly update a register of outsources to which the performance of important operational functions has been transferred, which should contain the following information:

reference number of each contract concluded with the outsourcing entity,
date of conclusion of the contract, date of commencement of its application (if
different from the date of conclusion), and if applicable, date of the next extension, i.e. date of the end of the contractual obligations, i.e. the notice period of the payment institution, the electronic money institution or the payment system operator and of THE outsourcing entity,
a brief description of the function that is transferred to the outsourcing entity,
function category (for example: information technology, control functions, etc.),
name of the outsourcing entity, registered office address, if applicable, name of parent
outsourcing entity and other contact information,
country or countries in which the service is provided, including the data location,
whether the function is treated as an important operational function,
for using services in the cloud service model, the nature of the data that is stored and
the location of its storage,
date of the last assessment of the importance of the operational function the
execution of which is transferred to the outsourcing entity,
date of the last risk assessment in accordance with the provisions referred to in items
25, 26 and 27 of this Decision and a brief summary of the assessment,
management authority that approved the outsourcing service,
date of the last, i.e. next planned audit, i.e. inspection of the important operational
function,
if applicable, the names of all subcontractors to whom significant parts of the service
are outsourced, the country in which the subcontractors have their registered office or residence, the country in which the function/service will be provided and if applicable the location where the data will be stored,
the result of the evaluation of the replaceability of the outsourcing entity (simple,
difficult or impossible), the possibility of restoring the important operational function at the payment institution, the electronic money institution or the operator of the payment system or the effects of terminating the performance of that function,
whether the important operational function supports a business activity where time is
a critical factor and
an estimate of the annual cost of the important operational function.

VI. NOTIFYING THE NATIONAL BANK
53. The payment institution, the electronic money institution or the payment system operator,
if they make a decision to transfer a certain important operational function to an outsourcing entity, should notify the National Bank about it at the earliest 90 days before concluding the contract with the outsourcing entity.
54. The notification referred to in item 53 of this Decision contains an explanatory note with
a description of the important operational function and the reason for the decision on engaging outsourcing entity.
55. The contract proposal, assessment of the impact of the transfer of the operational function
in accordance with item 8 paragraph 2 of this Decision and the information in accordance with item 52 of this Decision shall be submitted in conformity with item 54 of this Decision. If the National Bank assesses that the conditions under Article 40 paragraphs (3) and (4) of the Law are not met, it shall notify the payment institution, i.e. the electronic money institution, that it may not conclude draft contract for the transfer of an important operational function with an outsourcing entity.
56. The payment institution, the electronic money institution or the payment system operator
shall notify the National Bank without delay on the significant changes and/or events related to the use outsourcing services that could have a significant impact on the operation of the payment institution, the payment institution electronic money or the payment system operator.
57. The payment institution, the electronic money institution or the payment system operator
shall document the risk assessment in accordance with the provisions referred to in items 25, 26 and 27 of this Decision and the results of the constant monitoring of the utilization of outsourcing services.
58. The payment institution, the electronic money institution or the payment system operator
shall notify the National Bank without delay if the constant monitoring referred to in item 57 of this Decision indicates changes in the risks, the nature or the scope of the important operational function transferred for the execution to the outsourcing entity or when certain operational function that has been transferred for the execution to outsourcing entity becomes important. In addition to the notification, a summary of the risk assessment and a brief description of the change should be submitted.
59. If the outsourcing entity has the main office and/or conducts business activities in third
countries, the payment institution, the electronic money institution or the payment system operator shall confirm that the legislation in the country in which the outsourcing entity conducts business activities enable the National Bank the following:

implementation of the supervisory function over the operation of the outsourcing
entity which is directly involved or can be connected with the utilization of outsourcing service which is subject of a contract and
timely and unrestricted access to the documentation and data related to the utilization
of the services that outsourcing entity possesses.

In addition to the information referred to in items 56 and 57 of this Decision, the National
Bank, if it deems it necessary, may request additional information to assess the fulfillment of the conditions for the utilization of outsourcing services in accordance with the Law and this Decision.
VII. TRANSITIONAL AND CLOSING PROVISIONS
Payment institution, electronic money institution or payment system operator shall
harmonize its operations with the requirements stipulated in this Decision, no later than 31.12.2023.
Payment institution, electronic money institution or payment system operator shall
harmonize the provisions of the contract with the requirements of this Decision at first subsequent amendment of the existing contracts with outsourcing entity, but no later than 31 December 2023.
If the institution is not able to amend the contract with the outsourcing entity for important
operational functions no later than 31 December 2023, the payment institution, electronic money institution or payment system operator shall notify the National Bank no later than 31 December 2023 about the possible exit strategy.
This Decision shall enter into force on the eighth day from the day of its publication in the
Official Gazette of the Republic of North Macedonia, and shall apply from 1 January 2023. D No. 02-15/XX-7/2022 25 November 2022 Skopje Governor Chairperson of the Council of the National Bank of the Republic of North Macedonia Anita Angelovska Bezhoska