Draft new guidelines on outsourcing

8 November 2024
Ref.: 2106174

Circular no.: 28/2024
To supervised entities pursuant to the first paragraph of Article 2 of Act no. 87/1998

Subject: Draft new guidelines on outsourcing

The Financial Supervisory Authority of the Central Bank of Iceland has issued discussion paper no. 5/2024, which contains a draft of guidelines on outsourcing at supervised entities. The guidelines will be issued on the basis of the second paragraph of Article 8 of Act no. 87/1998 on official supervision of financial activities, and cover supervised entities, cf. the first paragraph of Article 2 of the same Act, with the exception of those entities that fall under the EBA guidelines on outsourcing arrangements (EBA/GL/2019/02).1

The draft is an update of guidelines no. 6/2014 on outsourcing at supervised entities, which were issued in December 2014, and they will be repealed by these new guidelines.

The guidelines had come to contain outdated references in light of the fact that a fair number of new guidelines from the European supervisory authorities, EBA, ESMA and EIOPA, related to outsourcing, had entered into force after the guidelines were issued.

According to the Financial Supervisory Authority's circular dated 27 December 2019, financial undertakings, payment institutions and electronic money institutions must take into account the EBA guidelines on outsourcing arrangements in their operations2 and they are the only guidelines that the European supervisory authorities have issued that apply generally to outsourcing. However, a fair number of more specific guidelines exist that address outsourcing, and the Central Bank takes them into account in its supervisory practice. Mentioned here as examples are the EBA recommendations regarding outsourcing to cloud service providers for cloud solutions EBA/REC/2017/03, 3 EIOPA guidelines on outsourcing to cloud service providers EIOPA/BoS/20/002, 4 ESMA guidelines on outsourcing to cloud service providers ESMA50/164/4285, 5 EBA guidelines on the internal governance of financial undertakings

[1] Adopted with publication on the Financial Supervisory Authority's website and with a circular dated 27.12.2019.

[2] In the circular that accompanied the publication of the EBA guidelines, reference is made to the fact that they are based on Article 54 of the Act on Financial Undertakings and are furthermore supported by Articles 80 and 81 of that Act as well as the sixth paragraph of Article 12 of Act no. 120/2011 on payment services and the sixth paragraph of Article 13 of Act no. 117/2013 on the issuance and handling of electronic money.

[3] Adopted with publication on the Financial Supervisory Authority's website and with a circular dated 24.5.2018.

[4] Adopted with publication on the Central Bank's Financial Supervisory Authority's website and with a circular dated 31.5.2021.

[5] Adopted with publication on the Central Bank's Financial Supervisory Authority's website and with a circular dated 15.9.2021.

EBA/GL/2017/116 and EIOPA guidelines on the governance system of insurance undertakings EIOPA-BoS-14/253. 7

Consideration was given to, among other things, taking into account the requirements that apply to outsourcing in the aforementioned guidelines, so that updated guidelines would not be at odds with them. Account was also taken of the provisions of Delegated Regulation (EU) 2015/35 Solvency II, then especially Article 274 thereof, which was implemented by Regulation no. 940/2018 on the entry into force of European Union regulations on insurance activities and insurance groups. Furthermore, consideration was given to Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (the DORA Regulation), since outsourcing is widely provided for in that regulation. The regulation enters into application in January 2025 within the EU, but it is expected to be implemented in the autumn months of 2025 in Iceland.

Harmonisation of requirements for parties in the financial market contributes to safeguarding credibility in financial supervision and in the financial market generally and supports the objective of the EEA Agreement to form a single European Economic Area based on common rules and the same conditions of competition. There are also strong public interests at stake for smaller and medium-sized supervised entities that may be affected if equally stringent requirements are not made for them as for larger entities.

With this circular, the Financial Supervisory Authority of the Central Bank of Iceland gives recipients the opportunity to submit comments on the draft. The discussion paper and this circular are published on the Central Bank's website: https://www.fme.is/log-og-tilmaeli/umraeduskjol. Comments from consultation parties on the discussion paper are requested to be received no later than 25 November next. It is requested that comments be written on the consultation form prepared for that purpose, which can be found at the aforementioned web address. Consultation forms shall be sent to the email address: skjalasafn@sedlabanki.is.

Yours faithfully,
CENTRAL BANK OF ICELAND

Gísli Óttarsson
Sigurveig Guðmundsdóttir managing director specialist prudential supervision prudential supervision

[6] Adopted with publication on the Financial Supervisory Authority's website and with a circular dated 28.5.2018.

[7] Adopted with publication on the Central Bank's Financial Supervisory Authority's website and with a circular dated 27.9.2017.