Draft Outsourcing Guideline Comments Matrix – February 2022

CBTT’s Responses to Comments on the Draft Outsourcing Guideline issued May 2020.

1. General
   Comment
   Entire document As an overarching comment, the Guideline should seek to ensure that financial institutions manage the relationship with the third-party service provider at a certain minimum standard, which can then be examined by the CBTT in its inspection of the financial institution. We are of the view that the CBTT should proceed cautiously in extending its role beyond this general oversight to avoid the risk of the CBTT being viewed as a party to the contract. Amendments have been made to the Guideline to reflect this comment.
2. General
   Comment
   Entire document As a general concern, we ask for clarification as to how these proposed Guidelines are intended to relate to the overseas operations of RFIs where agents may perform some or all of the services listed in Appendix 2. The expectations of the Central Bank as it relates to overseas operations of RFIs are detailed in section 9 – Outsourcing to a Cross-border Service Provider.
3. General
   Comment
   Entire document We have reviewed the draft Outsourcing Guideline, which in our view is much too onerous especially at a time when insurers need to be focussed on navigating the unique circumstances of COVID-19 and the local/global economic ramifications. Noted. However Outsourcing risks is a material risk facing regulated financial institutions globally. Consequently, this Guideline is intended to ensure proper risk management of outsourcing risks.
4. General
   Comment
   Entire document Do these guidelines apply to Consultancy Services for strategic acquisitions and Project Management? Refer to Appendix 1, which contains a non-exhaustive list of commonly outsourced activities and services and a

list of activities and services for which the Guideline would generally not apply.
5. General
Comment
Entire document While we support the CBTT’s initiative to implement the safeguards in respect of outsourcing, we respectfully disagree that such Guidelines should apply to non￾deposit taking institutions. As you are aware, our Company does not hold funds on behalf of customers and, as such, the Company will not be exposed to many of the risks highlighted in the Guidelines. The CBTT may accordingly wish to consider preparing an alternative Guideline, which would be applicable to entities such as ours, which reflects the nature of the business undertaken by non￾deposit taking institutions. We disagree. Some key risks presented by outsourcing are operational and cyber risks. Such risks can impact customers of regulated financial institutions. We therefore expect that the Guideline will be implemented in a manner that is proportionate to your outsourcing risks taking into consideration the minimum requirements.
6. General
Comment
Entire document While we agree that certain Guidelines should be in place that requires RFIs to consider certain prescribed matters when engaging an external third party service provider, it is important that such Guidelines are flexible such that the provisions can apply to the varying outsourcing arrangements, which may be entered into, and the internal processes of RFIs and service providers. We consider that this draft guideline overreaching and thus unduly intervenes with the right of freedom of contract with service providers who do not fall under CBTT’s jurisdiction. In the alternative, this guideline, if The Guideline is not intended to impede an RFI’s freedom to contract once the proper risk assessment and monitoring is in place. Consequently, RFIs will no longer be required to seek the approval of the CBTT before entering into material outsourcing contracts.

applicable, should only be applied prospectively to new or newly renewed outsourcing contracts.
7. Glossary
Material
Outsourcing
Material Outsourcing- means outsourcing of a business activity, function, process or service, which, if disrupted, has the potential to significantly impact the financial institution’s business operations, reputation or profitability. This term is defined at page 3, yet, the definition is very broad and can cover almost any and/or all functions or services outsourced by a RFI The comment is noted. The definition adequately captures the elements of material outsourcing that the Central Bank considers relevant. The RFI is expected to determine the actual materiality of the outsourced function in accordance with clause 4, which will potentially narrow the contracts captured as material.
8. Glossary
Material
Outsourcing
In addition to the criteria mentioned, “Material Outsourcing” should be defined by reference to a specific dollar value or range. The definition should be broadened to provide clearer guidelines on materiality and to avoid subjectivity on behalf of the RFI. The Central Bank will not place a dollar value to indicate materiality because the significance of dollar values are relative/subjective to the size and operations of each RFI. However,
section 4 of the Guideline provides RFIs
with a significant list of criteria, which includes among them the cost of the outsourcing arrangement as a proportion of its total operating costs; to evaluate when assessing materiality.
9. Glossary
Outsourcing
Outsourcing- means the regulated entity’s use of a third party or service provider (either an affiliated entity within a corporate group or an entity that is external to the group) to perform activities on a continuing basis that would normally be undertaken by the regulated entity. Definition of Outsourcing The definition of outsourcing is broadly framed. We therefore suggest it would be useful to include in Appendix 2 of the Guideline, examples of activities the Central Bank does not consider outsourcing arrangements. We also recommend including a definition for the word “Group” as a term used in the A list of arrangements not typically considered outsourcing has been included in the Guideline. A definition of Financial Group will be included to distinguish this from a general corporate group.

guideline. This term is defined at page 3, yet, the definition is very broad and can cover almost any and/or all functions or services outsourced by a RFI.
10. Glossary
Outsourcing
We consider that the definition of “Outsourcing” should not include the use of a third-party affiliated entity, which is within the same corporate group as the Regulated Financial Institution (‘RFI’). In our respectful view, the risks associated with the outsourcing activity as established under the guideline are those inherently present in an external third￾party contractual relationship. The potential lower risk presented by intra-group outsourcing is recognised in
section 8 of the Guideline.
11. Introduction￾paragraph 1.6
Moreover, the Central Bank will consider the potential system risks posed where outsourced activities of multiple regulated entities are concentrated in a single or limited number of service providers We note the concern about the concentration of Outsourced Activities in a single or limited number of service providers. To mitigate against such risks identified, will the Central Bank be willing to make available to RFIs a list of such service providers so that we may take it into consideration when assessing our risk? The Central Bank will not be providing a list of acceptable service providers. The due diligence conducted on the service provider should reveal whether the service provider has the capacity (time, resources, expertise) to provide the outsourced service adequately.
12. 2.2 Purpose,
Application and Scope
This Guideline therefore establishes minimum standards for the management of outsourcing risks by RFIs. As such, the principles detailed in the Guideline should be applied according to the degree of materiality of the outsourced activity or service. However, even where the activity or Clause 2.2 then goes on to refer to a “degree of materiality” which somewhat contradicts the definition. The definition suggests that once a function/process/service has the potential to significantly impact the RFI’s business operations, reputation or profitability, it is material. This means that it is the potential Clause 2.2. has been amended. The words “degree of” have been deleted.

service is not material, RFIs should consider the appropriateness of applying the principles of this guideline in a manner proportionate to the risks posed by the outsourcing of the impact that makes the outsourcing material. However, the Guideline does not set out how this ‘potential’ is to be measured so as to assist in evaluating the “degree of materiality” of any outsourced function/process/service.
13. 3.1.2 RFIs, which have existing outsourcing
contracts, are required to:
Notify the Inspector of Financial Institutions (“Inspector”), within three (3) months of the issuance of this Guideline, of the following:
a) all material outsourcing contracts using Appendix 1 and criteria outlined at 5.1; and b) all material outsourcing contracts which do not comply with this Guideline and the areas of non￾compliance. This should be submitted on a separate schedule in the same format as the template in
Appendix I.
Please indicate whether issuance of the Guideline is by way of formal notification letter or by update on CBTT website, and also consider extending the period from three (3) months to December 31, 2020 All CBTT Guidelines are issued by way of formal notification to RFIs. The timeframe for the list of material contracts to be submitted using
Appendix 1 will be extended to six (6)
months from the date of issuance. The requirement for item (b) has been removed.
14. 3.1.2 & 3.2.2. 3.1.2 RFIs, which have existing
outsourcing contracts, are required to:
Notify the Inspector of Financial Institutions (“Inspector”), within three Please indicate whether issuance of the Guideline is by way of formal notification letter or by update on CBTT website, and also consider extending the period from three (3) months to December 31, 2020. The comments have been noted. The timeframe for the list of material contracts to be submitted using
Appendix 1 will be extended to six (6)
months. The requirement for item (b) has been removed.

(3) months of the issuance of this Guideline, of the following:
a) all material outsourcing contracts using Appendix 1 and criteria outlined at 5.1; and b) all material outsourcing contracts which do not comply with this Guideline and the areas of non￾compliance. This should be submitted on a separate schedule in the same format as the template in
Appendix I.
3.2.2. Material outsourcing contracts
that are:
expiring after 12 months from the date of issue of this Guideline must be reviewed and revised to come into compliance with the provisions set out in this Guideline. Where the revision of the contract in this timeframe is not possible, the Inspector must be notified and provided with an explanation as well as the timeframe for the revision of the outsourced contract/ agreement No time frame was given for the revision of contracts identified therein. We recommend within twelve (12) months as terms and conditions may have to be negotiated. What if such contracts are not feasible to modify or renegotiate, for example due to onerous break clauses? Would an exception be provided? Noted. Timeframes have been revisited and extended outwards. See section 12 of the final Guideline.

Additionally, section 12.7 allows the RFI to notify the Inspector of any reasons why a contract could not be renegotiated or modified within the specific timelines.
15. 4.1 The determination of materiality to the
RFI of an outsourced activity, function In addition, Clause 4.1 sets out the criteria to be used in determining whether an outsourced function/process/service is
Section 4.1 provides examples of criteria
that should be considered in determining the materiality of the outsourcing

or service is important for proper risk identification, mitigation and management. Criteria that the management of the RFI may use to determine whether an outsourcing contract is material include:
4.1.1 the impact on significant
business lines if the service provider should fail to perform over a given period of time and whether or not this would result in potential losses or issues to the RFI, its customers and their counterparts;
4.1.2 the level of contribution of the
outsourced activity function or service to the RFI’s income and profit, including the cost of the outsourcing arrangement as a proportion of its total operating costs;
4.1.3 the ability of the RFI to
maintain appropriate internal controls and meet regulatory requirements, if the service providers were to material. It does not indicate the extent to which these criteria must be satisfied to determine if an engagement is material or not material. Is it that once all the criteria exist the outsourcing activity is material or if at least half are satisfied to a large extent, the activity is material? We suggest that the definition of material outsourcing and Clause 4.1 of the Guideline be revisited. The Guideline is unclear as to how materiality is determined and the extent to which the criteria must be satisfied to aid in the determination. arrangement. The application of one or more of the criteria in the determination of the materiality is a responsibility of the RFI based on its risk appetite, established risk thresholds, knowledge of its business and expert judgement.
16. 4.1 This section suggests that a RFI may apply
different criteria to determine materiality or that the criteria may not be applicable to all types of outsourcing arrangements. We therefore recommend a statement be included in Section 4.1 acknowledging the subjectivity of the assessment of materiality of an outsourcing arrangement. The subjective nature of the assessment has been clarified in the Guideline. A RFI’s policies and procedures for assessing the materiality of outsourcing arrangements and managing the risks associated with outsourcing arrangements may be evaluated against the expectations of this Guideline.
17. 4.1 Which non-material contracts should be
reported on to ensure compliance? These should be clearly defined. Only those services identified as material that are outsourced need to be reported to the Central Bank

experience financial, operational or other problems;
4.1.4 the interrelationship of the
outsourced activity, function or service with other activities, functions or services of the RFI;
4.1.5 the degree of difficulty and
time that would be required to find an alternative service provider or to bring the business activity in-house should this become necessary;
4.1.6 the ability to control the risks
where more than one service provider collaborates to deliver an end-to-end outsourcing solution;
4.1.7 the potential impact that a
confidentiality breach or failure of data integrity can have on the RFI and its customers;
4.1.8 the potential legal and
reputational risks if the

service provider fails to perform; or
4.1.9 the aggregate exposure to a
particular service provider in cases where the RFI outsources various functions to the same service provider
18. 4.3 Where the RFI intends to outsource a
material activity, service, business process or function, it should notify the Central Bank within seven (7) days of the RFI’s Board approving the material outsourcing arrangement and indicate in the notification the nature of the activity, service, business process or function that is being outsourced and the rationale. Subsequently, and at least 30 days prior to entering into the contract, the following documentation must be presented to the Central Bank for review:
4.3.1. A copy of the draft outsourcing
agreement/ contract;
4.3.2 Details of the activity, service or
function(s) to be outsourced In the case of cloud computing details should also be provided with respect to the type of cloud service and deployment model The Guideline require the RFI to notify the Central Bank within seven (7) days of the RFI’s Board approving the material outsourcing arrangement. In addition, the guidelines require the RFI to provide the outsourcing contracts inter alia to the Central Bank for review. We suggest that the Central Bank include a statement allowing the RFI to proceed with the outsourcing arrangement if the Central Bank does not raise any objection within 14 days of the submission of the requisite documentation. Clarify whether the notification period is within 7 calendar days or business days. Clarify whether the period for submission of documents to the Central Bank is within 30 calendar days or business days. It is not clear whether RFIs can proceed with the outsourcing arrangements once the obligations of subsections 4.3 are This provision has been amended for the Central Bank to review any material contracts upon request.

i.e. public/private/hybrid/community cloud;
4.3.3 A copy of the due diligence
conducted on the outsourced service provider (see section 5.4.2), including the key risks identified and how the risks will be mitigated; and
4.3.4 Details relating to the proposed
service provider including the directors, key shareholders, as well as, whether or not the service provider will be accessing the services of a sub￾contractor and the country where the service provider is registered or licensed. satisfied. We suggest that this be made clear in the Guideline. Alternatively, the Central Bank should commit to a minimum period within which its concerns/feedback would be conveyed to the RFI. The seven (7) and thirty (30) days referenced should be specific and state “business” days. What is the purpose of the outsourcing contract being submitted to CBTT prior to entering into the contract? Does the CBTT wish to make suggestions to the contract? What is the time frame associated with same? Is CBTT approval required prior to the RFI entering into a material outsourcing contract? If yes, what assurances can CBTT provide that its review process would not place time-sensitive strategic/critical outsourcing arrangements in jeopardy? It also seems impractical to ask for this draft contract to be provided due to processes involved in contract negotiation and the tight timeframe in which this occurs following the award of a contract. In this regard, we note that key outsourcing contracts include Information Technology contracts, including Cloud Computing contracts, where the providers

are foreign services providers that maintain contract prices for a finite period of time since there are time, resources and costs implications of maintaining same for extended periods. While FIs can include a period for contract negotiation into the request for services, periods that extend beyond the accepted timeline for contract negotiation, can have an adverse cost implication for the FI. A requirement for prior review of the contract is likely to increase the period required for contract negotiation and the risk of increased cost of the services to an FI. Subject to clarification on the above, due consideration should be given to whether contracts in their entirety are required, our whether a redacted version with only those terms impacted by the proposed Guideline should be submitted. Philosophically: As it relates to this
section and the one above, should the
Central Bank become so involved in the operations of the constituent banks/licensees as set out herein as opposed to defining the parameters for these outsourcing arrangements in clear terms?
19. 4.3.2 Details of the activity, service or
function(s) to be outsourced In the case of cloud computing details should also A period sign is required at line 1 after the word “outsourced”. Amended. The section has been amended for the Central Bank to review any material contracts upon request.

be provided with respect to the type of cloud service and deployment model i.e. public/private/hybrid/community cloud; Clarify whether the notification period is within 7 calendar days or business days. Clarify whether the period for submission of documents to the Central Bank is within 30 calendar days or business days. It is not clear whether RFIs can proceed with the outsourcing arrangements once the obligations of subsections 4.3 are satisfied. We suggest that this be made clear in the Guideline. Alternatively, the Central Bank should commit to a minimum period within which its concerns/feedback would be conveyed to the RFI.
20. 5.1 The RFI must have in place a
comprehensive outsourcing policy to guide the assessment of whether and how the RFI’s activities, functions, processes and services can be appropriately outsourced. The Board of Directors must retain responsibility for the outsourcing policy and related overall responsibility for activities undertaken under that policy. In particular, the RFI’s Board should:-
5.1.1 Approve the RFI’s
outsourcing policy and ensure At this time, the Board of Directors approves service contracts which exceed the threshold delegated to management. The parameters of this threshold are clearly defined within the Managing Director's Duties and Authorities, inclusive of an expenditure limit. It is our view that only where these limits are exhausted, should the Board of Directors be required to approve outsourced service contracts. Agreed. The provision does not require the Board to approve all outsourced service contracts. It requires that the Board approve the outsourcing policy. The Outsourcing Policy should identify the delegated authorities / thresholds for approval of outsourcing contracts.

that the RFI’s outsourcing policy is in line with its risk appetite, risk tolerance and overall risk management strategy and framework;
5.1.2 Ensure that the RFI’s risk
management framework includes provisions to evaluate the risks and materiality of all existing and prospective outsourcing arrangements, as well as, the policies that apply to such arrangements; and
5.1.3 Implement a process for its
review and approval of all material outsourcing contracts.
21. 5.2.5 THE RFI’S SENIOR MANAGEMENT
SHOULD ENSURE THAT THE OUTSOURCED ACTIVITIES AND THE RELATIONSHIP WITH THE SERVICE PROVIDER ARE ADDRESSED IN THE RFI’S ESTABLISHED RISK MANAGEMENT FRAMEWORK. Senior management should therefore:- Ensure that management and employees within the lines of As relates to Guideline 5.2.5 we seek clarification as to the Central Bank’s expectations as it relates to the interrelated responsibilities and expectations. This will be left to the discretion of the RFI. The Central Bank’s concern is ensuring that the risk framework addresses the risks associated with outsourcing and adequate measures are in place to mitigate the risks. Reference can be made to the draft Corporate Governance Guideline for additional information on financial institution’s risk governance framework.

businesses who manage the service provider relationships have the relevant skills, as well as, distinct but interrelated responsibilities to ensure that material outsourcing contracts are managed effectively and commensurate with the RFI’s level of risk and complexity
22. 5.2.10 THE RFI’S SENIOR MANAGEMENT
SHOULD ENSURE THAT THE OUTSOURCED ACTIVITIES AND THE RELATIONSHIP WITH THE SERVICE PROVIDER ARE ADDRESSED IN THE RFI’S ESTABLISHED RISK MANAGEMENT FRAMEWORK. Senior management should therefore:- Ensure that systematic risk evaluation is conducted to ensure that material outsourcing arrangements do not result in the internal controls, business conduct or reputation of the RFI being compromised or weakened. This evaluation should be performed at least annually on existing arrangements as part of the review processes of the RFI and be made available to the Central Bank upon The requirement/ expectations for the annual systematic risk evaluation is unclear. It should be more detailed if it is something that may be requested by the regulator and there are expectations on what it should contain and how it should be approached. This has been amended to remove the word “systemic”. Therefore, what is required is a risk evaluation relative to the financial institution’s overall risk profile, which ensures that the items listed in 5.2.10 (a) and (b) are captured in the assessment.
23. 5.2.10 According to Guideline 5.2.10, Senior
Management is to ensure that systematic risk evaluation is conducted, and that this evaluation should be performed at least annually on existing arrangements. We find this obligation to be too onerous. The various risks would have been assessed and evaluated at inception, before the contract was entered, and after the implementation of the Guidelines material arrangements submitted to the Bank for review. As such we are of the view that it need not be evaluated yearly especially in those circumstances where contracts are entered into for a period exceeding one year. It is unlikely that new major risks would arise during the second or third year The statement is noted however while the arrangement is in place circumstances that affect the arrangement may evolve during that time. The Central Bank therefore maintains that an annual review should be conducted.

request. As part of the systematic risk evaluation, the RFI should:
a) identify and classify its activities, processes and related data and systems re: the sensitivity and required protections; and b) define and decide on an appropriate level of protection of data confidentiality, continuity of activities outsourced, and integrity and traceability of data and systems in the context of the intended outsourcing. With regard to cloud computing institutions should also consider specific measures where necessary for data in transit, data in memory and data at rest, such as the use of encryption technologies in combination with appropriate key management architecture. of the contract that was not present or raised at first hand thus requiring it to be evaluated yearly.
24. 5.2.10 Section 5.2.10 requires the RFI to ensure
that a systematic risk evaluation is conducted on an annual basis. We recommend that:
(i) consideration be given to a risk based approach that allows for the risk assessment to be conducted on an annual basis only for material engagements; (ii) consideration should be given to allow for intra-group engagements to be assessed at a different frequency than external outsourcing suppliers; and (iii) consideration should be given to removing the word systematic risk as systematic risk generally refers to the risk inherent to the entire market or market segment which we don’t believe is the intent of this section. (i) Amended to allow for the application of the annual evaluation to apply only to material outsourcing arrangements. (ii) With respect to the intra group arrangements, the same timeframe will apply. (iii) Amended to remove the word “systemic”.
25. 5.2.11 Ensure that key risks and risk
mitigation strategies are identified and the impact and potential benefits of the outsourcing arrangements are analyzed. For example, where outsourcing risks are higher such as, where the RFI outsources to an unregulated third party or to a service provider located in an overseas jurisdiction, the RFI must ensure that The definition of cyber risk as an inherent risk in outsourcing does not speak to third party involvement but instead appears to be a generic definition of cyber risk. Amended to expand on the issues that are associated with cyber risk in an outsourcing arrangement.

risk mitigation strategies are more robust (see Section 9 of this Guideline).
26. 5.3-5.5 Entire sections In our experience, most service providers
will be very reluctant to allow a contracting party to unilaterally dictate the policies and procedures, which such service provider must adopt. As such, we are concerned that such requirement may restrict our ability to engage service providers to the extent that our preferred service providers do not agree to such provisions. As an alternative approach, the CBTT may wish to consider [SSAE 18, 'auditing guideline in connection with the processes and controls for the services outsourced to third party vendors. It appears that such provisions already cover the CBTT’s concerns and, as such, our respectful recommendation would be to require RFIs to adopt such standard. Where the RFI outsources material functions, activities or processes that can impact the Bank’s risk assessment of the RFI, it is imperative that the Bank has access to information on the service provider.
27. 5.3.5 The outsourcing does not impair the
Central Bank’s ability to exercise its regulatory responsibilities:
a) Therefore, the RFI should include, as a condition in the outsourcing contract, the ability of the Central Bank to request an examination or audit of the service provider which will be We have a strong concern that most service providers will be reluctant to agree to including provisions allowing for the CBTT’s examination rights, particularly where such service providers are not regulated by the CBTT or, in some cases, may not even be present in Trinidad and Tobago. Such provisions may severely restrict the Company’s ability to outsource
Section 5.3.5 referenced is now 5.3.4.
The concern is noted however contracts are generally subject to legal and regulatory requirements of the parties. Since this Guideline, once enforced, will be binding subordinate legislation and therefore bolster the negotiating positions of RFIs. Additionally, it is noted that access to audit reports etc. related to the outsourced activity should

undertaken by the RFI or an independent auditor. An examination or audit of the service provider under these circumstances would be specific to the service provider’s activities as it relates to the outsourcing arrangement with the RFI. b) The Central Bank should be granted access to internal and external audit reports prepared on the service provider in respect of the outsourced activity, function, process or service. c) The RFI is to ensure that the outsourcing contract does not impair its ability to access all books, records and information on the outsourced activity, function or service. All such information should be accessible to the Central Bank1 upon request, whether held by the RFI or service provider certain services to service provides who would otherwise be acceptable under normal circumstances already be
part of the monitoring framework of
RFIs. The Central Bank further notes that audits of the provider are not to be performed by the Central Bank, but by the RFI/third party as appropriate.

1 Section 78 (1) (a) of the Financial Institutions Act, 2008 grants the Central Bank the power to request information from “an agent” of a licensee. A service provider would be considered an agent of the RFI. Section 11(1)(a) of the IA also provides that the Inspector may request information from any person acting on behalf of an insurer of FHC, which would include a service provided acting on behalf of an RFI in relation to an outsourced activity. Section 10(12) of the IA and 62(14) of the FIA provide that the Central Bank shall have access to, inter alia, all books, records and any other documents (including those stored in electronic form) of a registrant/licensee or FHC, even where in the possession of another person, which would include the provider of outsourced services.

28. 5.3.5 a) The outsourcing does not impair the
    Central Bank’s ability to exercise its regulatory responsibilities:
    a) Therefore, the RFI should include, as a condition in the outsourcing contract, the ability of the Central Bank to request an examination or audit of the service provider which will be undertaken by the RFI or an independent auditor. An examination or audit of the service provider under these circumstances would be specific to the service provider’s activities as it relates to the outsourcing arrangement with the RFI. The Central Bank should provide more specific guidance relating to the execution of the “right to audit clause” for cloud outsourcing, so that RFIs can be in a better position to negotiate the terms of contracts relating to cloud computing. This has been the approach taken by some regulators including the European Banking Authority. There is the possibility that multiple regulators across the region may request an examination of a service provider within a short time period. We therefore ask the Central Bank to consider acceptance of the results of an examination conducted within a pre￾determined period.
    Section 5.3.5 referenced is now 5.3.4.
    The section as drafted does not prevent the Central Bank from accepting an audit already conducted/requested by another regulator. This discretion that the Central Bank has is reflected at 5.3.4 (b). However the audit right between the provider and the RFI must be included in the contract.
29. 5.3.5 a) & c) The outsourcing does not impair the
    Central Bank’s ability to exercise its regulatory responsibilities:
    a) Therefore, the RFI should include, as a condition in the outsourcing contract, the ability of the Central Bank to request an examination or audit of the service provider, which will be undertaken by the RFI or an independent auditor. An The Central Bank should provide more specific guidance relating to the execution of the “right to audit clause” for cloud outsourcing, so that RFIs can be in a better position to negotiate the terms of contracts relating to cloud computing. This has been the approach taken by some regulators including the European Banking Authority. There is the possibility that multiple regulators across the region may request an examination of a service provider within a short time period. We therefore
    Section 5.3.5 referenced is now 5.3.4.
    Section 5.3.4 (a) as drafted does not
    prevent the Central Bank from accepting an audit already conducted/requested by another regulator. The discretion that the Central Bank has is reflected at 5.3.4 (b). However, the audit right between the provider and the RFI must be included in the contract. On the issue of the right to access the books etc. of the service provider in subsection section (c) this may not be

examination or audit of the service provider under these circumstances would be specific to the service provider’s activities as it relates to the outsourcing arrangement with the RFI. c) The RFI is to ensure that the outsourcing contract does not impair its ability to access all books, records and information on the outsourced activity, function or service. All such information should be accessible to the Central Bank2 upon request, whether held by the RFI or service provider ask the Central Bank to consider acceptance of the results of an examination conducted within a pre￾determined period. What type of audit reports would CBTT consider acceptable from the RFI and service provider? Or more specifically, what information should be included in this report? If the RFI ensures, as stated in sub-clause c), that the contract does not affect its ability to access the books etc. of the service provider, by extension, these documents can be made available to the CBTT upon its request, and that the contract gives the RFI the right to evaluate as stated in clause 5.3.3, the need for the contract to also contain a condition, as suggested in sub-clause a), that the CBTT can request an examination or audit of the service provider to be undertaken by the RFI or an independent auditor appears excessive. Any powers by the CBTT with respect to this Clause should be exercised through the RFI. adequate to treat with a specific issue that requires a targeted examination typically conducted through an audit. The Central Bank will not be in a position to provide a comprehensive list of the types of information that may be required in advance of an audit request. However, generally such information will seek to address whether the risks to which the RFI is exposed through the contract are being adequately managed.
30. 5.3.5 a) & c) What type of audit reports would CBTT
consider acceptable from the RFI and service provider? Or more specifically,
Section 5.3.5 referenced is now 5.3.4.
On the issue of the right to access the books etc. of the service provider in

2 Section 78 (1) (a) of the Financial Institutions Act, 2008 grants the Central Bank the power to request information from “an agent” of a licensee. A service provider would be considered an agent of the RFI.

what information should be included in this report? If the RFI ensures, as stated in sub-clause c), that the contract does not affect its ability to access the books etc. of the service provider, by extension, these documents can be made available to the CBTT upon its request, and that the contract gives the RFI the right to evaluate as stated in clause 5.3.3, the need for the contract to also contain a condition, as suggested in sub-clause a), that the CBTT can request an examination or audit of the service provider to be undertaken by the RFI or an independent auditor appears excessive. Any powers by the CBTT with respect to this Clause should be exercised through the RFI. subsection section (c) this may not be adequate to treat with a specific issue that requires a targeted examination typically conducted through an audit. The Central Bank will not be in a position to provide a comprehensive list of the types of information that may be required in advance of an audit request. However generally such information will seek to address whether the risks to which the RFI is exposed through the contract are being adequately managed.
31. 5.3.6 The Central Bank is notified of any
material changes to the terms and conditions of the materially outsourced contract. Material changes to the terms and conditions will be relevant to the impact the changes may have on the criteria outlined in Section 4 of the Guideline, and which affects the obligations of the parties. Where the Central Bank has concerns about any aspect of the outsourcing contract, it is expected that both the RFI and the service provider would acknowledge these concerns and work with the Central Bank to address the identified issues. We recommend that the phrase “material change/s” as used in the Guideline be defined. This provision has been deleted however the Central Bank retains the right to review any documentation that relates to any material changes to the terms and conditions of materially outsourced contracts.

32. 5.4.2 Appropriate due diligence and
    assessment of the service provider should include a review of:
    a) the experience and the technical competence of its management and relevant staff to implement and support the proposed activity; b) the security, technological and internal controls, reporting and monitoring environment including its ability to adequately maintain confidentiality of information; c) its financial soundness and ability to service commitments; d) its business reputation and culture, for example consideration of complaints and pending litigation where appropriate; e) its business goals, objectives, continuity management and strategies; f) laws and regulations of the service provider’s jurisdiction (where applicable); Due Diligence should include checking that the principals and the company are not designated / sanctioned persons to manage compliance and reputation risks Amended to include this additional requirement.
33. 5.4.2 We recommend adding language that this
    criteria is for material outsourcing engagements. Amended to address the need to ensure these requirements are applied particularly in the case of material outsourcing arrangements.

g) whether a licence will be required to conduct the outsourced activities; and h) h) any other relevant information
34. 5.5.1 The contract should be sufficiently
flexible to allow for renegotiation and renewal to enable the RFI to retain an appropriate level of control over outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations. Therefore, key provisions of the outsourcing contract should include inter alia:
a) Limitations or conditions, if any, on the service provider's ability to subcontract. However, where subcontracting is permitted, it should require the prior consent of the RFI, and any obligations pertaining to the subcontract should be clearly stipulated; b) Requirements that the service provider comply with the same (or higher) standards as those that the RFI is required to comply with relating to IT, security, Pursuant to Guideline 5.5.1 we seek clarification as to whether the RFI will be expected to perform due diligence on the sub-contractor or whether the RFI would be able to rely on the due diligence conducted by the main provider. The RFI is not required to conduct a full scope due diligence on the subcontractor. However, the RFI is expected to at minimum consider if it can maintain a similar control over the risks when a service provider outsources to other third parties as in the original direct outsourcing arrangement. Additionally, the contract should contain provisions that the provider of the outsourced service must remain responsible for all of its obligations under this agreement.

confidentiality and disclosure of all information relating to or obtained from the RFI; c) Insurance, guarantees and indemnities; d) Obligation of the service provider to provide, upon request, records, information and/or assistance concerning the outsourcing arrangements to the RFI’s auditors and/or its regulators; e) Mechanisms to resolve disputes that might arise under the outsourcing arrangement; f) Business continuity provisions; g) Examples of the type of events/adverse developments and the circumstances under which the service provider should report to the RFI in order for the RFI to take prompt risk mitigation measures; h) Provisions for the termination of the contract, transfer of information and exit strategies; and

i) Responsibility of the service provider for compliance with local laws and regulations as required.
35. 5.5.1.(a) The contract should be sufficiently
flexible to allow for renegotiation and renewal to enable the RFI to retain an appropriate level of control over outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations. Therefore, key provisions of the outsourcing contract should include inter alia:
(a) Limitations or conditions, if any, on the service provider's ability to subcontract. However, where subcontracting is permitted, it should require the prior consent of the RFI, and any obligations pertaining to the subcontract should be clearly stipulated Clarification should be provided on what if anything is required in the case of sub￾contracting/ sub-outsourcing. e.g. Where an agreement is entered into between the RFI and a third party and subsequently the third party decides to sub-contract certain aspects of the service (with the consent of the RFI), what is CBTT’s expectation of the RFI in this instance. The RFI is not required to conduct a full scope due diligence on the subcontractor. However, the RFI is expected at a minimum to consider if it can maintain a similar control over the risks when a service provider outsources to other third parties as in the original direct outsourcing arrangement. Amended accordingly.
36. 5.5.1 (c) The contract should be sufficiently
flexible to allow for renegotiation and renewal to enable the RFI to retain an appropriate level of control over outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations.
Section 5.5.1 (c) provides that outsourcing
contracts are to have provisions on guarantees. Guarantees are not typical clauses in outsourcing contracts. We recommend that the appropriate provision would be for outsourcing Amended accordingly.

Therefore, key provisions of the outsourcing contract should include inter alia:
(c) Insurance, guarantees and indemnities contracts to include provisions for insurance and indemnity clauses.
37. 5.6.2 Specific contingency plans should be
developed separately for each material outsourcing arrangement which becomes more important based on the degree of materiality. Back-up arrangements should be tested at least annually by the service provider and the results provided to the RFI, together with any significant changes in the business resumption plan. The service provider should inform the RFI of material changes to their business continuity plans. Consideration should be given to applying a risk-based approach as opposed to annually for the frequency of testing back￾up arrangements. The Central Bank considers annual testing to be appropriate.
38. 5.6.2 Refers once again to the “degree of
materiality”. As suggested, this should be made clear in the Guideline to assist in the development of contingency plans. The reference to “degree of materiality” has been removed from the guideline.
39. 5.6.3 There are also risks where multiple
service providers depend on the same provider of business continuity services with a common disaster recovery site. Any disruption that affects a large number of service providers may result in a lack of capacity for the business continuity services. At the end of the section, consider including specific exit strategy provisions in respect of outsourcing of material activities/functions that the RFI should be able to undertake at least one of the following, within an appropriate time frame:
 transfer the function to an alternative service provider;  reintegrate the function; Amended to include details on the requirement. It is noted that section 5.5.1 (h) already contains the requirement for the contract to treat with transfer of information and exit strategies.

 or discontinue the business activities that are depending on the function. This provision should also be built into the contract.
40. 5.7.3 Any transfer of customer information
from the RFI to a third party service provider under the terms of an outsourcing contract should be with the customer’s consent. Such consent may be obtained at the initiation of the customer/RFI relationship as a term of the customer agreement or alternatively, prior to the proposed transfer of information. The rights of customers should not be affected because of the outsourcing arrangement between the service provider and the RFI. Principle 7 BANK ISSUE: This clause refers to customer consent for the transfer of information to a third-party service provider in an outsourcing contract. It appears that this requirement for prior customer consent may be based on provisions contained in Parts III and IV of the Data Protection Act, Chap 22:04. We note further that these sections have not yet been proclaimed, and it is our understanding that the Act which was passed some time ago, may be the subject of review and amendment (or possibly even repeal and replacement by new legislation), given the developments in privacy and data protection laws globally which have since occurred. The requirement to obtain customer consent will prove particularly onerous and consideration should be given instead to an exemption for the sharing of such information by financial institutions with outsourced technology providers, where these are necessary for carrying out their business subject to financial institutions complying with the other safeguards for These sections in the Guideline are not based on the provisions of the Data Protection Act but rather the confidentiality provisions in legislation that already governs the RFIs e.g. section 55(1) & (2) of the FIA and section 259(1) & (2) of the IA. Additionally, the Guideline does allow for the RFI to obtain consent as part of the general terms and conditions at the initiation of the customer/RFI relationship, so as to prevent the need for one off consents.

protection of customer data as contained in the Guidelines including but not limited to encryption of customer data.
41. 6.1 RFIs ideally should not outsource
certain core management functions pertaining to internal controls, compliance, and decision-making functions. While the RFI is not prohibited from doing so, the Central Bank recommends that the following not be outsourced where possible:
a) Corporate planning, strategic planning, risk management and control; b) Determining compliance with Know Your Customers (KYC) norms for opening accounts; and c) Loan approvals. Business Activities/Services That Should Not Be Outsourced This section provides that regulated financial institutions should not outsource certain core management functions pertaining to internal controls, compliance and decision making. The examples of functions that should not be outsourced include corporate planning, strategic planning, risk management and loan approvals. We are of the view that this section should not apply to intra-group outsourcing arrangements such as those between a financial holding company and its subsidiaries. As you are aware, the outsourcing of certain functions by a financial institution to a financial holding company is permitted under section 69 of the Financial Institutions Act, Chap 79:06. Also, the Corporate Governance Guidelines issued by the Central Bank requires the parent company of a financial institution within a financial group to be informed of all material risks and matters that affect the entire group. Accordingly, we are of the view that the restriction on outsourcing The Comment is noted however the
section specifically provides that the RFI
is not prohibited from outsourcing these matters. An additional provision has been included as follows for clarity:
“However, RFIs are permitted to implement intra-group outsourcing arrangements within a financial group structure, subject to the risk management principles established in this Guideline. RFIs shall not outsource the following activities to persons outside the financial group”

should not apply to outsourcing within financial groups.
42. 6.1 This section states that “RFIs ideally
should not outsource certain core management functions pertaining to internal controls, compliance and decision making functions.” Does this mean that internal audit, compliance and management roles cannot be outsourced? Or is it that the internal control, compliance and decision making responsibilities of a management role should not be outsourced? If so then does that not suggest that management roles should not be outsourced? What should not be outsourced should be clearly/specifically stated for the avoidance of doubt. The Central Bank has referenced the functions that should ideally not be outsourced. Also, the provision will be reworded as follows:
“However, RFIs are permitted to implement intra-group outsourcing arrangements within a financial group structure, subject to the risk management principles established in this Guideline. RFIs shall not outsource the following activities to persons outside the financial group….”
43. 6.1 We are respectfully of the view that there
should not be any prohibition on activities which may be outsourced by an RFI. Such a position would pose an undue burden to any RFI in respect of the manner in which it may wish to conduct its business. That said, an alternative approach may be to revise the definition of the term “Outsourcing” to remove affiliates within the same corporate group, which would provide greater flexibility to RFIs. Please note if all activities are outsourced to a service provider then the service provider may require a licence under the jurisdiction’s laws. Consequently, there must be limitations on the activities outsourced to a service provider. The provision will be reworded as follows:
“However, RFIs are permitted to implement intra-group outsourcing arrangements within a financial group structure, subject to the risk

management principles established in this Guideline. RFIs shall not outsource the following activities to persons outside the financial group….”
44. 6.1 & 6.2 6.1 RFIs ideally should not outsource
certain core management functions pertaining to internal controls, compliance, and decision-making functions. While the RFI is not prohibited from doing so, the Central Bank recommends that the following not be outsourced where possible:
a) Corporate planning, strategic planning, risk management and control; b) Determining compliance with Know Your Customers (KYC) norms for opening accounts; and c) Loan approvals
6.2 The RFI remains ultimately
responsible and accountable to the Central Bank and the customer for any error or breach by the service provider in all of its outsourcing contracts. Determining compliance with Know Your Customers (KYC) norms for opening accounts. Please provide clarification as this may impact our Digital transformation initiative Regulatory obligations in respect of the Money Laundering/ Financing of Terrorism/ Proliferation Financing (ML/TF/PF) control function, particularly the activities that support statutory reporting obligations for ML/TF/PF should not be outsourced. While collection of Know Your Customer (KYC) or screening against lists could be outsourced, the assessment of the risk and the determination of whether to report the matter to any authority should remain the responsibility of the RFI. Also, the provision will be reworded as follows:
“However, RFIs are permitted to implement intra-group outsourcing arrangements within a financial group structure, subject to the risk management principles established in this Guideline. RFIs shall not outsource the following activities to persons outside the financial group…”
45. 6.1 & 6.2 Business Activities/Services That
Should Not Be Outsourced This section provides that regulated financial institutions should not outsource This section does not prohibit the outsourcing but references that the RFI should ideally not outsource certain matters where possible. An RFI as part of its outsourcing policy should identify

certain core management functions pertaining to internal controls, compliance and decision making. The examples of functions that should not be outsourced include corporate planning, strategic planning, risk management and loan approvals. We are of the view that this section should not apply to intra-group outsourcing arrangements such as those between a financial holding company and its subsidiaries. The outsourcing of certain functions by a financial institution to a financial holding company is permitted under section 69 the Financial Institutions Act. Also, the Corporate Governance Guidelines issued by the Central Bank requires the parent company of a financial institution within a financial group to be informed of all material risks and matters that affect the entire group. Accordingly, we are of the view that the restriction on outsourcing should not apply to outsourcing within financial groups. any functions that, for strategic or internal control reasons, the RFI would not contemplate outsourcing. Also, the provision will be adjusted as follows:
“However, RFIs are permitted to implement intra-group outsourcing arrangements within a financial group structure, subject to the risk management principles established in this Guideline. RFIs shall not outsource the following activities to persons outside the financial group….”
46. 7 Outsourcing
arrangement with an
External
Auditor
Entire Section Consider including a provision to clarify that where non-audit services are outsourced to the external auditor that such arrangements should be set at arm’s length to avoid conflicts of interest. Generally, consider including a requirement for RFIs to identify, assess Amended to specifically reference the arm’s length basis of the transaction with the External Auditor. The Corporate Governance Guideline deals comprehensively with conflicts of interest. Further 5.2.3 of the Guideline requires that the RFI’s risk management

and manage COIs in their outsourcing arrangements, including intra-group arrangements framework include all associated risks and risk mitigation strategies of the RFI, this will encompass conflicts of interest.
47. 7.2.1 Notwithstanding, 7.1, there are certain
non-audit services that must not be outsourced to the RFI’s current external auditor responsible for its annual audit. Such non-audit services include:
7.2.1 Actuarial services
For 7.2.1 the following should be added after Actuarial services - unless it is reasonable to conclude that the results of the service will not be subject to audit procedures during an audit of the RFI’s financial statement. As there are different types of actuarial services Agreed. The provision will be changed.
48. Sections 8 & 9 Section 8- Material Intra- group
outsourcing arrangements & Section 9- Outsourcing to a Cross Border Service Provider (CSBP) Our general concern with these Sections is that compliance with the provisions will likely create an undue burden to the Company and restrict the Company’s ability to freely contract with a service provider. We are of the view that Section 8 should be eliminated if exempted from the outsourcing guidelines such services provided by affiliates within the same corporate group. In connection with section 9, we respectfully are of the view that the CBTT may wish to alternatively consider allowing each RFI to provide a proposed policy on how it intends to monitor its third-party service providers, which would allow each RFI to tailor the policies and procedures to its requirements and custom and be able to discuss together with the third party provider rather than imposed. The concern is noted however section 8 does not create additional restrictions but rather creates a framework to reduce the expectations applied to such outsourcing relationships in the intra-group setting. With respect to section 9 the items listed are minimum requirements. An RFI can engage in discussions with CBSPs and tailor the requirements once these minimum requirements are met.

49. 9.2 In addition to the assessment that
    would be conducted for a local outsourcing provider and the requirements for written outsourcing contracts in 5.5, RFIs engaged in any outsourcing arrangements with a CBSP should:
    9.2.1 Enter (in principle) into
    arrangements only with service providers operating in jurisdictions that generally uphold confidentiality clauses and agreements;
    9.2.2 Clearly specify the governing
    law of the arrangement;
    9.2.3 Ensure that the outsourced
    activity is conducted in a manner so as not to hinder efforts to supervise or reconstruct the Trinidad and Tobago activities of the RFI (that is, from its books, accounts and documents) in a timely manner; and
    9.2.4 Notify the Central Bank if any
    overseas authority was to seek access to its customer Outsourcing To A Cross-Border Service Provider (CBSP) This section requires regulated financial institutions to enter into outsourcing contracts with service providers operating in jurisdictions that “generally uphold confidentiality clauses and agreements”. We propose that this provision be reworded. If there are specific countries to which the Central Bank prohibits regulated financial institutions from outsourcing, then the Guideline should specify these countries. Alternatively, we recommend a clause to be added allowing a RFI to outsource functions to entities outside Trinidad & Tobago where the outsourcing is to an entity in a jurisdiction with an equivalent standard of data protection and privacy legislation, regulation or supervision as exists in Trinidad and Tobago. Cloud Computing – Internal Stakeholders We recommend that consideration be given to removing Internal Audit from the list requiring internal audit to evaluate cloud computing service providers. As a third line of defense internal audit should evaluate the processes and controls in place, and be embedded in the process Amended to provide for an equivalency assessment. On the issue of Internal audit being involved in cloud computing assessments prior to engagement, the Central Bank agrees with your comment and has amended the guideline accordingly.

information or if a situation was to arise where the rights of access of the RFI and the Central Bank have been restricted or denied. as a control point, as it removes their objectivity in auditing.
50. Appendix 1 Entire Table The table requests estimates of annual
spending on the arrangement and estimated contract value. We propose that one or other item be included as opposed to both. Both columns represent different elements of the costs involved in contract services. The annual figure may include varying phases of a project/service/statement of work per year and is essential in representing the annual cost of the outsourcing arrangement to the RFI. This will be different from the contract price, which address the entire value over the life of the contract. Both figures are of importance to the Central Bank.
51. Appendix 2
Examples of
Commonly
Outsourced
Activities and
Services
Entire section This Appendix was included in the Table of Contents, however, it has not been referenced in the Clauses of the Guideline. As such, what is the purpose of the
Appendix? Are these examples a guide to
the nature of outsourced activities that are considered material and require notification to the CBTT? This should be clarified. Further, is it the intention that CBTT will be providing case studies, data analysis or further guidance at regular intervals to RFI(s) on this subject matter? The Guideline has been amended to reference the Appendix. The matters listed are not necessarily categorised as material or non-material. Rather this determination must be based on the RFIs assessment in accordance with the criteria contained in section 4. The outcome of this assessment will vary for each RFI. On the issue of further guidance etc. the Central Bank will issue any further communication clarifying or updating requirements through circular letters as necessary. Guidance may be also sought

directly by the RFI from the Central Bank.
52. Appendix 2
Examples of
Commonly
Outsourced
Activities and
Services
Entire section Outsourcing is defined in the Glossary of the Guideline as the regulated entity’s use of a third party or service provider to perform activities on a continuing basis that would normally be undertaken by the regulated entity. The examples in the Appendix are not all activities, which would normally be undertaken by a regulated financial institution. An example is Real Estate Administration (building maintenance, property evaluation, and rent collection). As such, we would propose that the examples be revised to only capture activities normally undertaken by the regulated entity. The activities listed may apply in some manner to the wide cross section of RFIs to which this Guideline applies.
53. Appendix 3,
item 5
Appendix 3- Minimum Elements of
Outsourcing Contracts
5. Insurance, Guarantees, Indemnities
(Section 5.5.1(c))
This item sets out the need for insurance, guarantees and indemnities. For completeness and following from the comments on Section 5.5.1(c), the term “guarantees” should be deleted. This Appendix was included in the Table of Contents, however, it has not been referenced in the Clauses of the Guideline. As such, what is the purpose of the
Appendix? Are these examples a guide to
the nature of outsourced activities that are The Guideline has been amended to address these issues.

considered material and require notification to the CBTT? This should be clarified. Further, is it the intention that CBTT will be providing case studies, data analysis or further guidance at regular intervals to RFI(s) on this subject matter?
54. Appendix 3,
item 5
Appendix 3- Minimum Elements of
Outsourcing Contracts
Insurance, Guarantees, Indemnities (Section 5.5.1(c)) Minimum Elements of Outsourcing Contracts This item sets out the need for insurance, guarantees and indemnities. For completeness and following from the comments on Section 5.5.1(c), the term “guarantees” should be deleted. Amended accordingly.
55. Appendix 3,
item 7
Appendix 3- Minimum Elements of
Outsourcing Contracts
Audit and Examination Rights – e.g. rights of the RFI to audit the service provider or appoint an auditor to do same; rights of the Central Bank to audit/ inspect the service provider; rights of access by the RFI and the Central Bank to any reports on the service provider by its internal or external auditors. (Sections 5.3.3 and 5.3.) While most of the items listed in Appendix III which provide for the Minimum Elements of Outsourcing Contracts, are already incorporated into the Bank's service contracts, it is noted that item 7 of
Appendix III which is further articulated
in Part 5.3.5 of the draft Guidelines requires the inclusion of a clause within material service contracts which effectively gives the CBTT the right to audit or inspect the operations of the service provider in relation to the outsourced activities. It is our view that since the CBTT has the underlying right to inspect financial institutions or require the production of internal documentation in This provision is intended to ensure that the Central Bank can assess all aspects of an RFI’s operations. In addition, the Central Bank will not be conducting the audit but rather would be using an independent auditor. However, we acknowledge that this may create challenges re: negotiating with service providers. Consequently, the provision will be amended to reflect that the Central Bank can request any information from the RFI as it relates to the material service providers.

accordance with the Financial Institutions Act Chap 79:09 (FIA), this clause may not be practical when considered in the context of negotiating with third parties, especially overseas providers. We therefore recommend that the areas which the CBTT envisages to be audited/ inspected be clearly identified and also reduced to a requirement for information from time to time (vs. an audit/ inspection) from the financial institution which it supervises and limited to what can be obtained from the financial institution. A third-party entity, which does not fall within the supervisory framework of the FIA may likely challenge the jurisdiction of the CBTT to audit/inspect them. This will in turn protract the negotiation and conclusion of contracts with service providers