Guidelines on Outsourcing

5th December, 2014 Zambia Gazette 775
GAZETTE NOTICE No. 717 OF 2014 [5356662/2
Bank of Zambia
Guidelines on Outsourcing
1.0 Introduction
1.1 Regulated entities globally are increasingly resorting to outsourcing as a way of both reducing cost and accessing specialist
expertise and capabilities not available internally and for achieving strategic objectives and business aims. Outsourcing may be defined as a regulated entity s use of a third party (either an affiliated entity within a corporate group or an entity that is external to the corporate group) to perform activities on a continuing basis that would normally be undertaken by the regulated entity itself, now or in thefuture.
1.2 Outsourcing brings with it several risks therefore has the potential to significantly alter the risk outlook and profile of a regulated
entity. Some key risks in outsourcing include among others the following:
(i) Strategic Risk;
(ii) Reputational Risk;
(iii) Compliance Risk;
(iv) Operational Risk;
(v) Exit Strategy Risk;
(vi) Counterparty Risk;
(vii) Country Risk;
(viii) Contractual Risk;
(ix) Access Risk; and
(x) Concentration and Systemic Risk.
The failure of a service provider to deliver a specified service, a breach in security/ confidentiality, or non-compliance with legal and regulatory requirements by either the service provider or the outsourcing regulated entity can lead to financial losses for the regulated entity and could also lead to systemic risks within the entire financial system in the country. It would therefore be imperative for the regulated entity outsourcing its activities to put in place an effective risk management framework to manage and control these risks.
2.0 Purpose and Application of the Guidelines
2.1 These guidelines apply to all regulated entities licensed under the Banking and Financial Services Act (Cap 387) and the National
Payment Systems Act (2007). The purpose of the guidelines is to provide direction and guidance to regulated entities to adopt sound and responsive risk management practices for effective oversight and management of risks arising from such outsourcing activities.
2.2 These Guidelines also aim to ensure that all material outsourcing arrangements involving material business activities entered into
by regulated entities are subject to appropriate due diligence, approval and on-going monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that regulated entities are able to meet both their financial and service obligations to customers and the Bank of Zambia. Some ofthe key requirements of these Guidelines include that a regulated entity must:
-have a policy relating to outsourcing of material business activities; -have sufficient monitoring processes in place to manage the outsourcing of material business activities; -for all outsourcing of material business activities with third parties, have a legally binding agreement in place, unless otherwise agreed by the Bank of Zambia; and -obtain approval from the Bank of Zambia prior to entering into agreements to outsource material business activities to service providers.
2.3 These guidelines are applicable to outsourcing arrangements entered into by a regulated entity with a service provider located in
Zambia or elsewhere. The service provider may either be a member of the group/conglomerate to which the regulated entity belongs, or an unrelated party.
2.4 The underlying principles of these guidelines is that the regulated entity should ensure that outsourcing arrangements neither
diminish its ability to fulfill its obligations to customers and the Bank of Zambia nor impede effective supervision by the Bank of Zambia. Regulated entities, therefore, have to take steps to ensure that the service provider employs the same standard of care in performing the services as would be employed by the regulated entity if the activities were conducted within the regulated entities and not outsourced. Accordingly, regulated entities should not engage in outsourcing activities that would result in the compromise or weakening of their internal controls, business conduct or reputation.
3.0 Prohibited Outsourcing Activities
Regulated entities shall not outsource the following:
(a) core management functions such as corporate planning, organisation, management and control and decision-making functions; (b) determining compliance with Anti-Money Laundering and Combating of Financing of Terrorism and Know Your Customer (KYC) norms for opening accounts; (c) decisions whether or not to grant credit; (d) investment portfolio decisions; (e) Risk management function; and (f) Activities considered illegal under any law in Zambia.

776 Zambia Gazette 5th December, 2014
4.0 Material Outsourcing
The Bank of Zambia will review and monitor the implementation of these guidelines to assess the quality of related risk management systems particularly in respect of material outsourcing. Material outsourcing arrangements are those, which if disrupted, have the potential to significantly impact the business operations, reputation or profitability. Materiality of outsourcing would be based on:
(a) The level of importance to the regulated entity of the activity being outsourced; (b) The potential impact of the outsourcing on the regulated entity on various performance measures such as earnings, solvency, liquidity, funding and capital and risk profile; (c) The likely impact on the regulated entity's reputation and brand value, and ability to achieve its business objectives, strategy and plans, should the service provider fail to deliver the service; (d) The cost of the outsourcing as a proportion of total operating costs of the regulated entity; and (e) The aggregate exposure to that particular service provider, in cases where the regulated entity outsources various functions to the same service provider.
5.0 Activities not considered to be Outsourcing
(a) Market information services such as Bloomberg, Moody's, Standard & Poor's; (b) Common network infrastructures such as Visa and MasterCard; (c) Clearing and settlement arrangements between clearing and settlement institutions and their members and similar arrangements between members and non-members; (d) Correspondent banking services; and (e) Introducer arrangements (where the institution does not have any contractual relationship with customers).
6.0 Legal obligations and regulatory and supervisory requirements
6.1 The outsourcing of any activity by regulated entity does not diminish its obligations and those of its board and senior management
who have the ultimate responsibility for the outsourced activity. Regulated entities shall therefore remain responsible for the actions of their service provider including the confidentiality of customer information that come into the custody ofthe service provider. Regulated entities should retain ultimate control of the outsourced activity.
6.2 It is essential for the regulated entity, when performing its due diligence in relation to outsourcing, to consider all relevant laws,
regulations, guidelines and conditions of approval, licensing or registration. .
6.3 Outsourcing arrangements should not affect the rights of a customer against the regulated entity, including the ability of the
customer to obtain redress as applicable under relevant laws. Since the customers are required to deal with the service providers in the process of dealing with the regulated entity, regulated entities should reveal to their customers in the product brochures/agreements etc., the role of the service provider and their obligation towards the customers.
6.4 Whether the service provider is located in Zambia or abroad, outsourcing should not impede or interfere with the ability of the
regulated entity to effectively oversee and manage its activities or impede the Bank of Zambia in carrying out its supervisory functions and objectives.
6.5 Regulated entities need to have a robust grievance redress mechanism, which in no way should be compromised on account of
outsourcing.
7.0 Approvals for Outsourcing Arrangements
A regulated entity that is planning material outsourcing or is planning to vary any such outsourcing arrangements should seek prior written approval ofthe Bank of Zambia. The minimum criteria for evaluating requests from regulated entities for outsourcing will include the following:
(a) Demonstration of the need for the services being outsourced; (b) A clear basis for determining the fees payable; (c) Potential impact of outsourcing arrangements on the regulated entity's tariff structure; (d) A clear strategy for informing minority shareholders on the outsourcing the arrangements and their implications; (e) Evidence of due diligence on the capacity of the service provider; (f) Potential impact of the outsourcing on earnings, solvency, liquidity, funding, capital and risk profile; (g) Aggregate exposure to a particular service provider in cases where the regulated entity outsources various functions to the same service provider; and (h) Ability to maintain appropriate internal controls and meet regulatory requirements, ifthere were operational problems faced by the service provider.
8.0 Risk Management Practices for Outsourced Financial Services
8.1 Outsourcing Policy
A regulated entity intending to outsource any of its activities should put in place a comprehensive outsourcing policy, approved by its Board, which incorporates, inter alia, criteria for which activities can be outsourced, selection of such activities as well as service providers, delegation of authority depending on risks and materiality and systems to monitor and review the operations of these activities.

5th December, 2014 Zambia Gazette 777
8.2 Role of the Board and Senior Management
8.2.1 Responsibilities of the Board of Directors
The board of the regulated entity, or a committee delegated by it, should be responsible for- (a) Approving a framework to evaluate the risks and materiality of all existing and prospective outsourcing and the policies that apply to such arrangements; (b) Laying down appropriate approval authorities for outsourcing depending on risks and materiality; (c) Undertaking regular review of outsourcing strategies and arrangements for their continued relevance, and safety and soundness; and (d) Deciding on business activities of a material nature to be outsourced, and approving such arrangements.
8.2.2 Responsibilities of Senior Management
(a) Evaluating the risks and materiality of all existing and prospective outsourcing, based on the framework approved by the board; (b) Developing and implementing sound and prudent outsourcing policies and procedures commensurate with the nature, scope and complexity of the outsourcing; (c) Reviewing periodically the effectiveness of policies and procedures; (d) Communicating information pertaining to material outsourcing risks to the board in a timely manner; (e) Ensuring that contingency plans, based on realistic and probable disruptive scenarios, are in place and tested; (/) Ensuring that there is independent review and audit for compliance with set policies; and (g) Undertaking periodic review of outsourcing arrangements to identify new material outsourcing risks as they arise.
8.3 Evaluation of the Risks
The key risks and concerns in outsourcing that need to be looked into by the regulated entity include:- Risk Strategic Risk Major Concerns The service provider may conduct business on its own behalf, which is inconsistent with the overall strategic goals of the regulated entity. Poor service from the service provider, its customer interaction not being consistent with the overall standards of the regulated entity. Failure to fully comply with privacy, consumer and prudential laws and other regulations. The concerns arising from technology failure, fraud, error, inadequate financial capacity to fulfill obligations and/or provide remedies. This could arise from over-reliance on one firm, the loss of relevant skills in the regulated entity itself preventing it from bringing the activity back in-house and contracts entered into wherein speedy exits would be costly. Due to inappropriate underwriting or credit assessments or other circumstances where the counterparty is unable to fulfill its obligations. Due to the political, social or legal climate creating added risk. Arising from whether or not the regulated entity has the ability to enforce the contract. Due to lack of control of individual regulated entity over a service provider, more so when overall financial sector has considerable exposure to one service provider. Reputational Risk Compliance Risk Operational Risk Exit Strategy Risk Counterparty Risk Country Risk Contractual risk Concentration and Systemic Risk
8.4 Evaluating the Capability of the Service Provider
8.4.1 In considering or renewing an outsourcing arrangement, appropriate due diligence should be performed to assess the capability
ofthe service provider to comply with obligations in the outsourcing agreement. Due diligence should take into consideration qualitative, quantitative, financial, operational and reputational factors. Regulated entities should consider whether the service providers' systems are compatible with their own and also whether their standards of performance including in the area of customer service are acceptable to it. Where possible, the regulated entity should obtain independent reviews and market feedback on the service provider to supplement its own findings.
8.4.2 Due diligence should involve an evaluation of all available information about the service provider, including but not limited to:-
(a) Past experience and competence to implement and support the proposed activity over the contracted period; (b) Financial soundness and ability to service commitments even under adverse conditions; (c) Business reputation and culture, compliance, complaints and outstanding or potential litigation; (d) Security and internal control, audit coverage, reporting and monitoring environment, Business continuity management; (e) External factors like political, economic, social and legal environment ofthe jurisdiction in which the service provider operates and other events that may impact service performance; and. (/) Ensuring due diligence by service provider of its employees.
8.5 The Outsourcing Agreement
8.5.1 The respective rights, roles and responsibilities of each party in the outsourcing arrangement should be documented in writing in
a service level agreement or an equivalent document. The terms and conditions governing the contract between the regulated entity and the service provider should also be carefully defined in written agreements and vetted by a competent authority! on their legal effect and enforceability.

778 Zambia Gazette 5th December, 2014
Every such agreement should address the risks and risk mitigation strategies identified at the risk evaluation and due diligence stages. The agreement should be sufficiently flexible to allow the regulated entity to retain an appropriate level of control over the outsourcing and the right to intervene with appropriate measures to meet legal and regulatory obligations.
8.5.2 Content of outsourcing agreement
At a minimum, a contract agreement should:
(a) Clearly define the activities to be outsourced including appropriate service and performance standards; (b) ensure that a regulated entity has access to all books, records and information relevant to the outsourced activity in the service provider; (c) provide for continuous monitoring and assessment by the regulated entity of the service provider so that any necessary corrective measure can be taken immediately; (d) Have a termination clause and minimum periods to execute a termination provision, if deemed necessary; (e) Have provisions on controls to ensure customer data confidentiality and service providers' liability in case of breach of security and leakage of confidential customer related information; (f) Provide for contingency plans to ensure business continuity; (g) provide. for the approval by the regulated entity of the use of subcontractors by the service provider for all or part of an outsourced activity; (h) Provide the regulated entity with the right to conduct audits, on the service provider whether by its internal or external auditors, or by agents appointed to act on its behalf and to obtain copies of any audit or review reports and findings made on the service provider in conjunction with the services performed for the regulated entity; (i) Include clauses to allow the Bank of Zambia or persons authorized by it to access the regulated entity's documents, records of transactions, and other necessary information given to, stored or processed by the service provider within a reasonable time; (j) also include clause to recognize the right of the Bank of Zambia to cause an inspection to be made of a service provider of a regulated entity and its books and account by one or more of its officers or employees or other persons; and (k.) Have provisions for dispute resolution mechanisms between the contracting parties and shall clearly state under which law these disputes shall be subjected to.
8.5.3 Outsourcing contracts between parties shall not have any exclusivity clauses to ensure that the regulated entity retains control
over the outsourced activity.
8.6 Confidentiality and Security
8.6.1 Public confidence and customer trust in the regulated entity is a prerequisite for the stability and reputation of the regulated
entity. Hence the regulated entity should seek to ensure the preservation and protection of the security and confidentiality of customer information in the custody or possession of the service provider.
8.6.2 Access to customer information by staff of the service provider should be limited to those areas where the information is
required in order to perform the outsourced function.
8.6.3 The regulated entity should ensure that the service provider is able to isolate and clearly identify the regulated entity's customer
information, documents, records and assets to protect the confidentiality of the information.
8.6.4 Review and monitor the security practices and control processes of the service provider on a regular basis and require the
service provider to disclose security breaches.
8.6.5 The regulated entity should immediately notify Bank of Zambia in the event of any breach of security and leakage of
confidential customer related information. In these eventualities, the regulated entity would be liable to its customers for any damage.
8.7 Conduct of Service Providers
8.7.1 Regulated entities should ensure that the service providers are properly trained to handle with care, their responsibilities
particularly aspects like soliciting customers, hours of calling privacy of customer information and conveying the correct terms and conditions of the products on offer etc.
8.7.2 Recovery Agents should adhere to fair collection of dues and repossession of security. It is essential that the recovery agents
refrain from action that could damage the integrity and reputation ofthe regulated entity and that they observe strict customer confidentiality.
8.7.3 The regulated entity and their recovery agents should not resort to intimidation or harassment of any kind either verbal or
physical against any person in their debt collection efforts, including acts intended to humiliate publicly or intrude the privacy of the borrowers' family members, referees and friends, making threatening and anonymous calls or making false and misleading representations.
8.8 Business Continuity and Management of Disaster Recovery Plan
8.8.1 A regulated entity should require its service providers to develop and establish a robust framework for documenting, maintaining
and testing business continuity and recovery procedures. Regulated entities need to ensure that the service provider periodically tests the Business Continuity and Recovery Plan and may also consider occasional joint testing and recovery exercises with its service provider.
8.8.2 In order to mitigate the risk of unexpected termination of the outsourcing agreement or liquidation of the service provider,
regulated entities should retain an appropriate level of control over their outsourcing and the right to intervene with appropriate measures to continue its business operations in such cases without incurring prohibitive expenses and without any break in the operations of the regulated entity and its services to the customers.
8.8.3 In establishing a viable contingency plan, regulated entities should consider the availability of alternative service providers or
the possibility of bringing the outsourced activity back in-house in an emergency and the costs, time and resources that would be involved.

5th December, 2014 Zambia Gazette 779
8.8.4 Outsourcing often leads to the sharing of facilities operated by the service provider. The regulated entity should ensure that
service providers are able to isolate the regulated entity's information, documents and records, and other assets. This is to ensure that in adverse conditions, all documents, records of transactions and information given to the service provider, and assets of the regulated entity, can be deleted, destroyed, rendered unusable or removed from the possession of the service provider.
8.9 Monitoring and Control of Outsourced Activities
8.9.1 The regulated entities should have in place a management structure to monitor and control its outsourcing activities. It should
ensure that outsourcing agreements with the service provider contain provisions to address their monitoring and control of outsourced activities.
8.9.2 A central record of all material outsourcing that is readily accessible for review by the board and senior management of the
regulated entity should be maintained. The records should be updated promptly and form part of the corporate governance reviews undertaken by the board and senior management of the regulated entity.
8.9.3 Regular audits by either the internal auditors or external auditors of the regulated entity should assess the adequacy of the risk
management practices adopted in overseeing and managing the outsourcing arrangement, the regulated entity's compliance with its risk management framework and the requirements of these guidelines.
8.9.4 Regulated entities should at least on an annual basis, review the financial and operational condition of the service provider to
assess its ability to continue to meet its outsourcing obligations. Such due diligence reviews, which can be based on all available information about the service provider should highlight any deterioration or breach in performance standards, confidentiality and security, and in business continuity preparedness.
8.10 Redress Mechanisms for Grievances related to Outsourced services
(a) A regulated entity shall have clear procedures for addressing grievances/complaints relating to outsourced activities. (b) Regulated entities should constitute grievance handling procedures and give wide publicity about it through electronic and print media. The name and contact number of designated grievance redress officer of the regulated entity should be made known and widely publicized. The designated officer should ensure that genuine grievances of customers are redressed promptly. (c) The grievance redress procedure of the regulated entity and the time frame fixed for responding to the complaints should be placed in a conspicuous place within the regulated entity's premises or website.
9.0 Off-Shore Outsourcing of Financial Services
9.1 Off-shoring will require Bank of Zambia's prior approval.
The engagement of service providers in a foreign country exposes a regulated entity to country risk - economic, social and political conditions and events in a foreign country that may adversely affect the regulated entity. Such conditions and events could prevent the service provider from carrying out the terms of its agreement with the regulated entity. To manage the country risk involved in such outsourcing activities, the regulated entity should take into account and closely monitor government policies and political, social, economic and legal conditions in countries where the service provider is based, during the risk assessment process and on a continuous basis, and establish sound procedures for dealing with country risk problems. This includes having appropriate contingency and exit strategies. In principle, arrangements should only be entered into with parties operating in jurisdictions generally upholding confidentiality clauses and agreements. The governing law of the arrangement should also be clearly specified.
9.2 The activities outsourced outside Zambia should be conducted in a manner so as not to hinder efforts to supervise or reconstruct
the activities of the regulated entity in Zambia. Specifically, a regulated entity should not outsource to jurisdictions where unfettered access to information by Bank of Zambia or its authorised person, and the internal and external auditors of the regulated entity, may be impeded by legal or administrative restrictions. Bank of Zambia may communicate directly with the home or host regulator of the regulated entity or the service provider, as the case may be, to seek confirmation relating to these matters.
9.3 A regulated entity should notify Bank of Zambia if any overseas authority were to seek access to its customer information. If such
access seems unwarranted Bank of Zambia would require the regulated entity to take steps to make alternative arrangements for the outsourced activity.
10.0 Outsourcing within a Group/ Conglomerate
The risk management practices expected to be adopted by a regulated entity while outsourcing to a related party (i.e. party within the Group/ Conglomerate) would be identical to those specified in Paragraph 6 of the guidelines.
11.0 Transfer Pricing
11.1 Transfer pricing generally relates to the system of pricing the cross-border transfer of goods, services and intangibles between
entities in a group of companies. Transfer pricing also applies if such transactions were to take place between associated companies within the country. Ideally, the transfer price should not differ from the prevailing market price. However, when business dealings are made between connected entities, there is a possibility that these may not always reflect the dynamics of market forces as would be expected if such transactions were carried out by independent enterprises.
11.2 Therefore, a regulated entity that seeks to engage in intra-group outsourcing should ensure that it adopts reasonable transfer
pricing methodologies and that the regulated entity pays its fair share of tax. In order to do so, regulated entities involved must be able to provide adequate documented proof to support their transfer pricing policies.

780 Zambia Gazette 5th December, 2014
11.3 The regulated entity will need to clearly articulate and demonstrate evidence of its arms' length pricing methodologies when
seeking approvals for the outsource. The resulting pricing should not be significantly different from obtaining prices from independent service providers.
11.4 The Bank may, in appropriate circumstances, if it is of opinion that the price of an intra-group outsourced service or goods is not
reasonably reflective of market forces, disallow an outsourcing arrangement or otherwise approve it to proceed only upon such terms regarding pricing as the Bank considers to be reasonably representative of market pricing.
12.0 Self-Assessment of ExistinglProposed Outsourcing Arrangements
Regulated entities may conduct a self-assessment of their existing 1 proposed outsourcing arrangements, viewed in the light of these guidelines and rectify deficiencies/shortcomings if any observed in this regard.
Table: Guiding Principles on Outsourcing of Financial Services as Developed by the Joint Forum of the Basel Committee on
Banking Supervision .
Number
Principle I
Principle II
Principle III
Principle IV
Principle V
Principle VI
Principle VII
Principle
A bank or financial institution seeking to outsource activities should have in place a comprehensive policy to guide the assessment of whether and how those activities can be appropriately outsourced. The board of directors or equivalent body retains responsibility for the outsourcing policy and related overall responsibility for activities undertaken under that policy. The bank or financial institution should establish a comprehensive outsourcing risk management programme to address the outsourced activities and the relationship with the service provider. The bank or financial institution should ensure that outsourcing arrangements neither diminish its ability to fulfil its obligations to customers and regulators, nor impede effective supervision by regulators. The bank or financial institution should conduct appropriate due diligence in selecting third-party service providers. Outsourcing relationships should be governed by written contracts that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities and expectations of all parties. The bank or financial institution and its service providers should establish and maintain contingency plans, including a plan for disaster recovery and periodic testing of backup facilities. The bank or financial institution should take appropriate steps to require that service providers protect confidential information of both the bank or financial institution and its clients from intentional or inadvertent disclosure to unauthorised persons.
Section in Guideline
Guideline 8.1 captures the spirit of this principle in the draft guideline Guideline 8.3 Guideline 6.0 - 6.5 Guideline 7.4 Guide 7.5 (I-II) Guideline 7.5.2 (6)Guideline 7.8 Guideline 7.6 GAZEITENOTICENo.7 18 OF20 I4 P.O. Box 32020 LUSAKA 24th September, 20 I4 [5356382/3 GAZEITENoTICENo.7190F2014 The Companies Act (Cap. 388) [5356382/23 The Companies Act (Cap. 388 ) Notice Under Section 361 NOTICEISHEREBYGIVENthat at the expiration of a period of three months after the publication of this notice, Luckdrian Investments Zambia Limited, Company Registration No. 122376, Incorporated in Zambia on 15th day of May, 2014 and having its place of business at Plot No. 20844 alongAlick Nkhata Road, Lusaka, Zambia will be Struck off the register of companies pursuant to Section 361 of the Companies Act Cap. 388 of the Laws Zambia unless due causes is shown to the country. Notice Under Section 361 NOTICEISHEREBYGIVENthat at the expiration of a period of three months after the publication of this notice, Copperbelt Bottling Company Limited, Company Registration No. 329, Incorporated in Zambia on 24th day of January, 1950 and having its place of business at Corner LangashelNyerere Road, Light Industrial Area, Kitwe, Zambia will be Struck off the register of companies pursuant to
Section 361 of the Companies Act Cap. 388 of the Laws Zambia
unless due causes is shown to the country.
P.O. Box 32020
LUSAKA
7th October, 2014
W. BANDA,
Senior Inspector of Companies, for/Registrar,
Patents and Companies
Registration Agency
W. BANDA,
Senior Inspector of Companies, for/Registrar,
Patents and Companies
Registration Agency
Printed and Published by the Government Printer, P.O. Box 30136,10101 Lusaka