CENTRAL BANK OF ICELAND

DISCUSSION DOCUMENT
ON DRAFT GUIDELINES on the content of simple restructuring plans

GUIDELINES

on outsourcing

GUIDELINES

CENTRAL BANK OF ICELAND

on outsourcing

Issued pursuant to section 2 of Article 8 of Act No. 87/1998, on public supervision of financial activities

No. 1/2025

June 2025

Table of Contents

Introduction 4

1 Scope and Entry into Force 5

2 Definitions 6

3 Governance, Responsibility and Limitations on Outsourcing 7

4 Outsourcing Policy 8

5 Outsourcing Requirements – Duty of Care at the Onset of Outsourcing 9

6 Risk Assessment and Preparedness Framework 10

7 Outsourcing Agreement 11

8 Suitability of Parties 13

9 Conflicts of Interest 14

10 Additional Requirements for the Outsourcing of Critical or Important Functions 15

11 Implementation of Outsourcing (Continuing Duty of Care) and Supervision 16

12 Exit Plan 17

13 Chain Outsourcing 18

Introduction

These guidelines are intended to shed light on the matters and framework that supervised entities pursuant to section 1 of Article 2 of Act No. 87/1998, on public supervision of financial activities, should observe when outsourcing tasks in their operations. Entities that fall under the European Banking Authority's (EBA) Guidelines on outsourcing (EBA/GL/2019/02) of 25 February 2019 are, however, exempt from these guidelines.

In the preparation of these guidelines, reference was made to the EBA Guidelines on outsourcing (EBA/GL/2019/02), the European Insurance and Occupational Pensions Authority's (EIOPA) Guidelines on the system of governance of insurance undertakings (EIOPA-BoS-14/253) of 1 January 2014, and the delegated Regulation (EU) 2015/35 (Solvency II) of 10 October 2014, in particular its Article 274.

Provisions on the outsourcing of individual tasks by supervised entities are found throughout financial market legislation and guidelines of the Financial Supervision of the Central Bank of Iceland, as well as other guidelines of the European Union that have been incorporated into Icelandic law. With these guidelines, an attempt is made to specify the main principles that the Financial Supervision considers it desirable for supervised entities to follow when entering into outsourcing agreements and in the arrangement of outsourcing in other respects.

It should be borne in mind that other more specific provisions in laws and administrative orders and guidelines that apply to the activities of supervised entities already contain provisions on outsourcing. It is reiterated that the provisions of these guidelines apply where they do not.

1 Scope and Entry into Force

1.1 These guidelines apply to the outsourcing of supervised entities pursuant to section 1 of Article 2 of Act No. 87/1998, on public supervision of financial activities, with the exception of entities that fall under the EBA Guidelines on outsourcing (EBA/GL/2019/02).1

1.2 These guidelines, issued pursuant to section 2 of Article 8 of the Act on public supervision of financial activities, enter into force immediately. At the same time, Guidelines No. 6/2014 on outsourcing by supervised entities are repealed.

[1] Entities that fall under the aforementioned EBA Guidelines on outsourcing are financial institutions, payment institutions and electronic money institutions, and they are exempt from these guidelines.

Definitions

In these guidelines:

2.1 Outsourcing: An arrangement whereby a service provider undertakes tasks or services that generally fall within the scope of the supervised entity.2

2.2 Service provider: A party that provides services, facilities or performs tasks on behalf of a supervised entity.

2.3 Critical or important functions:3

a. Key business functions of a supervised entity, e.g. asset and risk management, and, where applicable, internal audit, compliance and the actuarial function.

b. Other tasks that are necessary for a supervised entity to ensure operational continuity and/or to fulfil obligations under laws and administrative orders.

c. Other activities that require an operating licence.

d. Tasks that have a significant impact on, among other things, risk management and the financial performance of a supervised entity.

2.4 Chain outsourcing: When a service provider further outsources tasks, in whole or in part, to a third party.

2.5 Incident: An unforeseen event that affects or may affect the performance of the outsourced task.

2.6 Material incident: An unforeseen event that affects or may affect the operations of the supervised entity and that could have a negative impact on operational continuity or prevent the supervised entity from fulfilling obligations under laws and administrative orders.

2.7 Exit plan: A written plan of a supervised entity that includes responses to circumstances that may prevent outsourced tasks from being performed in a satisfactory manner.

[1] In assessing whether a particular task/service constitutes outsourcing, the Financial Supervision refers to Chapter 3 of the aforementioned EBA Guidelines on outsourcing (EBA/GL/2019/02) and the aforementioned EIOPA Guidelines on the system of governance of insurance undertakings (EIOPA-BoS-14/253).

[2] In assessing what constitutes critical or important functions, the Financial Supervision refers, among other things, to Chapter 4 of the aforementioned EBA Guidelines on outsourcing (EBA/GL/2019/02) and Chapter 11 of the aforementioned EIOPA Guidelines on the system of governance of insurance undertakings (EIOPA-BoS-14/253).

[1] 1

[2] 2

3 Governance, Responsibility and Limitations on Outsourcing

3.1 The board of a supervised entity is responsible for ensuring that all outsourced tasks meet the criteria set out in these guidelines. The board shall make appropriate arrangements to ensure that the outsourced activity is carried out in accordance with these instructions.

3.2 Tasks relating to core elements of the operations of the supervised entity should not be outsourced to a third party. Core elements of the operations of the supervised entity include, among others, strategy setting, determination of risk appetite and risk tolerance limits. In view of the above, management tasks, such as strategy setting and rule-making for the supervised entity with regard to risk profile and risk management, as well as the supervisory role of the board, should therefore not be outsourced.

3.3 A supervised entity is prohibited from outsourcing an activity that is subject to a licence from the Financial Supervisory Authority, unless the service provider has an equivalent authorisation as the supervised entity to provide the service or perform the relevant task.

3.4 A supervised entity should make appropriate arrangements to ensure that the outsourcing does not lead to a deterioration in the quality of tasks or services compared to what would have been the case without outsourcing.

3.5 Final responsibility for the performance of all outsourced tasks and any risks associated with them always rests with the board of the supervised entity. Such responsibility cannot be outsourced.

3.6 A supervised entity should possess sufficient competence and appropriate human resources to ensure adequate supervision of outsourced tasks.

3.7 The board of a supervised entity should ensure the analysis, management and mitigation of risks arising from outsourcing, in particular, but not limited to, operational risk inherent in outsourcing.

3.8 All data and information should be hosted within the European Economic Area (EEA). If outsourcing outside the EEA is involved, data hosting should only be permitted in countries that have adopted the EEA data protection policy, or if secure encryption of the data is involved. It must always be ensured that the Financial Supervisory Authority's access to the supervised entity's data and information held by the service provider is the same as if the data and information were held by the Authority itself. It is also necessary to ensure that the data are accessible to the supervised entity at any time during the term of the contract and upon its termination.

4

Outsourcing Policy

4.1 The board of a supervised entity that intends to outsource any part of its operations should adopt a written outsourcing policy, whether the outsourcing involves material tasks or not, even if tasks are outsourced within the same group.

4.2 The board should approve, review and regularly update the written outsourcing policy and ensure its implementation. Decisions on the outsourcing of material tasks or key business areas should be submitted to the board for approval.

4.3 The board of a supervised entity shall set benchmarks in the outsourcing policy for acceptable risk related to outsourcing in view of the activities and scope of the entity concerned. The benchmarks must be reviewed on a regular basis.

4.4 The outsourcing policy should, among other things, include a discussion of the following general matters:

a. The position on what impact outsourcing has on the operations of the supervised entity and the risk factors relating to it, such as operational risk, reputational risk and concentration risk, in accordance with the supervised entity's risk assessment;

b. The position on the actions to be taken if uncertainty arises regarding the service provider's operations which may have a negative impact on the service provider's ability to perform the outsourced task;

c. The position on how and under what circumstances an outsourcing contract will be terminated;

d. The position on how a decision on outsourcing will be made;

e. The position on what requirements the supervised entity places on the service provider;

f. The position on who assesses the requirements for the service provider, cf. item e;

g. How the service provider communicates information on outsourced tasks to the supervised entity;

h. A discussion of the need to define in the contract who is responsible for each outsourced task and the role of the responsible party.

i. How supervision of outsourced projects shall be conducted;

j. The position on how changes to the organisation and ownership of the service provider will be monitored and which representative of the supervised entity will monitor this;

k. A plan for responses to non-compliance by the service provider.

5 Outsourcing requirements – duty of care at the outset of outsourcing

5.1 The supervised entity shall carry out an assessment prior to determining whether the arrangement with the service provider constitutes outsourcing. In such an assessment, consideration should be given, among other things, to whether services or projects, in whole or in part, to be performed by the service provider will be carried out on a regular or ongoing basis. It should also be assessed whether services or projects generally fall within the scope of the supervised entity, irrespective of whether the supervised entity has previously provided the relevant service or carried out the project.

5.2 Particular attention should be paid to whether critical activities are involved, see Chapter 10, as increased requirements are imposed on the duty of care for such projects.

5.3 When the contractual arrangement with the service provider covers two or more service components, the supervised entity should risk-assess each component of the arrangement independently, including by conducting due diligence on the service provider.

5.4 Outsourcing shall be structured so that it complies with the laws, regulations, rules, outsourcing policy and other guidelines applicable to the activities of the relevant supervised entity, including provisions on fair and sound business practices in the relevant market, with trust, credibility and security as guiding principles.

5.5 Before a decision on outsourcing is made, the supervised entity shall ensure the following:

a. That the outsourcing does not prevent good governance of the supervised entity;

b. That potential conflicts of interest with the service provider have been considered;

c. That the outsourcing does not damage the reputation of the supervised entity;

d. That the outsourcing does not involve unnecessary risk for the operations of the supervised entity;

e. That the supervised entity's ability to monitor and control outsourced projects or services is neither impaired nor hindered;

f. That the possibilities for internal supervision, including with regard to the role of the board and the audit committee, are neither impaired nor hindered;

g. That the Financial Supervisory Authority's ability to supervise is neither impaired nor hindered;

h. That continuous and satisfactory service to customers is not impaired.

6 Risk assessment and contingency framework

6.1 The board of the supervised entity shall ensure that a risk assessment is carried out in connection with outsourcing.

6.2 The risk assessment should include an analysis and assessment of the risks associated with outsourcing, including concentration risk, reputational risk and the financial risk inherent in taking back outsourced projects. The board should ensure that a process is in place within the supervised entity to monitor risk and minimise the likelihood of it materialising.

6.3 The board of the supervised entity shall ensure that the risk assessment is reviewed on a regular basis, particularly if there is reason to, for example, if changes occur that affect the security of outsourced projects, or if a risk related to outsourcing of the entity's activities has been assessed. In reviewing the risk assessment, consideration should be given, among other things, to deviation notifications received from the service provider, see provision 11.4.

6.4 The performance and outcome of the risk assessment should be documented, together with recommendations for remedial action where necessary and follow-up on such remedial action.

6.5 Following the risk assessment, the supervised entity should clearly define the actions to be taken in response to the identified risk. Responsibility for remedial action must be clear and such action must be followed up.

6.6 The supervised entity should also establish a contingency plan and review it regularly, and no less frequently than every three years. The contingency plan should be based on the outcome of the risk assessment.

Outsourcing agreement

7.1 The outsourcing agreement shall be in writing and contain provisions on the rights and obligations of the parties.

7.2 The outsourcing agreement for critical projects shall contain at least the following:

a. A detailed description of the outsourced project;

b. Provisions on the term of validity, commencement date, review of the agreement and, where applicable, the termination date of the agreement;

c. Provisions on the division of responsibilities, where applicable;

d. A clear position on sub-outsourcing. The agreement should specify whether sub-outsourcing is permitted and, if so, ensure that sub-outsourcing complies with these guidelines;

e. Provisions on where the outsourced projects will be carried out and, where applicable, where data relating to the outsourced projects will be processed and stored;

f. Provisions on how the service provider intends to safeguard data security and comply with data protection requirements pursuant to laws and administrative regulations, where applicable;

g. A detailed description of the requirements that the service provider must fulfil for the project to be considered satisfactorily performed. The supervised entity should set out the aforementioned requirements both quantitatively and qualitatively (English: quantitative and qualitative), so that active monitoring of the outsourced project is possible. As an example of quantitative requirements, various measurable aspects such as the uptime of computer systems could, for instance, be mentioned. As an example of qualitative requirements, various immeasurable aspects such as regular meetings to review services or that the supervised entity is informed of deviations could, for instance, be mentioned;1

h. Provisions on the roles and responsibilities of the supervised entity on the one hand and the service provider on the other. Including provisions on the supervised entity's access to the company's data held by the service provider and that the supervised entity shall be considered the owner of the data and products relating to the outsourcing agreement;

i. The Financial Supervisory Authority's access to the supervised entity's data and information held by the service provider, as well as access to the service provider's premises and employees, including for the purpose of examining the performance of projects carried out for the supervised entity;

j. Discussion of which responsible person within the supervised entity is responsible for supervising the outsourced task and that the service provider fulfils all the requirements made of the supervised entity in respect of the task. The person responsible for supervision within the supervised entity must have sufficient knowledge of the outsourced task to be able to exercise supervision over it. When designating the responsible person, the job title or area of responsibility within the relevant undertaking should be specified;

k. Position on whether the service provider must have in force liability insurance for damage that may result from its activities on behalf of the supervised entity and, if so, what the minimum requirements for such insurance are;

[1] Account should be taken of the forthcoming technical standard for service providers to be adopted under DORA.

l. Discussion of the access of the prudential supervisor, external and internal auditors of the supervised entity to all data relating to the outsourced task, together with access to the service provider's premises and employees for the purpose of examining the performance of tasks carried out for the supervised entity;

m. Discussion to the effect that the service provider is obliged to notify the supervised entity, or the financial supervisory authority, of all material changes in its operations which may affect its ability to perform the outsourced task;

n. Provisions on termination of the outsourcing in accordance with a pre-determined notice period, as well as provisions on termination of the contract without notice should special circumstances arise that lead the financial supervisory authority to request such;

o. Provisions on the service provider's obligation to inform the supervised entity of deviations, including serious deviations, in the outsourced service;

p. Provisions on the supervised entity's exit strategy;

q. Provisions on the settlement of disputes between the parties to the contract;

r. Provisions on the service provider's duty of confidentiality and non-disclosure regarding the tasks entrusted to it, cf. the confidentiality provisions in the relevant special legislation;

s. Provisions on how these recommendations are to be fulfilled, including regarding the retention and processing of data and deviation notifications.

8 Eligibility of parties

8.1 Eligibility of the supervised entity

The supervised entity should ensure that it always has sufficient overview and expertise to be able to supervise the outsourcing and to take over the performance of outsourced tasks or outsource them to another service provider if necessary.

8.2 Eligibility of the service provider

The supervised entity should ensure that a service provider undertaking tasks and its employees perform their duties conscientiously, and have sufficient specialist knowledge, education and experience to be able to perform the tasks in a satisfactory manner.

9 Conflicts of interest

9.1 The board of the supervised entity should ensure that the outsourcing of tasks does not involve an unnecessary risk of conflicts of interest.

9.2 The board should establish operating procedures or a policy1 regarding potential conflicts of interest arising from outsourcing and how any conflicts of interest that may arise should be dealt with.

9.3 Smaller entities should exercise particular care in the segregation of duties, as the risk of conflicts of interest increases where it is not possible to ensure satisfactory segregation of duties. Therefore, all avenues should be sought to obtain increased scrutiny2 of important tasks of the supervised entity.

[1] Cf. inter alia 5th paragraph of Article 258 of delegated EU Regulation 2015/35 Solvency II, cf. Article 3 of Regulation 590/2017 on the supervisory system for the risk of pension funds.

[2] Four eyes principle.

Increased requirements for the outsourcing of important tasks

10.1 A supervised entity should exercise particular caution in the outsourcing of important tasks. A supervised entity should then ensure that decisions on the outsourcing of important tasks are based on commercial grounds and not on management relationships or other interest relationships.

10.2 With reference to the 1st paragraph of Article 9 of Act No. 87/1998 on official supervision of financial activities, the Financial Supervisory Authority requests to be informed in a timely manner about the outsourcing of important tasks and changes that occur in that outsourcing.

Implementation of outsourcing (ongoing duty of care) and monitoring

11.1 Ultimate responsibility for the implementation of all outsourced tasks and the risk that may accompany them always rests with the board of the supervised entity. In that context, a supervised entity should ensure, on a regular basis, that the implementation of outsourcing is always in accordance with the outsourcing policy, risk assessment and meets the defined service standards in the relevant outsourcing agreement applicable to the service. When implementing outsourcing, a supervised entity should also ensure that the preconditions under Chapter 5 are always met.

11.2 A supervised entity should always ensure that the Financial Supervisory Authority's access to data and information of the supervised entity in the custody of the service provider is the same as if that data and information were in the custody of the supervised entity itself.

11.3 A supervised entity should maintain an updated register of all outsourced services to increase oversight, security and transparency. A distinction should be made between important outsourced tasks and other tasks in such a register.

11.4 A supervised entity should maintain a register of all deviations that have occurred in the implementation of outsourced tasks, regardless of origin. Such registration should, inter alia, include information on the causes of deviations and the response to them. The Financial Supervisory Authority may request such a deviation register.

11.5 The Financial Supervisory Authority directs supervised entities to entrust the internal auditor or an independent party to carry out a review of compliance with these recommendations. It is desirable that such a review be carried out at least every three years. It is important that the work of the reviewing party is organized and targeted and follows generally known and recognized methodology. Such a review should then be taken up at a board meeting for information and follow-up, if applicable.

11.6 The Financial Supervisory Authority may examine whether the outsourcing of tasks is consistent with the provisions of the laws that apply to the activities of the supervised entity, including the 1st paragraph of Article 8 of the Act on official supervision of financial activities, which provides that the activities of supervised entities are in accordance with laws, regulations, rules or resolutions that apply to the activities and that the activities are otherwise in accordance with sound and healthy business practices. In such an examination, the Financial Supervisory Authority would, inter alia, look to the following factors:

a. The type, nature and scope of the outsourced task or service.

b. The nature of those tasks or services that are outsourced.

c. Special circumstances relating to the service provider and its position in the market.

d. The duration of the outsourcing agreement.

e. Conflicts of interest that may arise due to the outsourcing.

f. The service provider's ability to influence the decisions of the supervised entity.

g. The geographical location of the service provider.

Exit plan

12.1 A supervised entity that intends to outsource tasks in whole or in part should establish a written exit plan, which should at least address responses to the following situations:

a. Termination of the outsourcing agreement;

b. Default by the service provider on the outsourcing agreement;

c. Deterioration in the quality of the outsourced service;

d. Inability of the service provider to perform outsourced tasks;

e. When it appears likely that an unchanged and ongoing outsourcing arrangement may entail increased risk.

Chain outsourcing

13.1 A supervised entity should only approve chain outsourcing if the chain service provider agrees to submit to the conditions of the agreement with the service provider.

13.2 A supervised entity should only approve chain outsourcing if the chain service provider is equally or more qualified for the task than the service provider.

13.3 Before a supervised entity approves chain outsourcing, it should independently assess the risk involved in the chain outsourcing, including whether the chain outsourcing reduces the service provider's ability to fully perform the outsourcing agreement and the supervised entity's access to monitoring.

Reykjavík, 2 June 2025
CENTRAL BANK OF ICELAND

Björk Sigurgísladóttir
Deputy Governor of Financial Supervision

Gísli S. Óttarsson
Director of Prudential Supervision