Guidelines on Outsourcing by Financial Institutions

BOM/BSD 17/May 2006
BANK OF MAURITIUS
Guidelines on Outsourcing by Financial Institutions May 2006 Revised November 2017 Revised March 2018 Revised October 2020 Revised January 2026

i
Table of Contents

Introduction.............................................................................................................. 1
Authority ..................................................................................................................... 1
Scope of application ................................................................................................... 1
Effective Date ............................................................................................................. 2
Interpretation........................................................................................................... 2
Risk Management Framework in Outsourcing .................................................... 3
3.1 Policy Formulation .......................................................................................... 3
3.2 Role of the Board of Directors and Senior Management............................. 3
3.3 Evaluation of Risks Involved in Outsourcing .............................................. 4
3.4 Due Diligence in Selecting Service Providers.............................................. 4
3.5 Contract Issues & Service Level Agreement................................................ 5
3.6 Contingency Planning .................................................................................... 6
3.7 Confidentiality and Security .......................................................................... 7
Classification of Outsourcing Activities .............................................................. 7
4.1 Outsourcing of Material Activities................................................................ 7
4.2 Outsourcing of Non-Material Activities....................................................... 8
4.3 Activities that cannot be Outsourced ............................................................ 8
4.4 Outsourcing Outside Mauritius (“Offshoring”)............................................ 9
Role of the External Auditor ................................................................................. 9
Cancellation ............................................................................................................ 9
Application of the Guideline ................................................................................. 9
Annual reporting................................................................................................... 10
Annex 1......................................................................................................................... 11
Annex 2......................................................................................................................... 12
Introduction
1.1 Outsourcing refers to recourse to third-party service providers (“service providers”)
by financial institutions to perform activities on a continuing basis. Such activities are normally undertaken by the financial institutions themselves. With evolution of technology, an increasing range of outsourcing of financial services activities is likely to be undertaken. Financial institutions usually outsource part of their activities with the view to reducing costs, which in turn may promote efficiency. However, outsourcing exposes financial institutions to new and/or increased risks. It may also impede effective supervision by regulators and have destabilising effects on the financial system. These risks should be controlled by requiring financial institutions to adopt a sound risk management framework when having recourse to outsourcing.
1.2 An essential criterion of Principle 25 (Operational risk) of the Core Principles for
Effective Banking Supervision issued by t h e Basel Committee on Banking Supervision calls upon supervisors to determine that banks have established appropriate policies and processes to assess, manage and monitor outsourced activities.
1.3 This Guideline on Outsourcing by Financial Institutions (“Guideline”) is being
issued to cope with the risks associated with outsourcing in the financial system through the application of an appropriate regulatory framework in this respect.
1.4 The main objective of this Guideline is to set out a broad framework for financial
institutions that have entered into outsourcing or are planning to outsource their business activities to service providers. The Guideline does not cover comprehensively all the outsourcing related issues but is intended to assist financial institutions to identify the nature of risks involved and to address them effectively in view of the consideration that the Bank of Mauritius (“Bank”) will hold its licencees fully responsible for all outsourced activities. The Guideline is based on a three-tier classification of activities, namely:

material activities which require the authorisation of the Bank;
non-material activities which do not require authorisation; and
core activities which cannot be outsourced.
1.5 The Guideline follows the high-level principles on ‘Outsourcing in Financial
Services’ developed by the Joint Forum1
. These principles are available at the following address, https://www.bis.org. Authority This Guideline is issued under the authority of section 50 of the Bank of Mauritius Act 2004 and section 100 of the Banking Act 2004. Scope of application This Guideline applies to all financial institutions licensed by the Bank under the Banking Act 2004. 1 The ‘Joint Forum’ comprises Basel Committee on Banking Supervision (BCBS), International Organisation of Securities Commission (IOSCO) and International Association of Insurance Supervisors (IAIS).

Effective Date
This revised guideline shall come into effect as from 6 January 2026.
2. Interpretation
2.1 In this Guideline -
“financial institution” means any bank, non-bank deposit taking institution or cash dealer licensed by the Bank of Mauritius; “outsourcing” means an arrangement whereby a financial institution engages a third-party service provider to perform activities on an ongoing basis that would normally have been undertaken by the financial institution itself; “material outsourcing” means the outsourcing of an activity of such importance that any weakness or failure in the provision of this activity could have a significant impact on the financial institution’s ability to meet its regulatory responsibilities and/or to continue in business; “offshoring” in the context of outsourcing means outsourcing activities beyond national borders; and “third-party service provider” refers to an entity that is undertaking the outsourced activity on behalf of the financial institution and includes a member of the corporate group to which the financial institution belongs or an entity that is external to the corporate group, whether located in Mauritius or elsewhere.

Risk Management Framework in Outsourcing
3.1 Policy Formulation
3.1.1 Prior to the outsourcing of any activity, a financial institution should establish a
comprehensive policy on outsourcing. The policy should guide the assessment of whether and how an activity should be outsourced. The policy should be well documented and should include, inter-alia:

strategic goals, objectives and business needs of a financial institution in
relation to outsourcing;
a clear definition of the range of activities that may be outsourced and those core
activities which cannot be outsourced;
steps to evaluate whether a particular activity is appropriate for outsourcing;
criteria for determining material outsourcing;
processes for evaluating risks associated with an outsourced activity;
criteria for evaluating outsourcing relationships (with service providers)
including necessary controls and reporting processes on an ongoing basis;
limits on the acceptable overall level of outsourced activities;
eligibility criteria for selecting service providers taking into account any
relation, directly or indirectly, with the latter;
issues addressing risk concentrations and risks arising from outsourcing multiple
activities to the same service provider;
steps to ensure compliance with legal and regulatory requirements in both home
and host countries; and
contingency plan in case of business disruptions.
3.2 Role of the Board of Directors and Senior Management
3.2.1 The board of directors and senior management of financial institutions have the
responsibilities for ensuring that an effective risk management system on outsourcing is in place. The board of directors shall, as a minimum, be responsible for:
approving the policy on outsourcing;
assessing outsourcing strategies and arrangements to evaluate consistency with
strategic objectives;
assessing how the outsourcing arrangement will support the financial
institution’s objectives and strategic plans;
laying down the appropriate approval authorities for outsourcing;
approving material outsourcing arrangements;
approving the exit mechanism in respect of material outsourcing arrangements;
assessing management competencies for developing sound and responsive
outsourcing risk management policies and procedures as commensurate with the nature, scope and complexity of the outsourcing arrangements;
reviewing all material outsourcing activities and relevant reports on outsourcing
at least once annually; and
ensuring the continued maintenance of an overall framework for the operational
stability of the financial institution, taking into account the scope of outsourced services.

3.2.2 The senior management has the responsibility for proper management of the risks
associated with outsourcing activities. In addition, senior management is responsible for:

evaluating the risks and materiality of outsourcing activities;
implementing sound and prudent outsourcing policies and procedures approved
by the board;
monitoring and controlling all relevant aspects of outsourcing arrangements on an
ongoing basis;
keeping the board informed on material outsourcing risks in a timely manner;
ensuring that contingency plans, including availability of alternative service
providers, costs and resources required to switch service providers, are in place;
ensuring that the internal audit function and the external auditors have the
authorities to assess any outsourced functions; and
ensuring that regulatory and legal requirements are complied with at all times in
the framework of and including outsourced services.
3.2.3 In the case of unincorporated branches of foreign banks or institutions incorporated
outside Mauritius, the role of the board of directors would be delegated to the management or body empowered with oversight and supervision responsibilities.
3.3 Evaluation of Risks Involved in Outsourcing
3.3.1 The ultimate responsibility for implementing a risk management framework on
outsourcing lies with the management. The board of directors and the management should, at all times, have a full understanding of the various risks associated with outsourcing. Annex 1 maps out some of the key risks in outsourcing. The risk management on outsourcing should include, inter-alia, the following steps:
identification of the role of outsourcing in the overall business strategy;
due diligence on the service provider and effective identification of the key risk
mitigation strategies;
analysis of the impact of the outsourcing arrangement on the overall risk profile
of the financial institution; and
analysis of risk-return on the potential benefits of outsourcing.
3.4 Due Diligence in Selecting Service Providers
3.4.1 Financial institutions are required to carry out stringent due diligence in selecting
service providers. They should develop criteria that would enable them to select service providers, both within and outside Mauritius, that have the capacity and ability, both operationally and financially, to perform the outsourced activities. The due diligence exercise, based on updated information, should be duly documented and should include, as a minimum, an assessment of:
the experience and competence of the service provider to implement and support
the proposed activity over the contracted period;
the reputation of the service provider in respect of the services offered, the
quality and dependability of its personnel;
the financial soundness of the service provider to fulfil its obligations, based on
updated audited financial statements;
the internal control systems, audit coverage, compliance, reporting and

monitoring environment, system development and maintenance, insurance coverage, and ability to respond and the speed of response to service disruptions by the service provider;

the commitment of the key service provider personnel towards compliance with
rules and regulations to which the outsourcing financial institution is subjected, for example, senior officer;
the capability to offer service support to ensure continuity of operations at the
financial institutions and the reliance of service providers on sub -contractors and other parties; and
the existence, at the service provider’s level, of a process for Business
Continuity Management.
3.4.2 Financial institutions should perform on-site visits to the service provider to better
understand and develop the necessary confidence as to the manner in which the service provider operates and supports its services.
3.4.3 Financial institutions intending to engage in outsourcing from abroad should, in
addition to section 3.4.1, carry out an assessment of the economic, legal and political environment into which the service providers operate.
3.5 Contract Issues & Service Level Agreement
3.5.1 Outsourcing arrangements between financial institutions and service providers
should be governed by formal and comprehensive written contracts. Contracts should clearly spell out the rights and responsibilities of each party, taking into consideration the specificities and the materiality of the outsourcing activities.
3.5.2 The agreement should not consist of clauses that would hinder the Bank from
exercising its supervisory powers. The Bank should have the same right of access to information with the service provider as it has with the financial institutions having undertaken the outsourcing. The contract should explicitly allow for on-site visits and unhindered inspections of the outsourced activities by the financial institutions and the Bank. The cost of on-site examinations shall be borne by financial institutions. Attention is also drawn to section 52(3) of the Banking Act 2004, which provides for the regulation and examination by the central bank of service providers to the same extent as that of the financial institutions in respect of outsourcing of operational functions relating to electronic delivery channels.
3.5.3 The agreement should consist of a clause for seeking the prior approval of the Bank
in the event of sub-contracting of material activities which have been outsourced by a financial institution to any other entity.
3.5.4 Other provisions to be included in an outsourcing contract are:
the scope of the outsourcing activities, including clear definitions of functions to
be outsourced to the service provider as well as the timeframe for implementation;
cost and maintenance;
confidentiality and security
;
2 Refer to section 3.7
contingency planning in the event the service provider fails;
access of financial institutions to all books, records and information relevant to
the outsourced activity provided by the service provider;
continuous monitoring and assessment by financial institutions of the service
providers;
types of audit reports and other reports that financial institutions should receive,
for example, audited financial statements and performance reports;
reporting of any material weakness that may impact negatively on the financial
soundness of the service provider, to the concerned financial institutions;
dispute resolution;
a termination and early exit clause in case of default by the service provider,
including insolvency, liquidation, receivership, change in ownership;
conditions of subcontracting by the service provider for all or part of an
outsourced activity and contingency planning for business resumption;
the need, if any, for insurance cover to be contracted by the service provider;
and
in case the service provider is located outside Mauritius, choice-of-law
provisions, agreement covenants and jurisdictional covenants that provide for adjudication of disputes between the parties under the laws of a specific jurisdiction.
3.5.5 Moreover, financial institutions should ensure that a service level agreement is put in
place when entering into an outsourcing arrangement with a service provider. The service level agreement should contain a mixture of quantitative and qualitative performance targets, to enable the outsourcing institution to assess the adequacy and effectiveness of service provision.
3.5.6 Any outsourcing agreement shall not affect the rights of customers towards the
financial institution, including their ability to obtain redress.
3.5.7 The Bank may, in the light of any adverse information, direct a financial institution to
modify, review or terminate an outsourcing arrangement in the interest of its customers or any other stakeholders.
3.6 Contingency Planning
3.6.1 Financial institutions should take appropriate steps to assess and address the
potential consequences in case of a business disruption of an outsourced activity. They should ensure that necessary contingency plans are in place for business continuity in the event that the service provider fails or the contract terminates prematurely or there is non-performance on the part of the service provider. Each outsourcing arrangement should be accompanied by relevant contingency plan.
3.6.2 Contingency plans should address issues such as availability of alternative service
providers and hand-over process to a new acceptable supplier. The plans can also be related to worst-case scenario.
3.6.3 Financial institutions should test and review their contingency plans pertaining to
the outsourced activities on a regular basis.

3.7 Confidentiality and Security
3.7.1 As mentioned in section 3.5.3, outsourcing agreements should contain a clause that
would address the service providers’ responsibility for confidentiality and security. Financial institutions that engage in outsourcing should take appropriate steps to protect confidential customer information. Financial institutions should expressly prohibit service providers from disclosing confidential customer information to any third-party except for regulatory purposes.
3.7.2 Depending on the nature and materiality of the outsourcing arrangement, financial
institutions should consider the possibility of notifying in advance their customers that customer data may be transmitted to a service provider as part of their contractual arrangement with the customers.
3.7.3 Financial institutions should abide by all relevant provisions of section 64 of
Banking Act 2004 when entering into an outsourcing agreement.
3.7.4 A financial institution should report to the Bank immediately about any
unauthorised access or breach of confidentiality and security, directly or indirectly, by an outsourced service provider and the action/s it is proposed to take in consequence.
4. Classification of Outsourcing Activities
4.1 Outsourcing of Material Activities
4.1.1 Material outsourcing refers to the outsourcing of an activity of such importance that
any weakness or failure in the provision of this activity could have a significant impact on the financial institution’s ability to meet its regulatory responsibilities and/or to continue in business. Outsourcing of activities may have varying degrees of materiality in different financial institutions. As mentioned in section 3.2.2, it is the role of the management to evaluate whether an outsourcing arrangement is material or not. In assessing materiality, both quantitative and qualitative judgments are involved. Financial institutions may carry out, as a minimum, the following assessment to determine the degree of materiality of an outsourcing activity:

the relative importance of the business activity to be outsourced which can be
measured in terms of contribution to income and profit;
the potential impact of the outsourcing activity on current and projected
earnings, solvency, liquidity, funding and capital and risk profile;
the impact on financial institution reputation in case the service provider fails;
the cost of the outsourcing as a percentage of total operating costs; and
the ability to maintain appropriate internal controls and meet regulatory
requirements in case of operational failures by the service provider.
4.1.2 Financial institutions that intend to outsource certain managerial and internal control
functions including compliance and internal audit should refer to section 4.3.1. Furthermore, it should be recalled that an outsourcing contract, which was previously not material may subsequently become material resulting from an increase in volume or nature of the activity outsourced to the service provider or for any other reason.

4.1.3 A financial institution that intends to outsource a material activity is required to
notify and obtain the prior authorization of the Bank. Such authorization should be sought at least 15 working days before entering into an agreement with the service provider. Annex 2 provides a list of information that should be submitted along with the request for authorization. The Bank may require additional information from outsourcing financial institutions and service providers depending on the specificities of the outsourcing arrangements.
4.2 Outsourcing of Non-Material Activities
4.2.1 There are certain types of activities that do not affect the internal control system to a
large extent and consequently do not pose significant risk. In that sense, such activities may be considered as non-material activities. Non-material activities are generally those that:

require infrastructure necessitating substantial investment as to render provision
of services nearly impossible and those that require the use of third-party service providers such as telephone, utilities, common network infrastructures (e.g. VISA, Mastercard);
are statutory or cannot legally be provided by financial institutions such as
statutory audits, discreet advisory services including legal opinions; and
are generally considered very low-risk, for instance, courier, mailing and
printing services.
4.2.2 Financial institutions are free to outsource non-material activities and do not need to
seek authorisation of the Bank, provided the activities do not require approval or authorisation under the Banking Act 2004. However, they should ensure that adequate risk management procedures are in place at all times. The board of directors and management should be fully aware of and responsible for the outsourcing of non-material activities.
4.3 Activities that cannot be Outsourced
4.3.1 Financial institutions would not be allowed to outsource certain core activities.
These activities should remain within the organisation in order not to lose control. Certain activities, if outsourced, might affect management ability to run the business properly. Activities that are considered ‘core’ and should not be outsourced are;
board and senior management functions such as strategic oversight;
internal audit function; and
compliance function.
4.3.2 The Bank would not support the outsourcing of the abovementioned activities.
However, exceptions for certain types of intra-group outsourcing may be allowed. This would be considered on a case-by-case basis. Financial institutions that intend to outsource the aforesaid activities, within the group, are required to seek prior authorization of the Bank and to consider the outsourcing of such activities as material outsourcing. As such the same requirements apply as in section 4.1.3.
4.3.3 The Bank is of the view that the internal audit function should be an integral part of
the systems of internal control established and maintained by management and

should provide independent assurance over the integrity and effectiveness of these systems. Generally, the Bank would not support the outsourcing of internal audit function to service providers. However, in certain circumstances, such as in section 4.3.2, the Bank may consider, on a case-by-case basis, the outsourcing of internal audit function. In no circumstances, the Bank would allow financial institutions to outsource the internal audit function to their external auditors. This is mainly for the simple reason that there will be an absence of independence when a service provider is handling both the internal and external audits.
4.4 Outsourcing Outside Mauritius (“Offshoring”)
4.4.1 A Survey conducted by the Bank on activities outsourced by financial institutions
revealed that many financial institutions outsource certain types of activities to service providers outside Mauritius, also known as ‘offshoring’. This practice increases the exposures of financial institutions to country risk. Financial institutions that engage in cross-border outsourcing should take into account the country risk element and hence the capacity to keep under control the ability of the service provider to deliver the service uninterruptedly. They should avoid crossborder outsourcing arrangements with countries that do not have legisla tions on confidentiality and where regulators may be denied access to information held by such service providers.
4.4.2 Financial institutions should also consider scenarios in case of disruptions in
business continuity. An aspect that financial institutions should consider seriously in this respect is how quickly and efficiently the processes could be reverted to the home country so as to keep to a minimum any potential disruption of service by the financial institution due to this factor.
5. Role of the External Auditor
5.1 The external auditor should review and attest the adequacy of the policies and
processes put in place by financial institutions for outsourcing activities. They should immediately inform the Bank of any material weaknesses or irregularities that, in their opinion, might affect the well-being of the financial institution or have additional operational risk implications.
6. Cancellation
6.1 In February 2001, the Bank issued to all banks a guideline entitled ‘Guideline on
Internet Banking’. The guideline deals with issues relating to Internet banking and
section 12 thereof deals exclusively with outsourcing of banks’ Internet banking
activity. This Guideline on Outsourcing by Financial Institutions covers broadly the outsourcing-related issues. As such, it supersedes section 12 of the Guideline on Internet Banking.
7. Application of the Guideline
7.1 This Guideline is applicable to all financial institutions falling under the regulatory
purview of the Bank. It needs to be emphasized, as mentioned in section 4.1.3, that

financial institutions should seek prior authorization of the Bank before entering into material outsourcing.
7.2 Financial institutions should conduct an assessment of all their existing outsourcing
arrangements against this Guideline. Where the outsourcing is considered material, financial institutions should inform the Bank in writing as to the level of compliance with the Guideline and report weaknesses, if any. They should also submit a plan and timeframe on how such weaknesses would be rectified. This should be done within 4 months from the effective date of this Guideline.
7.3 Financial institutions should inform the Bank immediately, of any adverse
development arising from any outsourcing arrangement that could significantly affect their businesses.
7.4 Financial institutions engaging in the use of cloud services should stand guided by the
Guideline on Use of Cloud Services which was issued on 7 September 2022.
8. Annual reporting
On a yearly basis, financial institutions should submit to the Bank a Return on Outsourced Activities, containing a list of all material and non-material activities that have been outsourced, in such form and manner prescribed by the Bank. This return should be submitted within the next twenty working days of the previous calendar year. Bank of Mauritius 6 January 2026 Introduced on 6 January 2026

Annex 1
Risks Involved in Outsourcing Financial Activities Strategic Risk • The service provider may conduct activities on its own behalf, which are inconsistent with the overall strategic goals of the financial institution.

Failure to implement appropriate oversight of the outsource provider.
Inadequate expertise to oversee the service provider.
Reputation Risk • Poor service from service provider.
Customer interaction is not consistent with overall standards of the
regulated entity.
Service provider practices are not in line with stated practices (ethical or
otherwise) of financial institutions.
Compliance Risk • Privacy laws are not complied with.
Consumer and prudential laws not adequately complied with.
Outsource provider has inadequate compliance systems and
controls.
Operational Risk • Technology failure.
Inadequate financial capacity to fulfil obligations and/or provide
remedies.
Fraud or error.
Risk that firms find it difficult/costly to undertake inspections.
Exit Strategy Risk • The risk that appropriate exit strategies are not in place. This could arise from over-reliance on one firm, the loss of relevant skills in the institution itself preventing it from bringing the activity back inhouse, and contracts, which make a speedy exit prohibitively expensive.
Limited ability to return services to home country due to lack of
staff or loss of intellectual history.
Counterparty Risk • Inappropriate underwriting or credit assessments.
Quality of receivables may diminish.
Country Risk • Political, social and legal climate may create added risk.
Business continuity planning is more complex.
Contractual Risk • Ability to enforce contract.
For offshoring, choice-of-law is important.
Access Risk • Outsourcing arrangement hinders ability of financial institutions to provide timely data and other information to regulators.
Additional layer of difficulty in regulator understanding activities of the
service provider.
Concentration and
Systemic Risk
Overall industry has significant exposure to service provider. This
concentration risk has a number of facets, including:
Lack of control of individual financial institutions over service
provider; and
Systemic risk to industry as a whole.

Annex 2
List of information to be submitted along with the request for authorisation for material outsourcing activities.

A feasibility study on the activity to be outsourced. In the absence of a feasibility
study, a statement on the ‘Rationale for Outsourcing’ should be submitted.
Profile of the service provider including, inter alia, details of significant
shareholders and senior management; and audited accounts over the last three years.
A draft outsourcing agreement to be entered between the financial institution
and the service provider.
A contingency plan of the outsourcing arrangement.
A statement by the Chief Executive stating that all the internal control procedures
and risk management systems are in place for the implementation of the outsourcing. Furthermore, he should state that the board of directors has given its approval for the outsourcing arrangement.

Guidelines on Outsourcing by Financial Institutions

Lineage: In force

Similar documents from other regulators