Notice No. 8/2023

Notice No. 8/2023
Published in: DR, 2nd Series, Part E, No. 242, of 18-12-2023 Mod. 99999910/T – 01/14

Index
Text of the Notice
Annex I to the Notice - Minimum content of the updated register of information on all outsourcing agreements
Annex II to the Notice - Model format for communication of outsourced functions

Text of the Notice

The use of outsourcing of functions by financial institutions has increased significantly in recent years, largely aiming to promote overall cost reduction and control, efficiency improvement, flexibility, and economies of scale. Outsourcing also facilitates access to specialized technical knowledge, especially given the growing importance of information and communication technologies, with a view to accelerating the ongoing digital transformation and increasing efficiency in the face of greater regulatory demands to which institutions are subject. However, a greater reliance on and dependence on outsourcing by institutions also entails relevant risks that must be safeguarded, as, ultimately, the materialization of such risks may affect the resilience and operational performance of these institutions and, in the extreme, the stability of the financial system. It is in this context that the governance and internal control systems of supervised institutions, in particular risk management systems, must provide for adequate management of outsourced functions, for which robust internal control mechanisms must be established to ensure that all risks to which a supervised institution is or may become exposed arising from the use of outsourcing of functions, in particular of essential or important functions, are adequately and timely identified, assessed, monitored, and controlled so as to ensure that they remain within the risk tolerance limits defined in the institutions' risk policies. Within the framework of the mandate established in Directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013, subsequently amended by Directive (EU) 2019/878 of the European Parliament and of the Council of 20 May 2019, and the powers provided for in Article 16(1) of Regulation (EU) No 1093/2010 of the European Parliament and of the Council of 24 November 2010, the European Banking Authority (EBA) published on 25 February 2019 the "Guidelines on outsourcing arrangements" (EBA/GL/2019/02) which establish a broad set of guidelines and recommendations related to the implementation of mechanisms and processes for the effective management of outsourced functions, with a view to strengthening and harmonizing the outsourcing policies and practices of the addressees.

Notice No. 8/2023
Mod. 99999910/T – 01/14

This Notice defines the minimum requirements for the registers of information on outsourcing agreements and the format for communicating this information to Banco de Portugal. By defining methods for the harmonized implementation of existing duties, the Notice simplifies the regulatory framework, reduces uncertainty, contributes to the consistency of procedures and requirements between institutions, and reinforces supervisory powers in this matter, taking into account the evidence and recognition of the growing relevance of this risk to financial stability. Banco de Portugal disseminated the EBA/GL/2019/02 through Circular Letter No. CC/2019/00000065 of 15 October 2019. Taking into account the above, this Notice absorbs the content of Circular Letter No. CC/2019/00000065, which thus ceases to be relevant from the entry into force of this Notice, without prejudice to the recommendation remaining naturally valid for credit institutions, investment firms, payment institutions, and electronic money institutions subject to the supervision of Banco de Portugal to continue to observe the requirements provided for in EBA/GL/2019/02. Within the scope of the supervision of payment services and electronic money issuance, as well as the supervision of the internal governance and internal control mechanisms of institutions, there are specific requirements regarding outsourcing (respectively, Article 33 of the Legal Regime of Payment Services and Electronic Money, approved by Decree-Law No. 91/2018 of 12 November (RJSPME) and Chapter VII and Annex to Banco de Portugal Notice No. 3/2020), which are clarified/harmonized with this Notice. Regarding the temporal scope of the register of outsourcing agreements, and given the time elapsed since the issuance of Circular Letter No. CC/2019/00000065, it was considered that all agreements currently in force and those terminated in the previous 12 months should be included, in order to ensure an adequate risk management assessment. The draft of this Notice was subject to public consultation in accordance with legal provisions. In these terms, Banco de Portugal, using the powers conferred upon it by letter f), paragraph 1, Article 17 applicable ex vi paragraph 2 of Article 99, and letters b) and c) of paragraph 1 and paragraph 2 of Article 120, all of the General Regime of Credit Institutions and Financial Companies (RGICSF), approved by Decree-Law No. 298/92 of 31 December, and by the provisions of letter c) of paragraph 1 of Article 7, in paragraph 4 of Article 70, and paragraph 3 of Article 60, all of the RJSPME, determines the following:

Article 1.
Object
1 - This Notice establishes:
a) The duty to maintain an updated register of information on outsourcing agreements in institutions, with a certain minimum content, as well as the duty to communicate the information contained in that register to Banco de Portugal when requested; b) The duty to communicate to Banco de Portugal in case of intention to outsource essential or important functions or any significant changes and/or serious events related to outsourcing agreements, likely to have a significant impact on the continuity of activities developed by institutions, in accordance with the instructions referred to in Annex I and II of this Notice. c) The format of communication to Banco de Portugal. 2 - The concept of outsourcing corresponds to that provided for in letter b) of paragraph 1 of Article 115-T of the RGICSF, as detailed by the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02).

Article 2.
Scope of application
1 - Without prejudice to other applicable legal and regulatory provisions, the provisions of this Notice apply to the following entities (hereinafter referred to as "institutions"):
a) Credit institutions with headquarters in Portugal, with the exception of institutions classified as significant in terms of paragraph 4 of Article 6 of Council Regulation (EU) No 1024/2013 of 15 October 2013, which confers specific tasks on the European Central Bank regarding policies relating to the prudential supervision of credit institutions; b) Payment institutions and electronic money institutions, with headquarters in Portugal; c) Branches, authorized to carry out activity in Portugal, of institutions mentioned in the preceding letters that have headquarters in countries that are not Member States of the European Union. 2 - The institutions mentioned in letter a) of the previous paragraph must comply with the provisions of this Notice on an individual, sub-consolidated, and consolidated basis. 3 - The application on an individual basis provided for in the previous paragraph may be waived by Banco de Portugal in accordance with Article 129-B of the RGICSF, upon prior authorization requested from Banco de Portugal. 4 - The institutions mentioned in letter b) of paragraph 1 of this article must comply with the provisions of this Notice on an individual basis. 5 - The Central Credit Union of Mutual Agricultural Credit issues the necessary guidelines to ensure the consistent and harmonized application of the provisions of this Notice by the Integrated System of Mutual Agricultural Credit.

Article 3.
Minimum content of the register in institutions of outsourcing agreements 1 - Institutions maintain a complete and permanently updated register on all outsourcing agreements, including outsourced functions to service providers who are members of the group or the institutional protection system to which the institution resorting to outsourcing belongs. 2 - The register referred to in the previous paragraph includes, at least, all information elements contained in Annex I of this Notice. 3 - Banco de Portugal may request, at any time, the availability of the complete register of outsourcing agreements, or specific sections thereof, in which case the information is provided in the format contained in Annex I of this Notice. 4 - The content of the register mentioned in this article constitutes adequate and sufficient information for institutions to comply with the provisions of paragraph 9 of Article 36 and letter i) of paragraph 1 of the Annex of Banco de Portugal Notice No. 3/2020, regarding the information referred to in Article 63 of that Notice.

Article 4.
Communications to Banco de Portugal on outsourcing of essential or important functions 1 - Institutions intending to outsource an essential or important function communicate their intention to Banco de Portugal at least 15 business days before the scheduled date of signing the outsourcing agreement. 2 - When an outsourced function has become essential or important, institutions communicate this change immediately to Banco de Portugal. 3 - The communications to Banco de Portugal provided for in the previous paragraphs are made in the format contained in Annex II of this Notice. 4 - The communications provided for in paragraphs 1 and 2 are accompanied by an opinion signed by the person responsible for the outsourcing function or equivalent senior management responsible for this function, in the sense of letter c) of paragraph 38 of EBA/GL/2019/02, which confirms compliance with the provisions contained in those Guidelines or describes and justifies the reasons for non-compliance with any of the provisions of those Guidelines. 5 - Institutions immediately inform Banco de Portugal if, during the validity of the outsourcing agreement of an essential or important function:
a) Any subsequent fact occurs that is likely to affect the nature or assessment of the risks arising from the previously carried out outsourcing; and b) The occurrence of such fact alters the information previously communicated to Banco de Portugal. 6 - The communication provided for in the previous paragraph is made by sending the parts of Annex II of this Notice that contain the altered information. 7 - For the purposes of paragraph 5, subsequent facts are considered both facts occurring after the communication to Banco de Portugal of the information provided for in this article, as well as information about previous facts that only come to the knowledge of institutions after the communication to Banco de Portugal has been made. 8 - Institutions inform Banco de Portugal, in a complete and timely manner, of any significant changes or serious events related to their outsourcing agreements likely to have a significant impact on the continuity of their business activities. 9 - The communications mentioned in this article constitute adequate and sufficient information for institutions to comply with the provisions of paragraphs 2 and 6 of Article 33 of the RJSPME.

Article 5.
Communication channels
The communication to Banco de Portugal of the information provided for in this Notice is carried out through the BPnet System, regulated by Banco de Portugal Instruction No. 16/2023 of 11 July, in the "Prudential Supervision" area, "Prudential Supervision - Reports" functionality, using (i) the "Submission of reports via correspondence" service, for the purposes of the communications provided for in Article 4 of this Notice, and (ii) the "Submission of Reports via File Transfer (NEW)" service, for the purposes of responding to requests provided for in paragraph 3 of Article 3 of this Notice.

Article 6.
Entry into force and temporal application
1 - This Notice enters into force the day following its publication, without prejudice to the provisions of the following paragraphs.
2 - The register referred to in Article 3 of this Notice includes all agreements currently in force, as well as those that ceased in the previous 12 months.
3 - The communications referred to in Article 4 of this Notice apply to all agreements whose scheduled signing date or the date of occurrence of subsequent facts motivating the communication is at least 30 days after the entry into force of this Notice. 4 - Banco de Portugal reviews the content of this Notice within 18 months after its entry into force and proceeds, if necessary, to its adjustment in light, inter alia, of the evolution of the applicable legal and regulatory framework to ensure the necessary consistency.

28 November 2023. - The Governor, Mário Centeno.

Annex to Notice No. 8/2023

Annex I to the Notice - Minimum content of the updated register of information on all outsourcing agreements1

I. Cover Page
Institution: AF Code - Name
Reference Date: DD/MM/YYYY

II. Register
Agreement Information
Applicable to all agreements
010 170 180 190 200 210 270 290
Reference number of the outsourcing agreement
Start date of the agreement
Next renewal date of the agreement
End date of the agreement
Notice period for termination by the institution Notice period for termination by the provider Essential or important?
Date of the last assessment of the importance of the agreement?

1 Response template available for download here: updated register of information on all existing outsourcing agreements in the institution.

Agreement Information
Agreements relating to essential or important functions 010 280 330 340 350 360 370 380 390 400 410 Reference number of the outsourcing agreement Rationale for importance (select all applicable options) Contract was reviewed considering the application of EBA/GL/2019/02 and relevant European and national legislation Estimated annual budgeted cost (euros) Date of the last risk assessment/service provider Basis of risk assessment Responsible body or individual responsible for the approval of the agreement Law applicable to the agreement Date of the Last audit Date of the Next audit Possibility of parts of the outsourced functions included in the contract being subject to cascading outsourcing Entity signing the agreement Service recipient Applicable to all agreements Applicable to all agreements 010 020 030 040 050 060 070 Reference number of the outsourcing agreement LEI Code Name Registration Country LEI Code Name Registration Country Service Provider Applicable to all agreements 010 080 090 100 110 120 130 140 150 160 Reference number of the outsourcing agreement LEI Code Tax ID Name Country of supplier headquarters Address of the service provider Intra-group provider? Name of the supervisory authority of the service provider Parent Company Country of parent company headquarters

Outsourced Function
Applicable to all agreements
010 221 230 231 232 233 240 250 260 300 310 320 Reference number of the outsourcing agreement Category of the outsourced function Brief description of the outsourced function Essential or important function? Institutions within the prudential consolidation scope that resort to the outsourced function Level of dependence on the outsourced service/function/provider Were personal data transferred or their processing outsourced to a service provider? Country/countries of data storage Country/countries providing services Cloud computing service model Cloud computing deployment model Cloud computing - nature of the data subject to outsourcing

Outsourced Function
Agreements relating to essential or important functions 010 470 480 490 510 500 Reference number of the outsourcing agreement Result of the assessment of the substitutability of the service provider Difficulty of reintegrating the outsourced function Impact of discontinuing the outsourced function Support for urgent business operations Names of alternative service providers

Cascading Outsourcing
Agreements relating to essential or important functions 010 011 420 430 440 450 460 Reference number of the outsourcing agreement Internal reference number of the cascading outsourcing relationship Name of the Subcontractor(s) in Chain Registration Country of the Service Provider(s) in Chain Country/countries where the service will be provided by the Service Provider(s) in Chain Country/countries of data storage by the Service Provider(s) in Chain Were personal data transferred or their processing outsourced to a service provider (by the service provider)?

III. Explanatory Notes
General Instructions:

• The scope of outsourcing agreements in this register includes all those that, according to the institution's classification, in conformity with the definition and requirement of EBA/GL/2019/02, are considered outsourcing agreements (whether or not essential or important).
• The consolidation scope of this register includes all outsourcing agreements and outsourced functions that the supervised institution(s) use(s) (C050, C060), i.e., that are part of the prudential consolidation perimeter and are supervised by Banco de Portugal.
• The temporal scope of this register includes all agreements that ended or were terminated after 31/12/2021. The respective termination date must be reported in field C190.
• Column G ("Key") of the table below indicates the fields that constitute the key for the purposes of identifying unique lines and which cannot be empty.
• The table below presents the designation, format, and filling instructions for all fields of the report.
• Any questions regarding filling should be sent to unf@bportugal.pt.

Column Block Designation Format Filling Instructions Key 010 Agreement Information Applicable to all agreements Reference number of the outsourcing agreement Alphanumeric (A/N) This column must contain a unique reference number for the agreement described in each line. When several lines describe a single agreement, they will all share the same reference number. Several lines will be used to describe agreements where there is/are subcontractor(s), as well as in cases where multiple functions are outsourced in the same agreement. ✔ 170 Start date of the agreement Date ("dd/mm/yyyy") Indication of the start date of the agreement. 180 Next renewal date of the agreement Date ("dd/mm/yyyy") Indication of the date corresponding to the next renewal of the agreement. 190 End date of the agreement Date ("dd/mm/yyyy") Indication of the end date of the agreement. In the case of a renewable agreement, leave the field empty. 200 Notice period for termination by the institution A/N Notification period required by the institution for the termination of the service provision contract, in days or months (the time unit must be indicated in the response) 210 Notice period for termination by the provider A/N Notification period required by the service provider for the termination of the service provision contract, in days or months (the time unit must be indicated in the response) 270 Essential or important? ("Yes" / "No") "Yes" if at least one essential or important function is outsourced; "No" if no essential or important function is outsourced. 290 Date of the last assessment of the importance of the agreement? Date ("dd/mm/yyyy") Date of the most recent assessment of the essential or important nature of the outsourcing agreement. 280 Essential/important agreements Rationale for importance (select all applicable options) Numeric Reasons why outsourcing is considered essential or important; Selection of the following criteria:
1 - a service disruption may materially impact compliance with authorization conditions or the institution's obligations under Directive 2013/36/EU, Regulation (EU) No 575/2013, Directive 2014/65/EU, Directive (EU) 2015/2366 and Directive 2009/110/CE and its regulatory obligations 2 - a service disruption may cause material financial impacts 4 - a service disruption may materially impact the robustness and continuity of banking activities and payment services 8 - internal control operational tasks are outsourced 16 - outsourcing of banking activities or payment services requiring authorization by the competent authority 32 - outsourcing of operational tasks of functions