MAS proposes revisions to outsourcing regime for banks and merchant banks

26 February 2019

On 7 February 2019, the Monetary Authority of Singapore (“MAS”) released a consultation paper on “Outsourcing by Banks and Merchant Banks”, seeking feedback on proposed revisions to the regime governing the outsourcing arrangements of banks and merchant banks. The proposals include amendments to the Banking Act to strengthen MAS’ oversight of outsourcing arrangements, as well as the issuance of an Outsourcing Notice for Banks and an Outsourcing Notice for Merchant Banks (collectively, “Outsourcing Notices”) prescribing identical requirements for banks and merchant banks in relation to outsourcing arrangements which are material (“material outsourcing arrangements”). The consultation closes on 8 March 2019.

MAS consulted on a proposed Outsourcing Notice setting out minimum standards for financial institutions’ (“FIs”) management of outsourcing arrangements in September 2014. However, following feedback which revealed a variation in the scale and nature of utilisation of outsourcing by different classes of FIs, MAS now intends to adopt a more targeted approach by issuing requirements for each class of FIs within MAS’ regulatory purview.

MAS states that it intends to consult on the outsourcing requirements for other classes of FIs in future. In the meantime, it expects such other classes of FIs to continue to observe the MAS Guidelines on Outsourcing issued in July 2016.

New MAS powers to prescribe requirements relating to outsourcing arrangements of banks and merchant banks

To strengthen MAS’ oversight of banks’ outsourcing arrangements, MAS proposes to include in the Banking Act the power to direct banks to comply with requirements concerning their outsourcing arrangements. These include requiring banks to:

  • ensure that an outsourcing agreement includes terms requiring the service provider to protect the confidentiality of customer information and to provide documents or information relating to the outsourcing arrangement to the bank or MAS, and allowing the bank to terminate the outsourcing agreement under prescribed circumstances; 
  • conduct due diligence on the service provider before the bank enters into an outsourcing arrangement with the service provider; and 
  • establish and maintain measures to minimise disruption to the operations of the bank in the event that the service provider is unable to provide the service to the bank.

MAS also proposes similar oversight powers over merchant banks.

New Outsourcing Notices for banks and merchant banks regarding material outsourcing arrangements

Requirement to comply with Outsourcing Notice before customer information may be disclosed

Currently, banks and merchant banks must comply with MAS Notice 634 and MAS Notice 1108 respectively (“current Notices”) if any outsourced function is to be performed outside Singapore, when relying on an exception provided in item 3 of Part II of the Third Schedule to the Banking Act or the Banking Regulations respectively (“Third Schedule exception”) to disclose customer information to service providers.

The proposed Outsourcing Notices will incorporate existing requirements under the current Notices and impose minimum requirements on the management of material outsourcing arrangements, assessment of service providers, and additional requirements on audit. MAS will repeal the current Notices after the Outsourcing Notices take effect. Banks and merchant banks will be required to comply with the respective Outsourcing Notices before they can rely on the Third Schedule exception to disclose customer information to their service provider.

The consultation paper sets out the proposed amendments to the Third Schedule to the Banking Act. Similar amendments will also be made in respect of merchant banks.

Revision of definition of “outsourcing arrangement” and types of outsourcing arrangements to be considered “material outsourcing arrangements”

The current Notices apply only where customer information is disclosed in connection with the performance of an outsourced function outside Singapore. In contrast, the proposed Outsourcing Notices will apply to any outsourcing arrangement involving the disclosure of customer information regardless of where the outsourced function is to be performed. In this regard, MAS proposes to:

  • amend the definition of “outsourcing arrangement” to incorporate the definition in the Banking Act and include: (a) outsourcing arrangements on which a bank is not dependent on an ongoing basis; and (b) outsourcing arrangements entered into by a related entity of the bank to provide a service to the bank; and 
  • revise the types of outsourcing arrangements to be considered a “material outsourcing arrangement” and covered by the proposed Outsourcing Notices to include all outsourcing arrangements where customer information is disclosed, or where the service provider or sub-contractor has access to, possesses or collects customer information. Thus, all outsourcing arrangements involving disclosure of customer information will be considered material outsourcing arrangements, regardless of the tenure of the arrangements and the impact of unauthorised access or disclosure, loss or theft of such customer information.

MAS intends for these revisions to similarly apply to merchant banks.

Twelve-month transition period for Outsourcing Notices to take effect

MAS proposes that the Outsourcing Notices take effect 12 months from the date of issuance. This will allow banks and merchant banks to make the necessary arrangements to comply with the proposed Outsourcing Notices.

Reference materials

The following materials are available on the MAS website www.mas.gov.sg:

 

Download PDF