“Boards must get to grips with outsourcing risks” – Director General Derville Rowland

• The Central Bank views the management of outsourcing risk as key from both a Conduct and Prudential perspective.

• The Central Bank expects boards to have appropriate oversight and awareness of outsourcing arrangements and the associated risks.
• A Central Bank review had found that 185 banks, asset management firms, insurers and payment institutions collectively reported having 7,700 outsourcing arrangements in place.

Speaking today at a Central Bank conference on outsourcing, the Central Bank of Ireland’s Director General, Financial Conduct, Derville Rowland, set out the Central Bank’s views on outsourcing in the financial services industry, and the risks associated with it.

She said: “In order to deepen our understanding of the potential risks to which the financial services industry may be exposed as a result of outsourcing, last year we carried out a review of outsourcing activity across the financial services sector, including a survey of regulated firms. Some 185 banks, asset management firms, insurers and payment institutions collectively reported having 7,700 outsourcing arrangements in place and we received data on about 3,600 of these.

“While the review found some good practices, overall the results were disappointing. To put it bluntly, we found significant risk management deficiencies on a widespread basis. More broadly, we concluded that, when it comes to outsourcing arrangements, governance and risk management standards are emphatically not where they need to be.”

The Central Bank is hosting today’s conference to discuss the evolving risks associated with outsourcing and to determine whether further guidance or policy is required in this area.

The Director General told an audience of regulators, financial services and outsourced service providers that the Central Bank views the management of outsourcing risk as key from both a Conduct and Prudential perspective. Outsourcing failures can have significant impacts on consumers, customers and investors in terms of loss of service, market operations, poor customer experience and potential financial loss.

She said: “Let me be very clear that the Central Bank expects boards to have appropriate oversight and awareness of outsourcing arrangements and the associated risks.”

In relation to accountability and enforcement, she said: “Ultimate accountability for compliance remains with regulated firms, particularly the boards of those firms. Where a firm chooses to outsource a regulated activity, that firm will be held responsible for any regulatory breaches that occur.  Indeed, the Central Bank has taken enforcement action regarding the failure by regulated firms to ensure that outsourced regulated activities are compliant with the relevant regulation including the Consumer Protection Code.”

She concluded: “From a Central Bank perspective, it is critical that we have visibility of activities that are being outsourced and that firms ensure that, when entering into such arrangements, that there are no barriers to our ability to effectively supervise those activities. It is also key that regulated firms can clearly demonstrate their understanding of their outsourcing arrangements and effectiveness of the governance and risk management measures in place.”

Notes to Editors:

• The Central Bank published a discussion paper (PDF 1.4MB) on outsourcing last year including the findings of a detailed review of outsourcing activity in the regulated financial services sector.