Guideline 75 sets out a list of matters which are to be included in outsourcing agreements for critical and important functions. Paragraph q of that list (75(q)) provides that outsourcing agreements for critical and important functions should at least include the “termination rights, as specified in Section 13.4”. Section 13.4 (which comprises guidelines 98 and 99) does not explicitly refer to outsourcing arrangements for critical and important functions or state that it is intended to be directed towards 'all’ outsourcing agreements regardless of the criticality or importance of the function to which they relate. It refers only to ‘the outsourcing arrangement’.  

Our view is that the EBA intends for guidelines 98 and 99 to be directed towards arrangements for critical and important functions only and not all outsourcing arrangements. The reference to ‘the outsourcing arrangement’ in guidelines 98 and 99 should be read as a reference to ‘the outsourcing arrangements for critical and important functions’ and not as a reference to ‘all outsourcing arrangements regardless of the criticality or importance of the function to which they relate’.

To extend the application of guidelines 98 and 99 to all outsourcing arrangements would (1) be out of line with the approach the EBA took in its Consultation Paper, EBA Draft Guidelines on Outsourcing (June 2018) ("Consultation Paper"); (2) be inconsistent with the general approach the EBA has taken towards risk management in the final guidelines and disproportionate to the risks presented by outsourcing arrangements that do not relate to critical or important functions; and (3) render guideline 75(q) of little practical effect.

Consultation Paper

The Consultation Paper listed contractual requirements applicable to all outsourcings in draft guideline 63, and separately listed those only applicable to critical or important in draft guideline 64. The Consultation Paper specified that the termination rights set out in guidelines 98 and 99 apply only to critical or important outsourcing (see draft guideline 64(g)).

The final guidelines however change this approach and contain only a list of matters to be included in the outsourcing agreement for critical or important functions (guideline 75). That list contains some matters taken from the ‘all outsourcing’ list set out in draft guideline 63 of the Consultation Paper.

Our view is it would be a material departure from the EBA’s approach in its Consultation Paper to apply guidelines 98 and 99 to all outsourcing arrangements, in particular without having referred to that possibility during the consultation period or clarified why it changed its position in the comments provided in its final report.

Further, the use of the terminology “as specified in” as it appears in guideline 75(q) indicates that the EBA intends for guidelines 98 and 99 to be directed towards outsourcing agreements for critical and important functions only. The words “as specified in” were also used in draft guideline 64(g) of the Consultation Paper. While guidelines 98 and 99 do not explicitly state that they apply only to outsourcing arrangements for critical or important functions, neither did the equivalent draft guidelines in the Consultation Paper (draft guidelines 81 and 82). While the application only to critical or important functions in the Consultation Paper was clearer (because it split out the list of matters to be included in all outsourcing agreements from the narrower list of matters for critical or important functions and only the latter incorporated the termination rights by reference), our view is that it now makes sense to read the reference to “as specified in” in guideline 75(q) in the context of the same terminology as it appeared in draft guideline 64(g) of the Consultation Paper – the intention being that the termination provisions referred to apply only to agreements which relate to the outsourcing of critical or important functions.

EBA’s general approach to risk

In another context the guidelines specify that a guideline is to apply 'regardless of the criticality or importance of the function' (see guideline 86). As no such statement has been made in respect of guidelines 98 and 99, our view is that this further indicates that the references in guidelines 98 and 99 to ‘the outsourcing arrangement’ should be read as references to an outsourcing arrangement which relates to a critical or important function.

Guideline 75(q) would be of little practical effect if financial institutions and payment institutions were required to observe guidelines 98 and 99 regardless of the criticality or importance of the function.