1. Application of paragraph 63 of the EBA Guidelines on outsourcing arrangements to third-country subsidiaries of EU institutions

As regards the scope of application, paragraph 9 of the EBA Guidelines on outsourcing arrangements specifies that institutions should comply with the EBA guidelines on a solo basis, sub-consolidated basis, and consolidated basis, in line with the provisions of Article 109, paragraph 2, of Directive 2013/36/EU (CRD). According to Article 109 of CRD, institutions need to ensure that policies are implemented on a consolidated basis. Consequently, group policies should also apply to subsidiaries that are not subject to the CRD individually, including institutions located in third countries.

The guidelines cannot deviate from Article 109 CRD, which prescribes how requirements should be applied on a prudential consolidated basis, including in third countries. As a result, where subsidiaries of EU institutions in a third country outsource functions to service providers in third countries to an extent that would require authorisation or registration: i. these service providers should be authorised or registered to provide that banking activity or payment service in the third country and supervised by a supervisory authority in the third country; and ii. adequate cooperation agreements with the supervisory authority of the service provider should be in place to ensure effective supervision on a consolidated basis.

A specific clarification on this issue was also provided in the Final report on EBA Guidelines on outsourcing arrangements, in the summary of EBA’s analysis to responses of the consultation (please refer to page 68, paragraph 3, and pages 73, 76, and 79 of the Final report).

Therefore, paragraph 63 should apply in this context. In accordance with the spirit of the guidelines, the provisions  of paragraph 63 shall also apply in the case where a service provider sub-outsources that banking activity or payment service to a service provider located in a third country.

2. Service providers located in the EU that are part of third-country groups

There is no reference to the location of the group the service provider belongs to in the guidelines (see e.g paragraph 43, letter d. on differentiation to be made in the outsourcing policy, paragraph 68, letter c on the risk assessment of outsourcing arrangements, paragraph 73 on due diligence, paragraph 86 on access rights). The outsourcing arrangements should set out the rights and obligations of the institutions, on the one hand, and the service provider, on the other hand.

The distinction according to whether the service provider is located in the EU or in a third country is to be understood against the background of the need to establish whether specific cooperation arrangements may be needed between an EU competent authority and the supervisory authority of the service provider to allow an efficient supervision of outsourcing arrangements that relate to authorized or registered activities.

In this regard, paragraphs 62 and 63 of the guidelines specify that institutions should abide by specific conditions that differ depending on whether the service provider is located in the EU or in a third country. Indeed, additional requirements apply if the service provider is located in a third country.

A service provider which is part of a third-country group but is located in an EU Member State as a separate legal entity falls into the scope of paragraph 62 (and not 63) of the EBA guidelines. In this context, no consideration should be given to the location of the group the service provider is part of.