| 1. |
Before entering into any Outsourcing arrangements, VASPs must consider the additional risk that may be posed if the Service Provider is allowed to further contract part of the service to third parties. |
| 2. |
Sub-Outsourcing – all Outsourcing arrangements.
|
| |
a. |
Consent should be given to sub-Outsourcing only if the subcontractor undertakes to—
|
| |
|
i. |
comply with all applicable laws, regulatory requirements and contractual obligations; and |
| |
|
ii. |
provide the same contractual rights of access and audit as those granted to the VASP and where applicable its regulators [including VARA] by the Service Provider.
|
| |
b. |
VASPs should ensure that no sub-Outsourcing engaged by the Service Provider will impede the Service Provider’s ability to comply with its contractual obligations to the VASP, including requirements on confidentiality of client data, information access and audit rights, and business continuity planning.
|
| 3. |
Sub-Outsourcing – Material Outsourcing. The following requirements apply in relation to sub-Outsourcing in relation to all or part of a Material Outsourcing—
|
| |
i. |
the Outsourcing agreement should specify whether or not sub-Outsourcing is permitted; and |
| |
ii. |
if sub-Outsourcing is permitted, the written Outsourcing agreement should—
|
| |
|
1. |
specify any types of activities that are not permitted to be sub-Outsourced; |
| |
|
2. |
specify the conditions to be complied with in the case of sub-Outsourcing; specify that the Service Provider is obliged to oversee those services that it has subcontracted to ensure that all contractual obligations between the Service Provider and the VASP are continuously met; |
| |
|
3. |
include an obligation of the Service Provider to inform the VASP of any planned sub-Outsourcing, or material changes thereof, in particular where that might affect the ability of the Service Provider to meet its responsibilities under the Outsourcing agreement; |
| |
|
4. |
ensure, where appropriate, that the VASP has the right to object to an intended sub-Outsourcing, or material changes thereof, or that explicit approval is required; and |
| |
|
5. |
include provisions such that the VASP has the contractual right to terminate the agreement in the case of undue sub-Outsourcing [e.g. where the sub-Outsourcing materially increases the risks for the VASP or where the Service Provider sub-Outsources without notifying the VASP].
|