FCA: no 'significant concerns' with banks' approach to outsourcing

The regulator said in its monthly regulatory round-up for September that it had reached the conclusion after completing a review of retail banks’ use of outsourcing. The review focused on looking at firms’ approaches to outsourcing and did not examine whether the approaches are mitigating potential harm that could arise, such as from service disruption and poor customer service, it said.

In its round-up, the FCA said that it did not "identify significant concerns" with banks' approaches to outsourcing. However, it highlighted the prescribed responsibility duty that firms are subject to when outsourcing under rules introduced by its sister regulator the Prudential Regulation Authority (PRA) in November 2017.

"Firms should be clear that those assigned this prescribed responsibility have overall accountability for outsourcing," the FCA said. "This includes where the responsibility for managing third parties is delegated."

The FCA also said there are further steps banks must take to reduce the potential harm that could arise from outsourcing.

"Firms must continue to have robust governance arrangements for outsourcing, including effective processes to identify, manage, monitor and report the risks it is (or might be) exposed to, as appropriate," it said. "These arrangements should help firms identify and reduce the potential harm to consumers if things were to go wrong."

"Consumers can be exposed to potential harm when a firm’s third party relationship ends, particularly if it ends unexpectedly. Robust oversight arrangements, that include sufficiently tested exit plans for different scenarios, will help reduce the potential harm by ensuring business continuity," it said.

The FCA also highlighted the growing appetite among banks to consider outsourcing services to the cloud.

In the summer, the regulator announced that guidance it had previously issued on outsourcing to the cloud would no longer apply to banks. At the time it confirmed that banks should instead adhere to the recommendations on cloud outsourcing that the European Banking Authority (EBA) has set instead. Those recommendations were finalised in late 2017, but only took effect on 1 July this year.

The EBA's cloud guidance is, however, in the process of being replaced too, with new, more general, guidance on outsourcing planned. The EBA's consultation on proposed new Committee of European Banking Supervisors (CEBS) guidelines on outsourcing was opened in June and is due to close on 24 September.

The FCA said it will have a "continued focus on outsourcing" and could "undertake further work in this area".