BSP tightens rules on bank outsourcing

MANILA, Philippines – The Bangko Sentral ng Pilipinas (BSP) has further strengthened the guidelines on outsourcing for Philippine banks as well as non-bank financial institutions.

BSP Deputy Governor Nestor Espenilla Jr. said the guidelines on outsourcing were amended by the Monetary Board.

“The amendments to the guidelines on outsourcing aim to set out an overarching governance framework, and align expectations with the principles of the guidelines on operational risk management,” he said.

Espenilla said major changes to the guidelines cover expectations or responsibilities of the board in managing outsourcing risks and the emphasis on having effective processes and systems to monitor and mitigate operational risks.

Likewise, he added the new guidelines also cover expectation on proper risk evaluation before banks and non-bank financial institutions enter into outsourcing contracts.

The BSP allows banks and non-bank financial institutions to outsource to third parties or to related companies in the group certain services or activities.

However, the bank regulator requires banks and non-bank financial institutions to put in place appropriate processes, procedures, and information system that can adequately identify, monitor, and mitigate operational risks arising from the outsourced activities.

Likewise, the banks’ board of directors and senior management should remain responsible for ensuring that outsourced activities are conducted in a safe and sound manner and in compliance with applicable laws, rules and regulations.

Outsourcing refers to any contractual arrangement between a bank and a qualified service provider for the latter to perform designated activities on a continuing basis.

BSP Governor Amando Tetangco Jr. has issued a circular containing the amendments to the guidelines on outsourcing.

The new guidelines state that key risk areas related to outsourcing such as strategic; reputation /legal; operational, compliance, country and concentration risks should be evaluated before entering into and while managing outsourcing contracts.

The BSP requires banks and non-bank financial institutions to perform risk assessment of a business activity and evaluate the implications of performing the activity in-house or having the activity outsourced.

The bank regulator also requires banks to establish policies and criteria to select the "best" service provider for the outsourced activities and to get said services at reasonable price.