Opinion of the European Central Bank of 26 February 2021 on the supervision of outsourcing arrangements entered into by credit institutions (CON/2021/8)

OPINION OF THE EUROPEAN CENTRAL BANK of 26 February 2021 on the supervision of outsourcing arrangements entered into by credit institutions (CON/2021/8) Introduction and legal basis

On 13 January 2021 the European Central Bank (ECB) received a request from the German Ministry of Finance for an opinion on the Law on strengthening the integrity of the financial market (hereinafter the ‘draft law’). The ECB’s competence to deliver an opinion is based on Articles 127(4) and 282(5) of the Treaty on the Functioning of the European Union and Article 2(1) of Council Decision 98/415/EC , as the draft law relates to the specific tasks conferred upon the ECB concerning the prudential supervision of credit institutions pursuant to Article 127(6) of the Treaty. In accordance with the first sentence of Article 17.5 of the Rules of Procedure of the European Central Bank, the Governing Council has adopted this opinion.

1. Purpose of the draft law

The draft law’s main purpose is it to foster public confidence in the German financial market. To that end, the draft law aims to prevent manipulation of the balance sheets of capital market companies by strengthening balance sheet controls and by further regulating the auditing of financial statements. Moreover, the draft law aims at improving the supervisory structures and the powers of the Bundesanstalt für Finanzdienstleistungsaufsicht (BaFin, Federal Financial Supervisory Authority) regarding the examination of outsourcing arrangements on the part of financial services companies. The consultation letter specifically requested an ECB opinion on Article 5 of the draft law, which introduces changes to the Law on banking , and on Article 8 of the draft law, which introduces changes to the Law on capital investment . Both articles concern the supervision of outsourcing arrangements by BaFin. 1.1 Definition of external service provider The draft law introduces a wide definition of what is regarded as an ‘external service provider’ . The term includes any company to which a credit institution has outsourced activities or processes to execute its ordinary services. The definition also covers outsourcing chains by including the

material subcontractors that the company engages with in order to execute the ordinary services of the credit institution. Whether the company is itself subject to supervision is irrelevant for the classification as an ‘external service provider’. 1.2 Notification obligation and outsourcing register A credit institution must notify the supervisory authority and the Deutsche Bundesbank of its intention to enter into a material outsourcing arrangement and the implementation of such an arrangement, including any material modification to the arrangement as well as any serious incident that has occurred as part of the outsourcing . As part of its risk management, a credit institution must keep an outsourcing register that lists all material and non-material outsourcing arrangements . 1.3 Appointment of an authorised agent in Germany A credit institution must contractually ensure that its external service providers in a material outsourcing arrangement which are established in third countries appoint an authorised agent in Germany to whom BaFin can serve documents and notifications . 1.4 Direct access to external service providers BaFin may issue orders directly to external service providers to which material activities and processes have been outsourced in order to prevent or stop breaches of supervisory law or to prevent or overcome deficiencies at a credit institution that could endanger the safety of the assets entrusted to the credit institution or impair the proper performance of its banking business or financial services . BaFin’s existing right to request information and documents from credit institutions, members of their governing bodies and their employees is extended to external service providers insofar as such requests relate to outsourced activities and processes. Whether the outsourcing arrangements are material or non-material is irrelevant . The right of BaFin to conduct an inspection of a credit institution is also extended to external service providers . In the same vein, BaFin’s existing power to order risk-reduction measures in order to remedy organisational deficiencies is extended to include external service providers insofar as the credit institution has outsourced material activities and processes . 1.5 Request to replace auditor The timeline within which BaFin can request the replacement of an auditor appointed by the credit institution is extended to two months . 1.6 Immediate enforceability and fines In line with the existing framework, BaFin is entitled to impose administrative fines in cases where credit institutions fail to comply with reporting requirements or where external service providers fail

to comply with orders issued by BaFin . Complaints against measures ordered by BaFin to prevent or stop breaches of supervisory law or to prevent or overcome deficiencies at a credit institution shall have no suspensive effect, i.e. are immediately enforceable .

2. Observations

2.1 This opinion is confined to Article 5 of the draft law, which introduces changes to the Law on banking concerning BaFin’s supervision of outsourcing arrangements entered into by credit institutions. 2.2 The ECB notes that the draft law introduces some of the processes and practices foreseen in the EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) (hereinafter, the ‘EBA Guidelines’) into the German legislative framework. These processes and practices include the obligation on credit institutions to notify the supervisory authority of its intention to enter into material outsourcing arrangements and the implementation of such arrangements, and the obligation to maintain a register of all material and non-material outsourcing arrangements. The ECB considers these measures as appropriate tools to ensure that the competent authority receives information useful to determine if the outsourcing arrangements involve a material change to the conditions and obligations of a credit institution’s initial authorisation in good time, and also to assess whether the outsourcing arrangement hinders its capacity to effectively supervise institutions. The extended notification requirements, such as the need to notify the supervising authority of serious incidents occurring as part of an existing material outsourcing arrangement that could materially influence the business activities of the credit institution, should allow the supervisor to be aware of potential problems early, and increases the ability of the competent authorities to react in a timely manner to the risks derived from such incidents. The ECB understands that the inclusion of these requirements in the German legislative framework is without prejudice to the provisions of the EBA Guidelines, which must also be considered by competent authorities when interpreting the requirements of the Law on banking. This is particularly relevant for the definition of ‘external service provider’, which has to be understood in accordance with the definition of ‘service provider’ as outlined in the EBA Guidelines. 2.3 The ECB observes that some aspects of the draft law go beyond the scope of the EBA Guidelines, such as the obligation on credit institutions to ensure contractually that that the external service provider appoints an authorised agent in Germany to whom BaFin may serve documents and notifications. Some of these requirements, such as the new power granted to BaFin to issue orders directly to external service providers to which material activities and processes have been outsourced, combined with the power to impose sanctions if such orders are not complied with, go beyond the traditional construct of Directive 2013/36/EU of the European Parliament and of the Council , where the role of the competent authorities is articulated exclusively vis-à-vis the credit

institution, which is the addressee of potential decisions or supervisory measures aimed at reducing the risk posed by a particular outsourcing arrangement. 2.4 The ECB notes, in general terms, that enhancing the digital operational resilience of credit institutions by extending supervisory powers directly to external service providers is a topical issue which needs to be addressed. In this regard, the proposed Regulation on digital operational resilience for the EU financial services sector (hereinafter the ‘DORA proposal’) deserves particular attention. Specifically, attention should be paid to the provisions setting out (a) the requirements in relation to the contractual arrangements concluded, inter alia, between credit institutions and information and communication technology (ICT) third-party service providers and (b) the oversight framework for critical ICT third-party service providers when providing services, inter alia, to credit institutions . It is understood that the German legislator will review the draft law once the DORA proposal is adopted in order to ensure full consistency with Union legislation . However, once Union legislation is adopted, the draft law will require additional adaptation, not just by the legislator but also on the part of credit institutions and their external service providers. Given the fact that the new obligations are mainly established regarding the particular outsourced service and not regarding service providers per se, it is particularly noted that while the draft law confers the power to issue orders directly to external service providers on BaFin, this should not replace the duty of credit institutions to have in place, appropriate arrangements, policies and practices to identify and manage the operational risks connected to the outsourcing of these activities. 2.5 The ECB understands that the new powers for the supervision of external service providers are granted to BaFin without prejudice to the supervisory responsibilities established under Regulation (EU) No 1024/2013 , which assigns to the ECB, responsibilities as competent authority for the supervision of significant credit institutions, including the supervision of the outsourcing arrangements entered into by credit institutions with third parties.

This opinion will be published on EUR-Lex.

Done at Frankfurt am Main, 26 February 2021.

[signed]

The President of the ECB

Christine LAGARDE