Circular 2018/3 Outsourcing Banks and Insurance companies

Transcription

1 Circular 2018/3 Outsourcing Banks and Insurance companies Outsourcing by banks and insurance companies

2 Circular 2018/3 Outsourcing Banks and Insurance companies Outsourcing by banks and insurance companies

3 Circular 2018/3 Outsourcing Banks and Insurance companies Outsourcing by banks and insurance companies Reference: FINMA circ. 18/3 Outsourcing banks and insurance companies Issued: 21 September 2017 Entry into force: 1 April 2018 Concordance: previously FINMA circ. 08/7 "Outsourcing banks" of 20 November 2008 Legal bases: FINMASA Article 7(1)(b) BA Article 3(2)(a) SESTA Article 10(2)(a) SESTO Article 19 ISA Articles 4(2)(j), 5(2), 14(3), 47(2) Addressees BA ISA SESTA FMIA CISA AMLA OTHERS Banks Financial groups and congl. Other intermediaries Insurance companies Ins. groups and congl. Distributors Securities dealers Trading Venues Central Counterparties Central depositories Trade repositories Payment systems Participants Fund management companies SICAV Limited partnerships for CIS SICAF Custodian banks Managers domestic CIS Distributors Representatives of foreign CISs Other intermediaries SROs DSFIs SRO Supervised Audit firms Rating Agencies X X X Circular 2018/3 Outsourcing Banks and Insurance companies 2

4 Table of Content I. Purpose margin no. 1 II. Definitions margin nos. 2 4 III. Scope margin nos. 5 6 IV. Admissibility margin nos A. Common Provisions margin nos. 7 9 B. Insurance companies margin nos V. Requirements applicable to outsourcing companies margin nos A. Inventory of outsourced functions margin nos B. Selection, instruction and monitoring of the service provider: margin nos C. Group-internal outsourcing margin no. 22 D. Responsibility margin no. 23 E. Security margin nos F. Audit and Supervision margin nos G. Outsourcing abroad: margin nos H. Agreement: margin nos VI. Conditions and exceptions margin no. 36 VII. Transitional provisions margin nos Circular 2018/3 Outsourcing Banks and Insurance companies 3

5 I. Purpose This circular sets out the regulatory requirements for outsourcing solutions applicable to banks, securities dealers and insurance companies. For these, it sets out the requirements for an appropriate organization aimed at limiting their risk. 1 II. Terms Companies shall be defined as institutions (banks, securities dealers and insurance companies) within the scope of this circular. 2 Outsourcing as defined the circular shall exist when a company contracts a service provider to independently and permanently perform a function, either wholly or in part, that is essential for the company s business activities. 3 The functions that support the compliance with the objectives and regulations of financial market supervision legislation shall be deemed essential. 4 III. Scope This circular shall apply to: Banks and securities dealers domiciled in Switzerland as well as Swiss branch offices of foreign banks and securities dealers; 5 Insurance companies domiciled in Switzerland and branch offices of foreign insurance companies, which require a license to run a business as an insurance company in accordance with Articles 3 and 6 ISA (initial request) or the approval to amend certain elements of the business plan as per Article 4 in conjunction with Article 5 ISA (approval of amendments). 6 IV. Admissibility A. Common Provisions All essential functions may be outsourced, except for the following ones (margin nos. 8 13). It is not possible to outsource the supreme governing body in charge of guidance, supervision and control, central management functions performed by the executive board and functions that involve making strategic decisions. Decisions about entering into or discontinuing business relationships may also not be outsourced. 7 8 Companies in supervisory categories 1 to 3 shall dispose of independent risk control and compliance functions that act as independent monitoring bodies. For companies in supervisory categories 4 and 5, it is sufficient to appoint a person in the executive board who shall be responsible for these functions. 9 Circular 2018/3 Outsourcing Banks and Insurance companies 4

6 Operational risk management and compliance tasks can be outsourced in all supervisory categories. B. Insurance companies According to Article 4(2)(j) in conjunction with Article 5(2) ISA, the outsourcing of essential functions and the limited permissible outsourcing of control functions are relevant to the business plan and shall therefore be subject to approval. 10 For insurance captives, the outsourcing of management and control functions shall be permitted to a greater extent than for other insurance companies. The following are permissible: 11 Outsourcing the management of direct and reinsurance captives domiciled in Switzerland (incl. central management functions of the executive board) to specialized captive management companies; 12 Outsourcing the management of branch offices of foreign direct insurance captives within the Group or to captive management companies specializing in this area. The regulatory function of the general agent (Article 17 and 18 ISO) may not be restricted as a result. 13 V. Requirements applicable to outsourcing companies A. Inventory of outsourced functions An up-to-date inventory of the outsourced functions must be kept. Such an inventory shall comprise a description of the outsourced function, specify the provider(s) (incl. subcontractors) and recipient(s), as well as the person responsible within the company (c.f. margin no. 20). 14 Insurance undertakings shall keep this inventory in accordance with the Business Plan Form J. 15 B. Selection, instruction and monitoring of the service provider The requirements for the provision of services must be specified and documented in detail in accordance with the outsourcing s objectives prior to concluding a contract. This shall include a risk analysis that comprises the main economic and operational considerations and the associated risks and opportunities. 16 The prospective service provider s professional capabilities as well as its financial and human resources must be carefully considered and assessed. If several functions are outsourced to the same service provider, the concentration risk must also be taken into account. 17 Furthermore, when deciding on outsourcing and selecting the service provider, thought must be given to the possibilities and consequences of a later change in service provider. The service provider has to offer a guarantee for a permanent service provision. An orderly re-integration of the outsourced function must be ensured. 18 The responsibilities of the company and the service provider must be contractually defined and delimited, in particular with regard to interfaces and responsibilities. 19 Circular 2018/3 Outsourcing Banks and Insurance companies 5

7 The outsourced business unit must be integrated into the company s internal control system. The material risk associated with the outsourcing must be systematically identified, monitored, quantified and managed. 20 A process owner shall be defined within the company who will be in charge of monitoring and controlling the service provider. Its services must be monitored and evaluated on an on-going basis so that any necessary measures may be taken in a timely manner. The company shall ensure that the service provider contractually grants the necessary rights of instruction and control. 21 C. Group-internal outsourcing With regard to the requirements of margin nos and 32 35, the Group s affiliation with the Group can be taken into account, provided that the risks typically associated with outsourcing verifiably do not exist or that certain requirements are not relevant or otherwise regulated. 22 D. Accountability The company shall remain accountable towards FINMA as if it were performing the outsourced function itself. It shall ensure the proper conduct of business at all times. 23 E. Security In the case of security-relevant outsourcing (especially in the area of IT), the company and the service provider shall agree on contractual security requirements. The company must monitor the compliance with these contractual requirements. 24 The company and the service provider shall work out a contingency plan that allows the continuation of the outsourced function in emergencies. When establishing and applying the contingency plan, the same degree of diligence shall apply to the company as if it were performing the outsourced function itself. 25 F. Audit and supervision The company, its audit firm as well as FINMA must be in a position to review the compliance with the supervisory provisions at the service provider. They shall be contractually entitled to inspect and audit the outsourced function at any time, in full and without hindrance. 26 Audit activities may be delegated to the service provider s external auditors, provided they possess the necessary technical competence. If audit activities are delegated, the company s external auditors may base their audit results on the audit findings of the service provider s external audit firm. 27 The outsourcing of a function must not make supervision by FINMA more difficult, especially in the case of outsourcing abroad. 28 If the service provider is not subject to FINMA supervision, it must contractually commit itself to the company to provide FINMA with all information and documents relating to the outsourced business area necessary for its supervisory activities. In the event that audit activities are delegated to the service pro- 29 Circular 2018/3 Outsourcing Banks and Insurance companies 6

8 vider s external auditors, their report must be made available, upon request, to the FINMA, the internal audit and outsourcing company s external auditors. G. Outsourcing abroad: Outsourcing abroad is permitted, provided that the company can explicitly guarantee that it itself, its external auditors and FINMA can exercise and enforce their right of inspection and examination. 30 A restructuring or wind-down of the company in Switzerland must be guaranteed. Access to the necessary information must be possible at any time in Switzerland. 31 H. Agreement The outsourcing must be based on a written contract. In addition to the name of the parties and a description of the function, it shall contain at least the following (margin nos ): 32 Subcontractors performing essential functions must be approved by the company beforehand. Where such subcontractors are involved, they shall be bound by the service provider s obligations and assurances required to comply with this circular. 33 Contractual arrangements must be made to implement the requirements of this circular and in particular margin nos. 21, 24, 26, 29, 30 and 31 of this circular. 34 The company must define the internal approval procedures for outsourcing projects as well as the competencies for the conclusion of such agreements. 35 VI. Conditions and exceptions In justified cases, FINMA may impose on a company other conditions and/or completely or partially exempt it from having to comply with this circular. 36 VII. Transitional provisions This circular shall apply to outsourcing arrangements of banks and securities dealers concluded or amended after its entry into force immediately. Outsourcing arrangements of banks and securities dealers that are already in place at the time of entry into force of the circular must be adjusted within a transitional period of five years from the date of entry into force in such a way that the requirements of the circular are complied with. 37 For insurance companies applying for an initial license, this circular shall apply as of its enactment. For amendment approvals, the circular shall apply from the moment the FINMA is informed of a business plan amendment or such an amendment is submitted. 38 Circular 2018/3 Outsourcing Banks and Insurance companies 7

9 Contacts Philipp Rickert Partner, Head of Financial Services, Member of the Executive Committee Zurich Tel Olivier Gauderon Partner, Financial Services Geneva Tel Markus Schunk Partner, Stream Lead Collective Investment Schemes Zurich Tel Patrizio Aggio Director, Financial Services Lugano Tel Mirko Liberto Partner, Stream Lead Regulatory Audit Tel mirkoliberto@kpmg.com Ralph Dicht Partner, Stream Lead Financial Audit Tel rdicht@kpmg.com Cataldo Castagna Partner, Cluster Head Assurance & Accounting Tel ccastagna@kpmg.com Michael Schneebeli Partner, Financial Services Zurich Tel mschneebeli@kpmg.com Helen Campbell Cluster Head Risk Management Tel hcampbell@kpmg.com The information contained herein is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received, or that it will continue to be accurate in the future. No one should act on such information without appropriate professional advice after a thorough examination of the particular situation. The scope of any potential collaboration with audit clients is defined by regulatory requirements governing auditor independence KPMG AG is a subsidiary of KPMG Holding AG, which is a member of the KPMG network of independent firms affiliated with KPMG International Cooperative ("KPMG International"), a Swiss legal entity. All rights reserved. Circular 2018/3 Outsourcing Banks and Insurance companies 8