IIROC Notice: Request for Comments on draft guidance regarding outsourcing arrangements

Transcription

1 Via January 18, 2013 Louis Piergeti Vice President, Financial Operations Compliance -and- Richard J. Corner Vice-President, Member Regulation Policy Investment Industry Organization of Canada Suite 2000, 121 King Street West Toronto, ON M5H 3T9 Dear Mr. Piergeti and Mr. Corner: Re: IIROC Notice: Request for Comments on draft guidance regarding outsourcing arrangements We are writing on behalf of RBC Dominion Securities Inc. (RBC DS), a full service securities firm, and RBC Direct Investing Inc.(RBC DI), a self-directed brokerage, in response to the request for comments issued by the Investment Industry Regulatory Organization of Canada ( IIROC ) on the draft guidance regarding outsourcing arrangements published on October 22, 2012 (the Notice ). We appreciate the opportunity to provide comments to the proposed guidance outlined in the Notice. We have participated in industry groups organized by both the Canadian Bankers Association (CBA) and the Investment Industry Association of Canada (IIAC). In this regard, we support the comments submitted by the CBA and the IIAC. General Comments At the onset, we recognize the importance of ensuring that Dealer Members have implemented the necessary policies and procedures to monitor contracting arrangements with third party service providers who are performing certain activities or functions related to the Dealer Members business operations. As stated in the Notice, Canadian banking institutions are Federally Regulated Entities (FREs) and are subject to the Office of the Superintendent of Financial Institutions (OSFI) Guideline B-10 Outsourcing of Business Activities, Functions and Processes (B-10 Guideline) which sets out OSFI s expectations with respect to outsourcing by FREs. Further, OSFI s B-10 Guideline outlines that the outsourcing requirements extend to a FRE s subsidiaries. In order to avoid duplicating the objectives of existing regulatory requirements, we suggest that IIROC consider an exemption for Dealer Member subsidiaries of FREs who are already subject to OSFI s outsourcing requirements as well as the Canadian Securities Administrators (CSA) outsourcing guidelines. Alternatively, IIROC should consider adopting OSFI s approach to outsourcing which is premised on a set of prudent practices and

2 procedures while providing a FRE and its affiliates with sufficient flexibility to manage and structure its business operations accordingly. Specific Comments 1. Principle-based approach to outsourcing requirements The Notice mentions that IIROC is currently working on proposed rules relating to outsourcing which will codify general due diligence obligations similar to those outlined in section 5 of the Notice and specific obligations for Dealer Members to ensure ongoing access and control over its books and records and client account assets. As the Notice will ultimately support IIROC s proposed outsourcing rules, it is our understanding that IIROC guidance notices are meant to outline best practices or how to interpret an existing rule without prescribing any new regulatory requirements. In our view, the Notice includes detailed requirements in a number of areas, such as which activities may be outsourced and those activities which may not be outsourced. To that end, we believe that both the proposed IIROC outsourcing rule and the Notice should be principles-based, similar to OSFI s B-10 Guidelines, to allow Dealer Members the flexibility to implement the necessary controls to their specific circumstances without limiting the functions or activities for which a Dealer Member may outsource to a third party. 2. Existing prudential oversight regarding outsourcing arrangements As mentioned above in our General Comments, a FRE and a FRE s subsidiary are subject to the requirements outlined in OSFI s B-10 Guideline for every outsourcing agreement. Further, we note that the Notice is intended to cover both arm s length and non-arm s length outsourcing arrangements and includes additional risk considerations for non-arm s length arrangements involving affiliates. OSFI s B-10 Guideline includes specific requirements for a FRE and its affiliates when entering into an arrangement which includes among other things, the scope of the arrangement, the services to be supplied, the nature of the relationship between the FRE and the service provider, and procedures governing the subcontracting of services. In addition, the B-10 Guideline recognizes that outsourcing arrangements exhibit varying degrees of materiality and include the expectation that the FRE will exercise the necessary due diligence in assessing the materiality of the agreement and manage risks accordingly. Furthermore, Part 11 of the CSA Companion Policy CP, Registration Requirements, Exemptions and Ongoing Registrant Obligations (the Companion Policy) highlights key aspects of outsourcing arrangements including due diligence and monitoring of the services outsourced. The Companion Policy also includes a provision that: The regulator, the registered firm and the firm s auditors should have the same access to the work product of a third-party service provider as they would if the firm itself performed the activities. Firms should ensure this access is provided and include a provision requiring it in the contract with the service provider, if necessary. In our view, the Companion Policy and OSFI s B-10 Guideline provide the necessary safeguards for both firms and regulators in mitigating any risks associated with outsourcing any of the Dealer Member s activities or functions to a third party. Consequently, given the current prudential regulatory environment that Royal Bank of Canada and its subsidiaries, including RBC DS and RBC DI, and other FRE s must adhere to, we are proposing that IIROC consider granting an exemption to the Notice, and any subsequent proposed outsourcing rules, for subsidiaries of FREs. In our view, adding additional outsourcing requirements which overlap with the existing regulatory framework adds an unnecessary layer of complexity and cost in managing outsourcing arrangements for Dealer Member subsidiaries of FREs. In the absence of such an exemption, we are suggesting that IIROC adopt OSFI s approach to outsourcing which provides guidance in a number of areas that the Notice proposes 2

3 to address such as accountability and control, risk management, monitoring and oversight of arrangements, due diligence, business continuity planning and location of books and records. 3. Classification of core and non-core activities We are requesting that IIROC provide clarification regarding the nature of core activities that can or cannot be outsourced in order to better understand the extent of the Notice. For example, each core activity includes administrative components which are similar in nature to the noncore activities and permitted to be outsourced under the terms of the Notice. Currently, many Dealer Members have centralized functions in order to provide effective and efficient services to their clients. In the Notice, IIROC acknowledges that there has been an increasing trend of Dealer Members using affiliated entities to perform certain back office operational related functions on behalf of the Dealer Member. However, the description of core activities which cannot be outsourced appears to limit the ability of Dealer Members to centralize certain aspects of their operations. As an example, the Notice prohibits Dealer Members from outsourcing the account opening process; however, many firms have centralized the anti-money laundering (AML) process in order to establish a centre of excellence within the parent Bank. In our view, it would not be efficient for the Dealer Member to re-execute these checks and/or duplicate the specialized expertise within the Dealer Member. Consequently, we believe that it would be appropriate for IIROC to recognize that pure administrative tasks related to core activities, such as the collection of know-your-client or AML information, do not introduce additional risks given that the Dealer Member has ultimate responsibility to ensure that the information collected reflects the client s circumstance. This recognition would also apply to other core activities which have been centralized to leverage expertise and efficiency such as common application technology platforms. We believe that any prohibition on outsourcing should be limited to conducting trading or advising activities on behalf of a Dealer Member to either employees or agents of a Dealer Member and should exclude administrative and back office type functions and activities. The Notice also requires that Dealer Members inform IIROC of any new outsourcing arrangements involving core Dealer Member activities that are being entered into by the Dealer Member in accordance with IIROC Rules Notice Reporting of Changes to Business Models (Notice ). IIROC Notice indicates that a Dealer Member is required to report changes based on a materiality assessment; however, some outsourcing arrangements involving core activities may not be considered material (e.g. marketing activities). We recommend that IIROC consider excluding from the notice requirement non-material core activities in order to streamline the reporting process for both IIROC and Dealer Members. In addition, we are requesting that IIROC clarify whether Introducing Broker/Carrying Broker (ICB) arrangements are excluded from the requirements specified in the Notice given the existing requirements outlined in Dealer Member Rule 35 addressing ICB arrangements. We are also requesting confirmation that the clearing and/or settlement services provided to Dealer Members by The TMX group (TSX, Montreal Exchange, Alpha, Canadian Derivatives Clearing Corporation) The Canadian Depository for Securities, The Canadian National Stock Exchange, CANNEX Financial Exchanges Limited, and Omega ATS are not considered outsourcing arrangements that fall within the scope of the Notice. Further, the Notice includes guidance pertaining to which non-core activities can be outsourced; however, the Notice does not specifically address whether there are any non-core activities that cannot be outsourced. In order to assist Dealer Members in planning future outsourcing initiatives, we are requesting that IIROC provide clarification regarding any prohibition on outsourcing non-core activities. We also request that IIROC provide additional clarification regarding whether accounting and back office support functions performed within an introducing/carrying broker arrangement are included in the scope of this notice. We are also seeking clarification from IIROC regarding the recommendation outlined in the Notice that a Dealer Member should not unduly concentrate its outsourcing activities in one or a few 3

4 outsource service providers. Specifically, we are requesting that IIROC advise whether this condition would apply to outsourcing arrangements among FREs and their affiliates. As stated above, OSFI s B-10 Guideline outlines the requirements for intra-group outsourcing arrangements. The preparation of regulatory financial reports and the preparation of non-financial regulatory reports are listed as core activities which may be outsourced within the Notice; however, Appendix B of the Notice deems their outsourcing to be prohibited resulting in an inconsistency within the Notice. We believe that the outsourcing of regulatory financial report preparation should be prohibited from being outsourced. Dealer Member Rule 2600, Statement 2, requires that the Dealer Member have in place internal policies and procedures to ensure that its capital adequacy obligation is being met at all times. This requirement would be difficult to meet if the preparation of regulatory financial reports was outsourced to a third party. 4. Audit reports and due diligence process As part of the due diligence process outlined in Section 5 of the Notice, IIROC indicates that where applicable a Dealer Member should obtain and provide to IIROC an audit report for each outsource arrangement relating to a core Dealer Member activity. We are requesting that IIROC clarify the circumstances where an audit report would be applicable and consider narrowing the scope to specific high risk activities. For example, the list of core activities which may be outsourced includes items pertaining to the performance of marketing activities and the preparation of research reports and marketing newsletters. These activities may not be considered by Dealers Members specifically as high risk. As an option, to narrow the list of core functions which would require an audit report, we recommend that the decision be based on whether or not the third party is an acceptable institution and/or regulated entity as defined in the General Notes and Definitions to Form 1 (the Joint Regulatory Financial Questionnaire and Report). 5. Books and Records In order for Dealer Members to meet its obligations concerning the maintenance of books and records, the outsourcing rule proposals will require that Dealer Members maintain its books and records at a central office location. Section 11.6 of National Instrument Registration Requirements, Exemptions and Ongoing Registrant Obligations outlines specific obligations for registered firms relating to the form, accessibility and retention of records. Furthermore, the Companion Policy provides further guidance relating to the confidentiality and access of records by a third party. As such, we propose that IIROC draft the proposed rule to reflect that books and records must be maintained in accordance with relevant securities legislation. Alternatively, we are requesting that IIROC provide clarification regarding the meaning of central office location. 6. Implementation The Notice does not include any guidance relating the applicability of the new requirements to current outsourcing arrangements. In the event that IIROC decides to proceed with the Notice as drafted, we recommend that IIROC consider allowing for a transition period similar to the implementation guidelines outlined in OSFI s B-10 Guidelines. The OSFI B-10 Guidelines indicates that arrangements are expected to comply [ ] at the first opportunity, such as the time the outsourcing contract, agreement or statement of work (where applicable) is substantially amended, renewed or extended. The OSFI B-10 Guidelines also includes a similar provision for arrangements a FRE may have obtained as a result of an acquisition. A similar transition period would provide Dealer Members the opportunity to: (a) review existing agreements to determine if any of the contracts would necessitate changes to comply or align with IIROC s Notice and/or proposed rules; and (b) minimize any costs associated with the review of outsourcing contracts. 4

5 Concluding Remarks As per our comments above, we encourage IIROC to consider the existing regulatory framework currently in place for FREs and their affiliates. We support the approach that OSFI has taken to outsourcing and believe that granting an exemption to such entities from the requirements outlined in the Notice or subsequent rule proposals would not be prejudicial to the public interest given that OSFI has implemented a robust risk management process for outsourcing arrangements. Alternatively, IIROC should consider the adoption of OSFI s B-10 Guideline for all Dealer Members. Thank you for the opportunity to provide comments on the Notice. We would welcome the opportunity to discuss the foregoing with you in further detail. If you have any questions or require further information, please do not hesitate to contact the undersigned. Sincerely, Brent Davies Global Head, Capital Markets Cash Product Operations Catherine Patterson Managing Director, Canadian Wealth Management 5