Off shoring From the perspective of a Financial Regulator Jean Moorhouse Financial Services Authority

Off shoring, for the purpose of this presentation can be defined as the use of a third party within a corporate group to perform activities on a continuing basis that would normally be undertaken by the regulated entity. Typically these would be undertaken in a different geographical location

Traditional examples of activities which may be undertaken ‘offshore’ Information technology Administration ( including HR and payroll functions) Distribution Customer call centres Treasury back office functions Debt recoveries Other sales/marketing functions

Regulators are becoming increasingly aware of the need to take account of the specific risks in such activities

Basel Committee on Banking Supervision Joint Forum Report on Outsourcing in Financial Services August 2004

High Level Principles Assessment should be made on what can be outsourced A risk assessment should be undertaken Obligations to customers and regulators should not be diminished Written contracts may be beneficial

High level principles Contingency planning including disaster recovery Confidentiality of data ensured Regulators to include those entities offshore as an integral part of a risk assessment Legal constraints on transferring activates to a non EEA jurisdiction need to be considered

A regulator’s perspective All firms must meet ‘Threshold conditions’ on a continuing basis Therefore a firms affairs must be conducted in a ‘sound and prudent manner’ There is a danger of regulatory arbitrage A firm should be able to ascertain/ analyse the impact on its overall risk profile and on its internal systems and controls

Access should be available to the regulator and other control functions such as internal and external audit to enable them to fulfil their responsibilities A member of the bank’s senior management who is an ‘ approved person’ must take responsibility A regulator’s perspective continued

The FSA considers a firm’s management accountable for the adequacy of systems and controls for the whole entity including any activities carried out elsewhere within the group