As 1st November 2007 approaches and the laws and regulations that give effect to MiFID swing into operation, there is no time like the present to consider whether your organisation's outsourcing arrangements meet the required standards.
The FSA Handbook contains detailed outsourcing requirements that will apply to any outsourcing of critical or important functions by common platform firms1, including any such outsourcing arrangements which are in place prior to 1st November 2007.
Q: What outsourcing arrangements are relevant?
A: The FSA Handbook defines the term "outsourcing" widely and includes any arrangement of any form between a regulated entity and a service provider by which the service provider performs a process, service or activity which would otherwise be undertaken by the firm itself.
However in practice the requirements only apply to outsourcing arrangements covering functions defined as critical or important, where a defect or failure in delivery would materially impair the continuing compliance of the outsourcing organisation with the conditions and obligations of its authorisation, or its financial performance, or the soundness or the continuity of its relevant services and activities. Standardised services, such as data feed services, are out of scope as are things like cleaning and catering.
Q: What does MiFID say about outsourcing arrangements?
A: MiFID's main impact on sourcing arrangements is in the area of risk management. Essentially, no sourcing arrangement of a critical or important function should increase the operational and regulatory risk to the firm. Where risk is unavoidable (e.g. potential failure of IT systems) there must be convincing evidence of measures in place to mitigate this risk (e.g. Disaster Recovery plans tested by both the firm and the service provider).
Q: What does this mean in practice?
A: The main areas to look at are the governance arrangements around your sourcing contracts. This includes the way you have structured your retained organisation (roles and reporting lines) to manage the supplier's delivery of the services, the processes you have to monitor supplier performance and correct any deficiencies, and the supplier's delivery of its obligations against the contract.
Q: How has this changed from our previous obligation to remain responsible for the quality of services delivered via a third party?
A: The principle remains the same, however MiFID has specific requirements in terms of a firm's ability to demonstrate that it has assured itself to the extent possible of a supplier's ability to deliver the services with no additional risk to the firm's business or to its clients, and that it has retained sufficient expertise in-house to allow for the effective management of the outsourced functions, and for moving the services back in-house or to another provider.
Compliance with regulatory requirements now makes a virtue of necessity: namely, the need to monitor and actively manage outsourced services. Many commentators have identified the lack of effective management during outsourcing projects as a major contributory factor to their failure. When the management time, effort and costs expended in entering into an outsourcing arrangement and the consequences associated with a failure of an outsourcing are all considered, it is surprising that, to date, little time, effort and cost has been expended to ensure that the outsourcing arrangement is delivering the desired performance at the budgeted cost.
Q: How can we ensure we are MiFID compliant with our outsourcing?
A: Two main areas are worth looking at. Existing arrangements will need to be checked, and processes put in place to make sure that any future contracts will be set up in a manner that complies with MiFID's requirements.
This review of existing contracts will be in the nature of a health check and can be undertaken by third party consultants or performed by the appropriate internal business units. The health check will need to cover operational delivery of the services (e.g. supplier performance and fitness for purpose of the agreed services, for example where business requirements have changed since the original contract was signed) and contractual provisions (e.g. termination clauses).
The benefits of undertaking such a health check will ensure contractual clarity and regulatory compliance. The will provide board level executives with protection from both corporate and personal liability. In addition, the health check will assist with business relationships, optimise service provider performance and provide your organisation with an opportunity to increase the value obtained from outsourcing. On a broader level, the health check can provide information which can be used to improve the performance of the retained organisation, containing costs and contributing to strategic objectives.
The report from the health check should provide you with auditable written evidence of compliance, and/or act as an early warning mechanism to identify risk and problems so that they can be managed and resolved before they can threaten both the sourcing relationship and your firm's regulatory compliance status.
Elizabeth Gordon-Pugh is a Senior Manager with Alsbridge, the independent advisors on outsourcing, shared services and offshoring. Elizabeth can be contacted at Elizabeth.gordon-pugh@alsbridge.eu or by calling +44(0)20 7242 0666.
