On 22 June 2018, the European Banking Authority (EBA) published a consultation paper containing draft guidelines on outsourcing under the Capital Requirements Directive IV (CRD IV) and the revised Payment Services Directive (PSD2).

The draft guidelines update the Committee of European Banking Supervisors (CEBS) guidelines on outsourcing issued in 2006 (the 2006 guidelines). The scope of application of the draft guidelines covers not only credit institutions and investment firms subject to the CRD IV (financial institutions) but also payment and electronic money institutions.

The draft guidelines provide a definition of outsourcing and specify the criteria to assess whether or not an outsourced activity, service, process or function (or part of it) is critical or important. The draft guidelines also deal with the responsibilities of the management body for the establishment of an appropriate framework for outsourcing, its implementation and application in a group, the due diligence process and risk assessment before entering in such arrangements. In addition, the draft guidelines cover certain aspects related to the contractual arrangements, the monitoring and documentation of outsourcing arrangements as well as the supervision by Member State competent authorities.

The cost benefit analysis in the consultation paper notes that the draft guidelines will, when finalised, trigger some implementation costs for financial institutions and payment and electronic money institutions, which will differ depending on the nature:

• for payment institutions and CRD-investment firms the additional costs should be very low, considering that the sectoral directives already establish a quite detailed set of requirements; and
• for CRD-credit institutions a detailed framework exists regarding their investment and payment services and activities, regarding their banking activities the 2006 guidelines applied, therefore the overall additional costs triggered by the draft guidelines should be low.

The cost benefit analysis adds that for financial institutions and payment institutions the draft guidelines may create low further costs for additional documentation requirements and the implementation of a register (e.g. in the form of a database). Some minor one off costs may be triggered by the need to update outsourcing policies and costs for establishing and maintaining the register of all outsourcing arrangements (e.g. in terms of additional data input on top of existing documentation).

The deadline for comments on the consultation paper is 24 September 2018. The 2006 guidelines will be repealed after these updated guidelines come into force.