13 Monitoring

Following a risk-based approach, financial entities should monitor the performance of the TPSPs providing services with regard to third-party arrangements and monitor on an ongoing basis the third-party arrangements supporting critical or important functions consistently with paragraph 112. Financial entities should regularly update their risk assessment in accordance with Section 11.2 and should periodically report to the management body on the risks identified in respect of the third-party arrangements supporting critical or important functions. Where the risk, nature or scale of a function has materially changed, financial entities should reassess the criticality or importance of that function in line with Section 4.

Financial entities should monitor and manage their internal concentration risks caused by third-party arrangements, including with regard to the use of subcontractors for supporting critical or important functions, taking into account Section 11.2 of these Guidelines.

Financial entities should ensure, on an ongoing basis, that third-party arrangements supporting critical or important functions, meet appropriate performance and quality standards in line with their policies by:

• a. ensuring that they receive appropriate reports from TPSPs;
• b. evaluating the performance of TPSPs using tools such as key performance indicators, key control indicators, service delivery reports, self-certifications, and independent reviews; and
• c. reviewing all other relevant information received from the TPSPs, including reports on business continuity measures and testing.

Financial entities should take appropriate measures if they identify actual or potential shortcomings in the performance of the services provided by a TPSP. If shortcomings are identified, financial entities should take appropriate corrective or remedial actions or terminate the contract.