13. Guideline 4.35 is replaced by the following: ‘4.35 Where the external provider is a firm …

Guideline 4.35 is replaced by the following:

‘4.35 Where the external provider is a firm established in a non-EU country, the firm should ensure that it understands the legal risks and operational risks and data protection require-ments associated therewith and mitigates those risks effectively. The firm should also ensure that it can promptly access the relevant customer data and information when necessary, in-cluding in case of termination of an outsourcing agreement .’

1. Overview

1.1 References

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/