6. Outsourcing

The management body should approve and regularly review and update the outsourcing policy of an issuer of ARTs, ensuring that appropriate changes are implemented in a timely manner.

The outsourcing policy should consider the impact of the use of the outsourcing on an issuer of ARTs ’ business and the risks it faces (such as operational risks, including legal, reputational risks, and concentration risks).

The policy should include the reporting and monitoring arrangements to be implemented from inception to the end of outsourcing arrangements (including the due diligence process and risk assessment, the management and the monitoring of the arrangement, the termination, contingency plans and exit strategies).

The outsourcing of functions cannot result in the delegation of the management body’s responsibilities. An issuer of ARTs remains fully responsible and accountable for all outsourced services and activities and management decisions arising from them. Accordingly, the outsourcing policy should make it clear that outsourcing does not relieve the issuer of ARTs of its legal and regulatory obligations.

The policy should state that outsourcing arrangements, should not hinder effective on-site or off-site supervision of the issuer of ARTs and should not contravene any supervisory restrictions on services and activities. The policy should also cover intragroup outsourcing arrangements and take into account any specific group circumstances where appropriate.

Issuers of ARTs should maintain at all times sufficient substance and not become ‘empty shells’ or ‘letter - box entities’. To this end, they should:

• a. meet all the conditions of their authorisation at all times, including the manage-ment body effectively carrying out its responsibilities as set out in Section I of these guidelines;
• b. retain a clear and transparent organisational framework and structure that ena-bles them to ensure compliance with legal and regulatory requirements as re-ferred to Section 4;
• c. where operational tasks of internal control functions are outsourced, exercise ap-propriate oversight and be able to manage the risks that are generated by the out-sourcing of critical or important functions; and
• d. have sufficient resources and capacities to ensure compliance with points
• (a) to (c).