97. This policy should include the main phases of the life cycle of these third-party arrangements …

This policy should include the main phases of the life cycle of these third-party arrangements and define the principles, responsibilities and processes in relation to the use of third-party. In particular, the policy should cover at least:

• a. the responsibilities of the management body including its involvement, as appropriate, in the decision-making;
• b. the involvement of business lines, internal control functions and other individuals in respect of those arrangements;
• c. the planning and structuring of third-party arrangements, including the definition of business requirements regarding the use of third-parties.
• d. risk identification, assessment and management in accordance with Section 11;
• e. due diligence checks on prospective third-parties;
• f. policies and procedures to identify, prevent, manage and disclose conflicts of interest, in line with Article 32 of Regulation (EU) 2023/1114;
• g. business continuity planning and exit strategies to ensure the issuer of ARTs ’ operational resilience in the event of a failure or disruption at a third-party entity impacting the provision of critical operations. The issuer of ARTs ’ business continuity and exit plans should assess the substitutability of the third-party entity that it uses for critical operations, and other viable alternatives that may facilitate operational resilience in the event of an outage at a third-party entity such as bringing the activity back in-house;
• h. the approval process of new arrangements;
• i. the implementation, monitoring and management of those arrangements, including the ongoing assessment of the third-party entit ies’ performance to ensure that the relationship remains within the issuer of ARTs ’ risk appetite and tolerance for disruption of critical operations and core business lines;
• j. the procedures for being notified and responding to changes to an arrangement by third-party entities;
• k. the independent review and audit of compliance with legal and regulatory requirements and policies;
• l. the renewal processes for arrangements with third-party entities;
• m. the documentation and record-keeping; and
• n. the exit strategies and termination processes, including a requirement for a documented exit plan for each arrangement with a third-party entity, where such an exit is considered possible, taking into account possible service interruptions or the unexpected termination of an agreement.

1. Overview

1.1 References

• Article 32 Identification, prevention, management and disclosure of conflicts of interest

1.2 Identified Requirements

1.3 Related Standards

2. Identified Requirements

3. Related Standards

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/