5 Sound governance arrangements and third-party risk

The management body of financial entities should define, approve and regularly review a strategy on the sound management of third-party risks, which should include a policy on third-party risk management as referred to in Section 6 which should complement financial entities operational risk management and supports its operational resilience. The policy should allow for the implementation of a holistic approach to third-party risk management. Financial entities should have the flexibility to develop either integrated or separate strategies regarding ICT and non-ICT third-party risk management. The management body should ensure, on the basis of an assessment of the overall risk profile of the financial entity, and taking into account the principle of proportionality, that the financial entity itself regularly reviews the risks identified in respect to third-party arrangements on the use of services supporting critical or important functions.

The overall internal control framework, including the risk management framework, should enable financial entities to make well-informed decisions on risk-taking and ensure that risk management measures are appropriately implemented.

Taking into account the application of the principle of proportionality as referred to in Title I, financial entities should identify, assess, monitor, and manage all risks resulting from arrangements with TPSPs to which they are or might be exposed in accordance with Section 1211.2. Financial entities should also ensure that they comply with all requirements under Regulation (EU) 2016/679, including for their third-party arrangements.

The use of TPSPs for the provision of services to support functions cannot result in the delegation of the management body ’ s responsibilities. Financial entities remain fully responsible and accountable for complying with all their regulatory obligations, including the ability to oversee the use of TPSPs supporting critical or important functions and to assess and challenge the performance of TPSPs.

The management body is at all times fully responsible and accountable for at least:

• a. ensuring that the financial entity meets on an ongoing basis the conditions with which it must comply to remain authorised, including any conditions imposed by the competent authority;
• b. ensuring the internal organisation of the financial entity;
• c. approving and overseeing the implementation and maintenance of effective policies to identify, assess, manage and mitigate or prevent actual and potential conflicts of interest;
• d. the setting of the financial entity ’s strategies and policies (e.g. the business model, the risk appetite, the risk management framework);
• e. overseeing the day-to-day management of the financial entity, including the management of all risks associated with third-party arrangements;
• f. exercising the oversight role of the management body in its supervisory function, including overseeing and monitoring management decision-making;
• g. approving, overseeing, and periodically reviewing the implementation of the business continuity policy regarding third-party arrangements;
• h. approving and periodically reviewing the internal audit plans, audits, and material modifications to them regarding third-party arrangements.

The use of TPSPs should not lower the suitability requirements applied to the members of the management body of financial entities, senior management, including key function holders, and persons responsible for the management of the payment institution. Financial entities should have adequate competence and sufficient, appropriately skilled resources to ensure appropriate management and monitoring of third-party arrangements.

Financial entities should:

• a. clearly assign the responsibilities for the documentation, management, and monitoring of third-party arrangements;
• b. allocate sufficient resources to ensure compliance with all legal and regulatory requirements, including these Guidelines and the documentation, and monitoring of all third-party arrangements;
• c. taking into account the application of proportionality under Section 1 of these Guidelines, establish a role in order to monitor all third-party arrangements or designate a member of senior management within the financial entity as directly accountable to the management body and responsible for overseeing the third-party risks as part of the financial entity’s internal control framework and the documentation of third-party arrangements (⁴⁶ ). Less complex financial entities should at least ensure a clear division of tasks and responsibilities for the management and control of third-party risks and may assign the role to a member of the financial entity ’s management body.

⁴⁶ This role can be combined with the one in charge of monitoring the arrangements concluded with ICT third-party service providers on the use of ICT services under Article 5(3) of DORA.

Financial entities should maintain at all times sufficient substance and not become ‘ empty shells ’ or ‘ letter-box entities ’ . To this end, they should:

• a. meet all the conditions of their authorisation (⁴⁷ ) at all times, including the management body effectively carrying out its responsibilities as set out in paragraph 42 of these Guidelines;
• b. retain a clear and transparent organisational framework and structure that enables them to ensure compliance with legal and regulatory requirements including the ability to be audited and supervised;
• c. where operational tasks of internal control functions are provided by TPSPs (including in the case of intragroup outsourcing or outsourcing within institutional protection schemes), exercise appropriate oversight and be able to manage the risks that are generated by the third-party arrangement supporting critical or important functions by a TPSP; and
• d. have sufficient knowledge, resources and capacities to ensure compliance with points
• (a) to (c).

⁴⁷ See also the regulatory technical standards (RTS) under Article 8(2) of Directive 2013/36/EU on the information to be provided for the authorisation of credit institutions, and the implementing technical standards (ITS) under Article 8(3) Directive 2013/36/EU on standard forms, templates and procedures for the provision of the information required for the authorisation of credit institutions (https://eba.europa.eu/regulation-and-policy/other-topics/rts-and-its-on-the-authorisation-of-credit-institutions). For payment institutions, please refer to the EBA Guidelines under Directive (EU) 2015/2366 (PSD 2) on the information to be provided for the authorisation of payment institutions and electronic money institutions and for the registration of account information service providers (Guidelines on authorisation and registration under PSD 2).

When using a TPSP, financial entities should at least ensure that:

• a. they can take and implement decisions related to their business activities and their critical or important functions;
• b. they maintain the orderliness of the conduct of their business and the banking, investment and payment services they provide;
• c. the risks related to current and planned third-party arrangements are adequately identified, assessed, managed, and mitigated;
• d. appropriate confidentiality arrangements regarding data and other information are in place;
• e. an appropriate flow of relevant information with the TPSPs is maintained.
• f. with regard to the third-party arrangements supporting critical or important functions, they are able to undertake at least one of the following actions, within an appropriate time frame:
• i. transfer the function to alternative TPSPs;
• ii. reintegrate the function; or
• iii. discontinue the business activities that are depending on the function.
• g. where personal data are processed by service providers located in the EU and/or third countries, appropriate measures are implemented and data are processed in accordance with Regulation (EU) 2016/679.