14 Exit strategies regarding third-party arrangement supporting critical or important functions

Financial entities should have a documented exit strategy when services supporting critical or important functions are provided by TPSPs, which is in line with their strategy on third-party risk management and business continuity plans (⁵⁸ ), taking into account at least the possibility of:

• a. the termination of third-party arrangements;
• b. the failure of the TPSP;
• c. the concentration risk at entity level and the possibility of difficult exit from such arrangements;
• d. the deterioration of the quality of the function provided and actual or potential business disruptions caused by the inappropriate or failed provision of the function;
• e. material risks arising for the appropriate and continuous performance of the function;
• f. a significant breach by the TPSP of applicable laws, regulations, or contractual terms.

⁵⁸ Institutions, in line with Title VI of the EBA Guidelines on internal governance, should have appropriate business continuity plans in place with regard to the provision of critical or important functions by third-party service providers.

Financial entities should ensure that they are able to exit third-party arrangements supporting critical or important functions performed by TPSPs without undue disruption to their business activities, without limiting their compliance with regulatory requirements and without any detriment to the continuity and quality of their provision of services to clients. To achieve this, they should:

• a. develop and implement exit plans that are realistic, feasible, and based on plausible scenarios and reasonable assumptions. Exit plans should be comprehensive, documented, and, where appropriate, sufficiently tested (e.g. by carrying out an analysis of the potential costs, impacts, resources, and timing implications of transferring a service performed by a TPSP to an alternative provider); and
• b. identify alternative solutions and develop transition plans to enable the financial entity to remove functions provided by TPSPs and data from the TPSP and transfer them to alternative TPSPs or back to the financial entity, or to take other measures that ensure the continuous provision of the critical or important function or business activity in a controlled and sufficiently tested manner, taking into account the challenges that may arise because of the location of data and taking the necessary measures to ensure business continuity during the transition phase.

When developing exit strategies for third-party arrangements supporting critical or important functions, financial entities should:

• a. take into account the results of the analysis described in paragraph 73;
• b. define the objectives of the exit strategy;
• c. assign roles, responsibilities, and sufficient resources to manage exit plans and the transition of activities;
• d. define success criteria for the transition of services provided by TPSPs and the data held by them; and
• e. define the indicators to be used for the monitoring of the third-party arrangement (as outlined under Section 13), including indicators based on unacceptable service levels that should trigger the exit or other appropriate actions.