12.1 Subcontracting of critical or important functions

The third-party arrangements on the use of services supporting critical or important function by TPSPs should specify whether the subcontracting of critical or important functions, or material parts thereof, is permitted and, when that is the case, the conditions applying to such subcontracting. The use of subcontractors supporting critical or important functions by TPSPs cannot reduce the ultimate responsibility of the financial entities ’ management body to manage their risks and to comply with their legislative and regulatory obligations. Financial entities should have a clear and holistic view of the risks associated with subcontracting services that support critical or important functions so that they are able to monitor, manage and mitigate those risks. Among those subcontractors that provide services supporting critical or important functions, financial entities should notably focus continuously on those subcontractors that effectively underpin the non-ICT related service supporting a critical or important functions.

If the subcontracting of services supporting critical or important functions or material parts thereof is permitted, financial entities should determine whether the subcontractor effectively underpins the non-ICT related service that supports the critical or important function, and, if it does, record it in the register.

If the use of subcontractors supporting critical or important functions or material parts thereof is permitted, the written agreement between the financial entity and the TPSP should specify:

• a. any types of activities that are excluded from subcontracting;
• b. the conditions to be complied with in the case of subcontracting;
• c. that the TPSP has to assess and manage all risks associated with the location of the current or potential subcontractors, and their parent company, and with the location where the service concerned is provided from;
• d. that the TPSP is obliged to monitor those functions that it has subcontracted to ensure that all contractual obligations between the TPSP and the financial entity are continuously met;
• e. the reporting obligations of the TPSP towards the financial entity regarding subcontractors supporting critical or important functions;
• f. that the TPSP has to specify in its contract with its subcontractors the monitoring and reporting obligations of those subcontractors towards the TPSP, and, where agreed, towards the financial entity;
• g. that the TPSP has to ensure the continuity of the provision of the critical or important functions throughout the chain of subcontractors in case of failure by a subcontractor to meet its contractual obligations;
• h. that the subcontractor grants to the financial entity and relevant competent and resolution authorities the same rights of access, inspection, and audit, as those granted by the TPSP to the financial entity; and
• i. that changes to written agreements between the financial entity and the TPSP that are necessary to comply with EU legal requirements and the specifications provided in these Guidelines, should be implemented in a timely manner and as soon as it is possible by the subcontractor;
• j. the financial entity should document and communicate the planned timeline for the implementation of such changes.

The written agreement between the financial entities and the TPSPs should specify that the TPSP should notify the financial entity about new subcontracting arrangements and any intended material changes to its subcontracting arrangements well in time to enable the financial entity to assess:

— the impact on the risks it is or might be exposed to; — whether such new subcontracting arrangements or such material changes might affect the ability of the TPSP to meet its contractual obligations vis-a-vis the financial entity.

The written agreement should include a reasonable notice period by which the financial entity is able to approve or to object to new subcontracting arrangements or changes of such arrangements.

The TPSP should only enter into new subcontracting arrangements or implement material changes to its subcontracting arrangements after the financial entity has either approved or not objected to the changes by the end of the notice period.

Where the financial entity is of the opinion that the new subcontracting arrangement or the material changes referred to in paragraph 90 exceed the financial entity’s risk tolerance, the financial entity should before the end of the notice period:

— inform the TPSP thereof; and

— object to the new subcontracting arrangement or to the changes and request modifications to the subcontracting arrangement or to those changes before they are entered into or implemented.

Financial entities should ensure that the TPSP appropriately identifies all subcontractors and monitors the subcontractors providing critical or important functions or material parts thereof that with a particular focus on subcontractors effectively underpinning the non-ICT related service supporting a critical or important function.

The financial entity should ensure in the written agreement with the TPSP that the agreement between the TPSP and the subcontractor may be terminated in each of the following cases:

— the financial entity has objected to a new subcontracting arrangement supporting critical or important functions or to material changes to the subcontracting arrangements supporting critical or important functions and requested for modifications to those arrangements, but the TPSP has nevertheless entered into the new subcontracting arrangement or implemented those material changes;

— the TPSP has entered into a new subcontracting arrangement supporting critical or important functions or implemented material changes to subcontracting arrangements supporting critical or important functions before the end of the notice period without approval by the financial entity;

— the TPSP subcontracts a service supporting a critical or important function not explicitly permitted to be subcontracted by the contract between the financial entity and the TPSP.