11.2 Risk assessment of third-party arrangements

Financial entities should consider, on a risk-based approach, the potential impact of third-party arrangements on their relevant risks, including the operational risk, the reputational risk, the legal risk and the concentration risk at entity level. They should take into account the assessment results when deciding whether the function should be performed by a TPSP and should take appropriate steps to avoid undue additional operational risks before entering into third-party arrangements.

Financial entities should consider:

• a. the potential impact of a third-party arrangement on their ability to:
• i. identify, monitor and manage relevant risks;
• ii. comply with all legal and regulatory requirements;
• iii. conduct appropriate audits regarding the function provided by TPSPs;
• b. the potential impact on the services provided to their clients;
• c. the size and complexity of any business area affected;
• d. the possibility that a proposed third-party arrangement might be scaled up without replacing or revising an underlying agreement;
• e. the ability to transfer a proposed third-party arrangement to another TPSP, if necessary or desirable, both contractually and in practice, including the estimated risks, impediments to business continuity, costs and time frame for doing so (‘substitutability’);
• f. the ability to reintegrate the function provided by TPSPs into the financial entity, if feasible, necessary, or desirable;
• g. the protection of data and the potential impact of a confidentiality breach or failure to ensure data availability and integrity on the financial entity and its clients, including but not limited to compliance with Regulation (EU) 2016/679 (⁵⁵ ).

⁵⁵ Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, pp. 1 – 88, ELI: http://data.europa.eu/eli/reg/2016/679/oj).

The risk assessment should include, where appropriate or relevant, scenarios of possible risk events, including high-severity operational risk events. Within the scenario analysis, financial entities should assess the potential impact of failed or inadequate services, including the risks caused by processes, systems, people, or external events. Financial entities, considering the application of the principle of proportionality referred to in Title I, should document the analysis performed and its results and should estimate the extent to which the arrangement would increase or decrease their risk level. Taking into account the application of the principle of proportionality under Title I, less complex financial entities may use qualitative risk assessment approaches, while large or complex financial entities should have a more sophisticated approach, including, where available, the use of internal and external loss data to inform the scenario analysis.

Within the risk assessment, financial entities should also consider the expected benefits and costs of the proposed third-party arrangement, including weighting any risks that may be reduced or better managed against any risks that may arise as a result of such proposed arrangement, taking into account at least:

• a. concentration risks at entity level, including from:
• i. using a TPSP that is not easily substitutable; and
• ii. multiple third-party arrangements with the same TPSP or closely connected TPSPs;
• b. the aggregated risks resulting from the use of TPSPs to perform several functions across the financial entity and, in the case of groups of institutions or institutional protection schemes, the aggregated risks on a consolidated basis or on the basis of the institutional protection scheme;
• c. in the case of significant institutions, the step-in risk, i.e. the risk that may result from the need to provide financial support to a TPSP in distress or to take over its business operations; and
• d. the measures implemented by the financial entity and by the TPSP to manage and mitigate the risks.

Where a third-party arrangement supporting critical or important functions includes the possibility that the TPSP subcontracts critical or important functions to subcontractors, financial entities should take into account:

• a. the risks associated with subcontracting, including the additional risks that may arise if the subcontractor is located in a third country or a different country from the TPSP; and
• b. the risk that long and complex chains of subcontracting reduce the ability of financial entities to oversee the critical or important function and the ability of competent authorities to effectively supervise them.

When carrying out the risk assessment prior to the conclusion of the third-party arrangement and during ongoing monitoring of the TPSP’s performance, financial entities should, at least:

• a. conduct a thorough risk-based analysis of the functions that are being considered for an arrangement with a TPSP or have been provided by a TPSP,
• b. whether the functions are critical or important and address the potential risks, in particular the operational and reputational risks, and the oversight limitations related to the countries where the functions are or may be provided;
• c. consider the consequences of where the TPSP is located (within or outside the EU);
• d. consider the political stability and security situation of the jurisdictions in question, including:
• i. the laws in force, including laws on data protection, compliant with the EU General Data Protection Regulation (GDPR);
• ii. the law enforcement provisions in place; and
• iii. the insolvency law provisions that would apply in the event of a TPSP ’ s failure and any constraints that would arise in respect of the urgent recovery of the financial entity ’ s function in particular;
• e. consider whether the TPSP is a subsidiary or parent undertaking of the financial entity, is included in the scope of accounting consolidation or is a member of or owned by financial entities that are members of an institutional protection scheme and, if so, the extent to which the financial entity controls it or has the ability to influence its actions in line with Section 2.