12 Contractual phase

The rights and obligations of the financial entity and the TPSP should be clearly allocated and set out in written contract.

The contractual arrangement should include at least the following elements:

• a. a clear and complete description of non-ICT services supporting functions to be provided by the TPSP, indicating whether the subcontracting of a critical or important function, or material parts thereof, is permitted and, if so, the conditions specified in Section 1312.1 that subcontracting is subject to;
• b. the location(s) (i.e. regions or countries) where the function will be provided, and the conditions to be met, including a requirement to notify the financial entity if the TPSP envisages changing the location(s);
• c. the governing law of the contract;
• d. the location where the data is processed including storage;
• e. provisions on availability, authenticity, integrity, and confidentiality in relation to the protection of data, including personal data;
• f. provisions on ensuring that the data that are owned by the financial entity can be easily accessed, recovered, and returned in the case of the insolvency, resolution, or discontinuation of business operations of the TPSP, or in the event of the termination of the contractual arrangements;
• g. service level descriptions, including their updates and revisions thereof;
• h. the obligation of the TPSP to fully cooperate with the competent authorities and resolution authorities of the financial entity, including other persons appointed by them;
• i. termination rights and related notice periods for the termination of the third-party arrangement, as specified in Section 1312.3;
• j. for institutions under CRD, a clear reference to the national resolution authority’s powers, especially to Articles 68 and 71 of Directive 2014/59/EU (BRRD), and in particular a description of the ‘substantive obligations’ of the contract in the sense of Article 68 of that Directive.

In addition to the elements referred to in paragraph 84, the third-party arrangement supporting critical or important functions should set out at least:

• a. the agreed service level descriptions, including updates and revisions thereof, with precise quantitative or/and qualitative performance targets for the function provided to allow for effective, timely monitoring by the financial entity so that appropriate corrective action can be taken without undue delay if the agreed service levels are not met;
• b. the notice periods and reporting obligations of the TPSP to the financial entity, including the communication by the TPSP of any development that may have a material impact on the TPSP’s ability to provide the services supporting critical or important functions in line with the agreed service levels and in compliance with applicable laws and regulatory requirements and, as appropriate, the obligations to submit reports of the internal audit function of the TPSP.
• c. whether the TPSP should take out mandatory insurance against certain risks and, if applicable, the level of insurance cover requested;
• d. the requirements for the TPSP to implement and test business contingency plans;
• e. the right of the financial entity to monitor the TPSP’s performance on an ongoing basis, which entails the following:
• i. the unrestricted right of access of financial entities and competent authorities to inspect and audit the TPSP, as specified in Section 1312.2;
• ii. the right to agree on alternative assurance levels if other clients’ rights are affected;
• iii. the obligation of the TPSP to fully cooperate during the onsite inspections and audits performed by the competent authorities, the financial entity or an appointed third-party; and
• iv. the obligation to provide details on the scope, procedures to be followed and frequency of such inspections and audits;
• f. exit strategies, establishing a mandatory adequate transition period:
• i. during which the TPSP will continue providing the respective functions with a view to reducing the risk of disruption at the financial entity or ensuring its effective resolution and restructuring; and
• ii. allowing the financial entity to migrate to another TPSP or change to in-house solutions consistent with the complexity of the service provided.

Without prejudice to the requirements set out under Regulation (EU) 2016/679, financial entities, when contracting with TPSPs located in particular in third countries, should take into account differences in national provisions regarding the protection of data. Financial entities should ensure that the third-party arrangement includes the obligation that the TPSP protects confidential, personal or otherwise sensitive information and complies with all legal requirements regarding the protection of data that apply to the financial entity (e.g. the protection of personal data and that banking secrecy or similar legal confidentiality duties with respect to clients’ information, where applicable, are observed).