Article 4 2

(a)

tasks and responsibilities reserved for the risk control unit are not outsourced;

(b)

the senior management and the management body are actively involved in the supervision of any tasks outsourced by the institution, and in the acquisition of any IT risk management tool solutions from third parties;

(c)

the institution itself has sufficient knowledge about any outsourced tasks, activities or functions and of the structure of any data and methodologies obtained from a third party, and is able to verify the quality of the work performed by the third party to which it outsources its tasks, as well as the results of that work;

(d)

the internal audit and the ongoing monitoring by the institution of any outsourced tasks, activities and functions are not limited or inhibited by such outsourcing;

(e)

full access to all relevant information is granted to competent authorities.