48. The policy should include the main phases of the life cycle for the adoption and use of …

The policy should include the main phases of the life cycle for the adoption and use of contractual arrangements with TPSP. It should cover, for each main phase of the life cycle of the contractual arrangement, at least:

• a. the responsibilities of the management body in line with paragraphs 38 and 42, including its involvement, as appropriate, in the decision-making on the use of services supporting critical or important functions provided by TPSP;
• b. the involvement of business lines, internal control functions, and other individuals in respect of contractual arrangements supporting critical or important functions;
• c. the identification of the role or member of senior management responsible for monitoring the relevant contractual arrangements, specifying how that role or member of senior management shall cooperate with the internal control functions, unless it is part of it, and setting out the reporting lines to the management body, including the nature of the information to report and the documents to provide, and the frequency of such reporting;
• d. the planning of contractual arrangements, including:
• i. establishing whether an arrangement with a TPSP could potentially fall under the definition of third-party arrangement provided in these Guidelines;
• ii. the definition of business requirements regarding third-party arrangements;
• iii. the criteria, including those referred to in Section 4, and processes for identifying critical or important functions;
• iv. risk identification, assessment, and management in accordance with Section 1211.2;
• v. due diligence checks on prospective TPSPs, including the measures required under Section 1211.3;
• vi. procedures for the identification, assessment, management, and mitigation of potential conflicts of interest, in accordance with Section 7;
• vii. business continuity planning in accordance with Section 8;
• viii. the approval process of new third-party arrangements;
• e. the implementation, monitoring, and management of third-party arrangements supporting critical or important functions, including:
• i. the monitoring of the TPSP’s performance in line with Section 13;
• ii. the procedures for being notified and responding to changes to a third-party arrangement or TPSP (e.g. to its financial position, organisational or ownership structures, subcontracting);
• iii. the independent review and audit of compliance with legal and regulatory requirements and policies;
• iv. their renewal processes, where applicable;
• f. the documentation and record-keeping, taking into account the guidelines in Section 10;
• g. the exit strategies and termination processes, including a requirement for a documented exit plan for non-ICT services supporting critical or important function to be provided by TPSPs, in accordance with Section 14.

1. Översikt

1.1 Referenser

1.2 Identifierade krav

1.3 Relaterade standarder

2. Identifierade krav

3. Relaterade standarder

• EBA - Published by the European Banking Authority at https://www.eba.europa.eu/