• OM-2.8 OM-2.8 Intra-group outsourcing

    • OM-2.8.1

      As with outsourcing to non-group companies, the Board and management of licensees are held ultimately responsible by the Agency for the adequacy of systems and controls in activities outsourced to group companies.

    • OM-2.8.2

      However, the degree of formality required — in terms of contractual agreements and control mechanisms — for outsourcing within a licensee's group is likely to be less, because of common management and enhanced knowledge of other group companies.

    • OM-2.8.3

      A licensee must formally notify the Agency at least 6 weeks before committing to a material intra-group outsourcing. The request must be made in writing to the licensee's normal supervisory contact, and must set out a summary of the proposed outsourcing, its rationale, and an analysis of its associated risks and proposed mitigating controls. The Agency will respond to the notification in the same manner and timescale as set in section OM-2.3 above.

    • OM-2.8.4

      The Agency expects, as a minimum, an agreed statement of the standard of service to be provided by the group provider, including a clear statement of responsibilities allocated between the group provider and licensee.

    • OM-2.8.5

      The Agency also expects a licensee's management to have addressed the issues of customer confidentiality, access to information and business continuity covered above (section OM-2.5 and OM-2.4).