• GR-9.3 GR-9.3 Intra-Group Outsourcing

    • GR-9.3.1

      As with outsourcing to non-group companies, the Board and management of licensees are held ultimately responsible by the CBB for the adequacy of systems and controls in activities outsourced to group companies.

      May 2011

    • GR-9.3.2

      However, the degree of formality required — in terms of contractual agreements and control mechanisms — for outsourcing within a licensee's group is likely to be less, because of common management and enhanced knowledge of other group companies.

      May 2011

    • GR-9.3.3

      Licensees must obtain CBB prior written approval before committing to a material intra-group outsourcing. The request for approval must be made in writing to the licensee's normal supervisory contact at least 6 weeks prior to committing to the outsourcing, and must set out a summary of the proposed outsourcing, its rationale, and an analysis of its associated risks and proposed mitigating controls.

      Amended: October 2017
      May 2011

    • GR-9.3.4

      The CBB will respond to the request for approval in the same manner and timescale as set out in RM-7.1.8 above.

      Amended: October 2017
      May 2011

    • GR-9.3.5

      The CBB expects, as a minimum, an agreed statement of the standard of service to be provided by the group provider, including a clear statement of responsibilities allocated between the group provider and licensee.

      May 2011

    • GR-9.3.6

      The CBB also expects a licensee's management to have addressed the issues of customer confidentiality, access to information and business continuity.

      May 2011

    • GR-9.3.7

      Licensees may not outsource their core business activities, including the internal audit function, to their group.

      May 2011