Retail banks must seek the CBB's prior written approval for third party and intragroup outsourcing of functions/services containing customer information including but not limited to payment services, debt collection, card and data processing, IT function, internal audit and electronic/internet banking services but excluding legal services.