Revised draft outsourcing policy for registered banks

The Reserve Bank has published a near-final draft policy on the requirements that will apply to large New Zealand registered banks entering into arrangements to outsource any business or function of the bank to a third party.

The revisions to the draft policy follow feedback on an earlier consultation paper issued in November 2004. The Reserve Bank is seeking to finalise the policy in late 2005.

The main thrusts of the draft policy are as follows:

1. Large banks
   It applies to registered banks whose New Zealand liabilities, net of amounts due to related parties, exceed $10 billion ("large banks").
   
   
2. Control over core functions in event of stress or failure
   The revised draft policy does not completely ban the outsourcing of core services. However, it states that large banks will normally be subject to a condition of registration requiring them to have the "legal and practical ability to control and execute" outsourced functions in the event of stress or the failure of the bank or a relevant service provider.
   
   That control must achieve the following outcomes:
   
   
   • the bank's clearing and settlement obligations can be met on the due day;
     
     
   • the bank's financial risk positions can be identified on each day;
     
     
   • the bank's financial risk positions can be monitored and managed on the day following a failure and on subsequent days; and
     
     
   • the bank's existing customers can access payments facilities on the day following a failure and on subsequent days.
     
     
   The "legal ability to control and execute" means the ability to invoke legal rights necessary to ensure the continuity of the relevant functions. According to the Reserve Bank, this would be assisted by, for instance, contractual terms being clear and complete, New Zealand being the governing law and jurisdiction of any contract, and service providers being regulated by the Reserve Bank rather than any overseas regulator.
   
   The "practical ability to control and execute" means the ability to secure continuity within the required timeframes (bearing in mind that the enforcement of legal rights may involve a delay).
   
   This relates to the availability and knowledge of personnel, and physical control over the relevant systems and data. The Reserve Bank wants to mitigate the risks associated with the performance of functions outside New Zealand and the practice of service providers mingling the performance of functions for a New Zealand registered bank with the performance of functions for other entities.
   
   
3. Board and executive accountability
   Large banks will also generally be subject to a further condition of registration requiring that:
   
   
   • the management of the bank by its CEO (or equivalent) is carried out solely under the direction and supervision of the board;
     
     
   • the CEO's employment contract is with the bank, and its terms are determined by the board; and
     
     
   • all staff of the bank have their remuneration determined by (or under delegated authority from) the board or the CEO and are accountable (directly or indirectly) to the CEO.

The press release issued by the Reserve Bank in relation to the revised draft policy states that it incorporates the following changes from the November 2004 paper:

1. a greater emphasis on the primary responsibility of bank directors to manage outsourcing risk as a normal business risk;
   
   
2. a narrower focus on ensuring that large banks can continue to provide the core functions of liquidity, payments and transactions services, with less emphasis on other functions;
   
   
3. more clarity on the outcomes required by the policy; and
   
   
4. greater flexibility in the methods banks can use to meet those outcomes.

The Reserve Bank has also emphasised that the draft policy has been designed with a view to balancing the pros and cons of outsourcing within the banking system - essentially cost versus stability.

It is acknowledged, for instance, that outsourcing allows banks to lower their everyday operating costs, which makes for a more efficient financial system generally. However, any failure (even a short-lived one) by a large bank to provide core services such as liquidity, payments and transaction functions could have a serious effect on the New Zealand economy.

Indications of possible acceptable approaches to achieving the required outcomes where a core function is outsourced to a third party include:

1. alternative channels for the delivery of the function in the event of failure (e.g. "step-in" rights for the bank, backups or workarounds);
   
   
2. business continuity planning and regular testing;
   
   
3. explicit exclusion of statutory management of the bank from the definition of default events under contracts for core services; and/or
   
   
4. requirements that the service be provided from New Zealand or from a location close to New Zealand.

However, the acceptability of any such approach would depend on factors such as the materiality of the function in question and the impact of any failure on customers.

The Reserve Bank will be working with each bank to implement the draft policy taking into account its individual circumstances and investment cycles.

For more information, see www.rbnz.govt.nz.

Enquiries and information

For more information on any of the cases, articles and features in Financial Services Quarterly, please email Rachel Gowing or call on 64 9 916 8825.