.jpg)
The International Organization of Securities Commission (IOSCO) Technical Committee has published a final report – Principles for Outsourcing by Markets (Outsourcing Principles) – containing a set of principles designed to assist market operators1 i.e. exchanges, and market authorities when considering outsourcing arrangements.
Many markets and their market operators use third party service providers to perform processes, services or activities that would otherwise be undertaken by the markets or market operators themselves.
The report is available on the IOSCO website.
Summary
The Outsourcing Principles set out the factors that market operators should consider when deciding whether, and to whom, to outsource processes, services or functions, and are also designed to assist market authorities in their oversight of these arrangements.
These principles were developed following an earlier IOSCO report on Regulatory Issues Arising from Exchange Evolution which identified outsourcing amongst regulatory issues causing concern arising from the new business model of exchanges. In particular the report focused on the issues that could arise once exchanges began to consider outsourcing activities relating to regulatory and key operational functions.
Outsourcing can bring substantial benefits for markets particularly through the lowering of costs whilst allowing access to a high level of expertise and the latest technology. However, it also raises a number of issues that may impact on the effectiveness and integrity of markets related to their ability to manage risks and monitor compliance with regulatory requirements.
Outsourcing thus poses a number of important challenges to both markets and market authorities and these principles are designed to address those concerns.
Principles for Outsourcing by Markets
The following areas and related principles have been identified as requiring consideration when a market outsources any of its processes, services or functions:
1. Due diligence in selecting the service provider and in monitoring the service provider’s performance
Principle: An outsourcing market should conduct suitable due diligence processes in selecting an appropriate third party service provider and in monitoring its ongoing performance.
The outsourcing market should also take appropriate steps to identify any conflicts of interest between the outsourcing market and the service provider (including affiliated entities and sub-contractors) and ensure that policies and procedures are in place to mitigate and manage any potential conflicts of interest which have been identified or could arise.
2. The contract with a service provider
Principle: There should be a legally binding written contract between the outsourcing market and each third party service provider, the nature and detail of which should be appropriate to the materiality and nature of the outsourced activity to the ongoing business of the outsourcing market.3. Business Continuity at the Outsourcing Provider
Principle: The outsourcing market should take appropriate measures to determine that its service providers establish and maintain emergency procedures and a plan for disaster recovery, with periodic testing of backup facilities.
4. Security and Confidentiality of Information
Principle: The outsourcing market should take appropriate measures to determine that procedures are in place to protect the outsourcing market’s proprietary, member-related and potentially market sensitive information and software.
The outsourcing market should take appropriate steps to require that service providers protect confidential information regarding the outsourcing market’s members from intentional or inadvertent disclosure to unauthorised individuals.
5. Termination Procedures
Principle: Outsourcing with third party service providers should include contractual provisions relating to the termination of the contract and appropriate exit strategies.6. Regulator’s and Market’s Access to Books and Records, including rights of inspection
Principle: The market authority, the outsourcing market, and its auditors, should have access to the books and records of service providers relating to the outsourced activities and the market authority should be able to obtain promptly, upon request, other information concerning activities that are relevant to regulatory oversight.
This Report complements an existing IOSCO report - Principles on Outsourcing of Financial Services for Market Intermediaries - which establishes a set of principles designed to assist regulated market intermediaries in determining the steps they should take when considering outsourcing activities.
1 For the purpose of this Report, the term “market” refers to exchanges only and does not include Alternative Trading Systems (ATS) or Multilateral Trading Facilities (MTFs).
