When a bank or other Bangko Sentral ng Pilipinas-supervised financial institution (BSFI) brings in a technology provider, the work doesn't leave the institution. The responsibility doesn't either.
The Central Bank of the Philippines’ rules, otherwise known as the Bangko Sentral ng Pilipinas (BSP), say the board and senior management “shall remain responsible for ensuring that outsourced activities are conducted in a safe and sound manner.”
That's why examiners ask about your vendors. They want to see that you chose the provider carefully, that your contract protects the institution and its customers, and that you're still monitoring the relationship after the contract is signed.
Below are the questions that tend to come up, the BSP rules behind them, and the vendor due diligence records worth having on file before the examination starts.
The rules behind the questions
Most of what an examiner asks traces back to two sets of BSP rules.
The first is the outsourcing framework. Section 112 of the Manual of Regulations for Banks sets out requirements for assessing, selecting, contracting with and monitoring service providers. BSP Circular No. 1137 also strengthened the regulatory framework for outsourcing and IT risk management, including requirements relevant to banks and non-bank financial institutions.
The rules require institutions to assess the risks associated with an outsourcing arrangement and determine whether the arrangement is material. The assessment considers factors such as the importance of the activity, the potential impact of disruption, the institution's overall exposure to the provider, and risks to customer and bank data.
The second is the BSP's guidance on IT outsourcing and vendor management, which covers technology providers specifically. It addresses areas such as data security, incident and breach reporting, subcontracting, business continuity and disaster recovery.
It's also important to understand what cannot simply be outsourced. Certain inherent banking functions cannot be outsourced under the BSP framework. A technology provider may support an institution's operations, but the institution remains responsible for functions that are required to be performed by the bank itself.
What examiners ask about a technology provider
Every examination is different, but the questions usually fall into six areas.
1. Did you assess the risk before signing?
Examiners want to see that the decision to outsource came after a risk assessment, not before it.
The BSP framework considers factors such as the importance of the activity, the cost of the arrangement, the institution's overall exposure to a particular provider, the adequacy of its controls, and the risks to the confidentiality, integrity and availability of customer and bank data.
Expect to be asked whether you classified the arrangement as material and, more importantly, why.
2. Why this provider?
This is where third party due diligence comes in.
The BSP expects institutions to consider a provider's financial soundness, reputation, managerial skills, technical capabilities, operational capability and capacity.
For a technology provider, examiners may also ask how you assessed its information security controls, how it handles your data, and who has access to that data.
The exact information you collect will depend on the nature and risk of the arrangement. For a higher-risk technology provider, this may include security assessments, audit reports, certifications, financial information and information about subcontractors.
3. What does the contract say?
Certain clauses are likely to get close attention.
The agreement should recognize the BSP's supervisory authority and applicable access rights, including access to relevant information, records and areas needed for supervisory purposes.
It should also require the provider to meet the institution's security requirements, provide for appropriate incident or breach reporting, and set out the rules and limits around subcontracting.
Service levels should be clear enough to measure the provider's performance against the agreement.
4. What happens if the provider fails?
Banks are expected to maintain and regularly test business continuity plans for situations where a service provider cannot deliver.
The BSP framework also considers the portability of outsourced services.
In practice, an examiner may ask what happens if you need to move to another provider or bring the service back in-house. They may also want to know how long the transition would take and whether you have tested the plan.
5. How are you monitoring it now?
Due diligence doesn't end when the contract is signed.
Institutions are expected to keep records of their outsourcing activities, review them regularly, and maintain enough resources to monitor each relationship.
The provider's actual performance also matters. Keep evidence of SLA performance, incidents, issues raised and periodic reviews up to date.
The extent and frequency of monitoring should also reflect the nature and risk of the outsourcing arrangement.
6. Who owns the relationship?
The board and senior management remain accountable for outsourced activities. Examiners therefore look for clear ownership within the institution.
Who approved the arrangement? Who is responsible for the relationship? Who reviews the provider's performance? And what gets escalated to senior management or the board?
These should all have clear answers.
What to have on file before the examination
The BSP expects institutions to maintain documentation showing that outsourcing arrangements have been properly assessed, approved where applicable, and managed.
The exact records will depend on the arrangement and its risk. For a technology provider, a well-organized vendor file may include:
The risk assessment, including whether the arrangement is considered material and the reasoning behind that assessment.
Your vendor due diligence records, which may include financial information, ownership details, security assessments, certifications and a completed vendor due diligence questionnaire, depending on the nature of the provider and the arrangement.
The signed contract and SLAs, with the relevant BSP access, incident reporting and subcontracting provisions easy to find.
Business continuity and exit plans, along with the results of relevant testing where applicable.
Monitoring records, including SLA performance, incident reports and periodic reviews.
Board or committee approvals and reports, where applicable, for the arrangement and any significant changes.
Not every document will apply in the same way to every technology provider. The records you maintain should be appropriate to the type, scope and risk of the outsourcing arrangement.
If the arrangement is material, check the applicable BSP notification or approval requirements before proceeding. The regulatory treatment of an outsourcing arrangement depends on the applicable rules and the circumstances, including the type of institution and the nature of the arrangement. Confirm the current requirements with your compliance or legal team.
The BSP's current Manual of Regulations is updated to incorporate subsequent circulars and amendments, so always check the current provisions rather than relying on an older summary.
A good technology provider makes this process easier. Ask early for the security documentation, audit reports, certifications and other information your institution needs for its due diligence. You should also confirm that the provider will cooperate with the institution's regulatory and audit requirements.
Working with TNKR
An examiner's questions are easier to answer when your technology provider has already thought about them.
If you're evaluating TNKR as a technology provider, talk to our team about the documentation available to support your vendor due diligence process.
Frequently asked questions
Originally published