Subject matter, scope and definitions
Subject matter
These guidelines specify the internal governance arrangements, including sound risk management, that institutions, payment institutions and electronic money institutions should implement when they outsource functions, in particular with regard to the outsourcing of critical or important functions.
The guidelines specify how the arrangements referred to in the previous paragraph should be reviewed and monitored by competent authorities, in the context of Article 97 of Directive 2013/36/EU(20), supervisory review and evaluation process (SREP), Article 9(3) (opens EUR-Lex in a new tab) of Directive (EU) 2015/2366 (opens EUR-Lex in a new tab)(21), Article 5 (5) (opens EUR-Lex in a new tab) of Directive 2009/110/EC (opens EUR-Lex in a new tab)(22) by fulfilling their duty to monitor the continuous compliance of entities to which these guidelines are addressed with the conditions of their authorisation.
Addressees
These guidelines are addressed to competent authorities as defined in point 40 of Article 4(1) of Regulation (EU) No 575/2013(23), including the European Central Bank with regards to matters relating to the tasks conferred on it by Regulation (EU) No 1024/2013(24), to institutions as defined in point 3 of Article 4(1) of Regulation (EU) No 575/2013, to payment institutions as defined in Article 4(4) (opens EUR-Lex in a new tab) of Directive (EU) 2015/2366 (opens EUR-Lex in a new tab) and to electronic money institutions within the meaning of Article 2(1) (opens EUR-Lex in a new tab) of Directive 2009/110/EC (opens EUR-Lex in a new tab). Account information service providers that only provide the service in point 8 of Annex I (opens EUR-Lex in a new tab) of Directive (EU) 2015/2366 (opens EUR-Lex in a new tab) are not included in the scope of application of these guidelines, in accordance with Article 33 (opens EUR-Lex in a new tab) of that Directive.
For the purpose of these guidelines, any reference to ‘payment institutions’ includes ‘electronic money institutions’ and any reference to ‘payment services’ includes ‘issuing of electronic money’.
Scope of application
Without prejudice to Directive 2014/65/EU (opens EUR-Lex in a new tab)(25) and Commissions Delegated Regulation (EU) 2017/565 (opens EUR-Lex in a new tab)(26) (which contains requirements regarding outsourcing by institutions providing investment services and performing investment activities, as well as relevant guidance issued by the European Securities and Markets Authority regarding investment services and activities), institutions as defined in point 3 of Article 3 (1) of Directive 2013/36/EU should comply with these guidelines on a solo basis, sub-consolidated basis and consolidated basis. The application on a solo basis might be waived by competent authorities under Article 21 of Directive 2013/36/EU or Article 109(1) of Directive 2013/36/EU in conjunction with Article 7 of Regulation (EU) No 575/2013. Institutions subject to Directive 2013/36/EU should comply with this Directive and these guidelines on a consolidated and sub-consolidated basis as set out in Article 21 and Articles 108 to 110 of Directive 2013/36/EU.
Without prejudice to Article 8 (3) (opens EUR-Lex in a new tab) of Directive (EU) 2015/2366 (opens EUR-Lex in a new tab) and Article 5 (7) (opens EUR-Lex in a new tab) of Directive 2009/110/EC (opens EUR-Lex in a new tab), payment institutions and electronic money institutions should comply with these guidelines on an individual basis.
Competent authorities responsible for the supervision of institutions, payment institutions and electronic money institutions should comply with these guidelines.
Definitions
Unless otherwise specified, terms used and defined in Directive 2013/36/EU, Regulation (EU) No 575/2013, Directive 2009/110/EC (opens EUR-Lex in a new tab), Directive (EU) 2015/2366 (opens EUR-Lex in a new tab) and the EBA Guidelines on internal governance(27) have the same meaning in these guidelines. In addition, for the purposes of these guidelines, the following definitions apply:
Outsourcing | means an arrangement of any form between an institution, a payment institution or an electronic money institution and a service provider by which that service provider performs a process, a service or an activity that would otherwise be undertaken by the institution, the payment institution or the electronic money institution itself. |
Function | means any processes, services or activities. |
Critical or important function(28) | means any function that is considered critical or important as set out in Section 4 of these guidelines. |
Sub-outsourcing | means a situation where the service provider under an outsourcing arrangement further transfers an outsourced function to another service provider.(29) |
Service provider | means a third-party entity that is undertaking an outsourced process, service or activity, or parts thereof, under an outsourcing arrangement. |
Cloud services | means services provided using cloud computing, that is, a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, servers, storage, applications and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. |
Public cloud | means cloud infrastructure available for open use by the general public. |
Private cloud | means cloud infrastructure available for the exclusive use by a single institution or payment institution. |
Community cloud | means cloud infrastructure available for the exclusive use by a specific community of institutions or payment institutions, including several institutions of a single group. |
Hybrid cloud | means cloud infrastructure that is composed of two or more distinct cloud infrastructures. |
Management body | means an institution’s or payment institution’s body or bodies, which are appointed in accordance with national law, which are empowered to set the institution’s or payment institution’s strategy, objectives and overall direction, and which oversee and monitor management decision-making and include the persons who effectively direct the business of the institution or payment institution and the directors and persons responsible for the management of the payment institution. |