CHAPTER II

ORGANISATIONAL REQUIREMENTS
SECTION 2

Outsourcing

Scope of critical and important operational functions(Article 16(2) and first subparagraph of Article 16(5) of Directive 2014/65/EU)
Article 30
1
For the purposes of the first subparagraph of Article 16(5) of Directive 2014/65/EU, an operational function shall be regarded as critical or important where a defect or failure in its performance would materially impair the continuing compliance of an investment firm with the conditions and obligations of its authorisation or its other obligations under Directive 2014/65/EU, or its financial performance, or the soundness or the continuity of its investment services and activities.
2
Without prejudice to the status of any other function, the following functions shall not be considered as critical or important for the purposes of paragraph 1:
a
the provision to the firm of advisory services, and other services which do not form part of the investment business of the firm, including the provision of legal advice to the firm, the training of personnel of the firm, billing services and the security of the firm's premises and personnel;
b
the purchase of standardised services, including market information services and the provision of price feeds.

Outsourcing critical or important operational functions(Article 16(2) and of Article 16(5) first subparagraph of Directive 2014/65/EU)
Article 31
1
Investment firms outsourcing critical or important operational functions shall remain fully responsible for discharging all of their obligations under Directive 2014/65/EU and shall comply with the following conditions:
a
the outsourcing does not result in the delegation by senior management of its responsibility;
b
the relationship and obligations of the investment firm towards its clients under the terms of Directive 2014/65/EU is not altered;
c
the conditions with which the investment firm must comply in order to be authorised in accordance with Article 5 of Directive 2014/65/EU, and to remain so, are not undermined;
d
none of the other conditions subject to which the firm's authorisation was granted is removed or modified.
2
Investment firms shall exercise due skill, care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions and shall take the necessary steps to ensure that the following conditions are satisfied:
a
the service provider has the ability, capacity, sufficient resources, appropriate organisational structure supporting the performance of the outsourced functions, and any authorisation required by law to perform the outsourced functions, reliably and professionally;
b
the service provider carries out the outsourced services effectively and in compliance with applicable law and regulatory requirements, and to this end the firm has established methods and procedures for assessing the standard of performance of the service provider and for reviewing on an ongoing basis the services provided by the service provider;
c
the service provider properly supervises the carrying out of the outsourced functions, and adequately manage the risks associated with the outsourcing;
d
appropriate action is taken where it appears that the service provider may not be carrying out the functions effectively or in compliance with applicable laws and regulatory requirements;
e
the investment firm effectively supervises the outsourced functions or services and manage the risks associated with the outsourcing and to this end the firm retains the necessary expertise and resources to supervise the outsourced functions effectively and manage those risks;
f
the service provider has disclosed to the investment firm any development that may have a material impact on its ability to carry out the outsourced functions effectively and in compliance with applicable laws and regulatory requirements;
g
the investment firm is able to terminate the arrangement for outsourcing where necessary, with immediate effect when this is in the interests of its clients, without detriment to the continuity and quality of its provision of services to clients;
h
the service provider cooperates with the competent authorities of the investment firm in connection with the outsourced functions;
i
the investment firm, its auditors and the relevant competent authorities have effective access to data related to the outsourced functions, as well as to the relevant business premises of the service provider, where necessary for the purpose of effective oversight in accordance with this article, and the competent authorities are able to exercise those rights of access;
j
the service provider protects any confidential information relating to the investment firm and its clients;
k
the investment firm and the service provider have established, implemented and maintained a contingency plan for disaster recovery and periodic testing of backup facilities, where that is necessary having regard to the function, service or activity that has been outsourced;
l
the investment firm has ensured that the continuity and quality of the outsourced functions or services are maintained also in the event of termination of the outsourcing either by transferring the outsourced functions or services to another third party or by performing them itself.
3
The respective rights and obligations of the investment firms and of the service provider shall be clearly allocated and set out in a written agreement. In particular, the investment firm shall keep its instruction and termination rights, its rights of information, and its right to inspections and access to books and premises. The agreement shall ensure that outsourcing by the service provider only takes place with the consent, in writing, of the investment firm.
4
Where the investment firm and the service provider are members of the same group, the investment firm may, for the purposes of complying with this Article and Article 32, take into account the extent to which the firm controls the service provider or has the ability to influence its actions.
5
Investment firms shall make available on request to the competent authority all information necessary to enable the authority to supervise the compliance of the performance of the outsourced functions with the requirements of Directive 2014/65/EU and its implementing measures.

Service providers located in third countries(Article 16(2) and first subparagraph of Article 16(5) of Directive 2014/65/EU)
Article 32
1
In addition to the requirements set out in Article 31, where an investment firm outsources functions related to the investment service of portfolio management provided to clients to a service provider located in a third country, that investment firm ensures that the following conditions are satisfied:
a
the service provider is authorised or registered in its home country to provide that service and is effectively supervised by a competent authority in that third country;
b
there is an appropriate cooperation agreement between the competent authority of the investment firm and the supervisory authority of the service provider.
2
The cooperation agreement referred to in point (b) of paragraph 1 shall ensure that the competent authorities of the investment firm are able, at least, to:
a
obtain on request the information necessary to carry out their supervisory tasks pursuant to Directive 2014/65/EU and Regulation (EU) No 600/2014;
b
obtain access to the documents relevant for the performance of their supervisory duties maintained in the third country;
c
receive information from the supervisory authority in the third country as soon as possible for the purpose of investigating apparent breaches of the requirements of Directive 2014/65/EU and its implementing measures and Regulation (EU) No 600/2014;
d
cooperate with regard to enforcement, in accordance with the national and international law applicable to the supervisory authority of the third country and the competent authorities in the Union in cases of breach of the requirements of Directive 2014/65/EU and its implementing measures and relevant national law.
3
Competent authorities shall publish on their website a list of the supervisory authorities in third countries with which they have a cooperation agreement referred to in point (b) of paragraph 1.
Competent authorities shall update cooperation agreements concluded before the date of entry into application of this Regulation within six months from that date.