Outsourcing benefits in financial services include reduced hiring and infrastructural costs, improved efficiency and service quality, and much more.
Gargi AgarwalAssociate,Banking & Finance
Zeina AlbuainainAssociate,Corporate Commercial
Businesses in the global financial services sector commonly use third parties to execute functions they usually would have undertaken internally. Financial firms outsource significant parts of their operations to achieve strategic objectives. Outsourcing provides businesses with flexible solutions for specific organisational requirements and budgets. Outsourcing benefits in the financial services sector include reduced hiring and infrastructural costs, improved efficiency and service quality, and wider access to global talent and expertise.
The Central Bank of Bahrain (“CBB”) is the sole regulator of financial services in Bahrain. The CBB publishes its regulatory requirements in the form of a rulebook ("CBB Rulebook”). All banks licensed by the CBB (“CBB Licensees”) are subject to the CBB Rulebook, including its chapters linked to outsourcing arrangements. These chapters essentially set out the obligations imposed on CBB Licensees before entering an outsourcing agreement in addition to their continuing obligations throughout the outsourcing arrangement.
The CBB Rulebook is divided into separate volumes, each focusing on a particular category of license or industry sector. Thus, obligations and requirements on outsourcing under the CBB Rulebook slightly vary between CBB Licensees, depending on the category of license they hold. That said, the definition of outsourcing arrangements remains consistent across the relevant volumes under the CBB Rulebook, being an arrangement whereby a third party performs on behalf of a licensee an activity which was previously undertaken by the CBB Licensee itself (or in the case of a new activity, one which commonly would have been performed internally by the CBB Licensee).The CBB Rulebook provides examples of frequently outsourced activities, including data processing, cloud services, customer call centres and back-office activities.
The Central Bank of Bahrain (“CBB”)’s approach is to allow CBB Licensees the freedom to effect outsourcing arrangements, provided these have been properly structured and the associated risks have been addressed.
The CBB’s approach is to allow CBB Licensees the freedom to effect outsourcing arrangements, provided these have been properly structured and the associated risks have been addressed, and provided that the CBB’s written approval is obtained before committing to a new material outsourcing arrangement. If the outsourcing arrangement is not deemed to be a material outsourcing then the CBB would need to be notified of the outsourcing arrangement. There are however certain functions that may not be outsourced by CBB Licensees (including, for example, those pertaining to risk management and financial control).
While the requirements set out under the CBB Rulebook’s chapters and compliance thereof is primarily targeted at CBB Licensees, there are some considerations for the outsourcing service providers insofar as ‘indirect’ requirements are concerned. Yet generally speaking, it is ultimately the CBB Licensee’s responsibility to ensure that the service provider is aware of, and adheres to certain obligations that will enable the CBB Licensee to fulfil its duties under the CBB’s outsourcing rules. This essentially means that CBB Licensees must ensure that they have adequate mechanisms for monitoring the performance of the outsourcing service provider, in addition to imposing certain obligations on the outsourcing service provider (e.g. by way of contractual obligations) to ensure compliance with the CBB Rulebook. For example, the outsourcing service may be required to regularly review and test plans to ensure continuity in the provision of the outsourced activity.
An example of one crucial requirement under the CBB Rulebook’s outsourcing chapters is the conclusion of a service level agreement (“SLA"). The SLA forms a part of the outsourcing agreement between the outsourcing service provider and the CBB Licensee. It must address the allocation of responsibilities between the two parties and outline the service standards the outsourcing service provider offers.
The CBB also places an emphasis on customer data confidentiality. The CBB Rulebook states that requirements set out under Bahrain’s data protection law — Law No. 30 of 2018 on the Personal Data Protection Law (“PDPL”), and any other applicable legal requirements concerning customer confidentiality, must be observed.
Depending on the outsourcing arrangement, it is likely that the outsourcing service provider will act as a 'data processor' of the CBB Licensee for the purpose of the PDPL. The PDPL defines a 'data processor' as any natural or legal person other than an employee of the data controller or data processor, who processes personal data for the data controller’s benefit and on the data controller’s behalf.
Therefore, consideration must be given by the CBB Licensee on the PDPL’s requirements pertaining to appointing data processors, whereas the outsourcing service provider must adhere to the obligations indirectly imposed on data processors (i.e. separate from any other obligations it may have as a ‘data controller’ in Bahrain generally). Separate to the PDPL, the obligation to maintain consumer privacy is enshrined in various pieces of legislation in Bahrain. For instance, Law No. 35 of 2012 on the Consumer Protection Law obliges service providers to respect consumers’ privacy by maintaining their personal information, and not to exploit the same for other purposes.
The importance and advantages of outsourcing arrangements in the financial services sector are clear. However, financial services outsourcing can potentially cause certain systemic and operational issues. To eliminate these challenges, CBB Licensees and outsourcing service providers must give consideration to the laws regulating outsourcing arrangements in Bahrain, which in turn may ensure that both parties contract in a manner that does not hinder their operations' efficiency or effectiveness.
For further information,please contact Gargi Agarwal or Zeina Albuainain
Published in February 2023
