Statement Of Guidance: Outsourcing For Regulated Entities In The Cayman Islands.pdf

This Statement of Guidance is intended to provide regulated entities with minimum expectations on outsourcing material functions or activities and outsourcing arrangements. Regulated entities remain ultimately responsible for all outsourced material functions or activities, regulatory requirements, and other requirements of the Authority. The Authority expects regulated entities not to generally outsource material functions, but where material functions are outsourced, regulated entities should follow this Guidance.

This Guidance applies to all entities regulated by the Authority, including controlled subsidiaries, and is provided on the basis that regulated entities, including their Governing Body and Senior Management, remain ultimately responsible for all outsourced material functions or activities, regulatory requirements, and any other requirements of the Authority.

For the purpose of this Guidance, outsourcing is defined as a regulated entity's use of a third party to perform functions or activities on a continuing basis that would normally be undertaken by the regulated entity. Outsourcing does not include purchasing contracts. A material function or activity is defined as a function or activity that, if disrupted, could impact an institution's business operations, reputation, or profitability in a significant way.

A regulated entity should assess the materiality of its outsourcing arrangements, considering factors such as the impact on finances, reputation, and operations, the ability to maintain internal controls and meet regulatory requirements, the cost of the outsourcing arrangement, the risk of potential loss of access to important data, and the degree of difficulty and time required to find an alternative Service Provider or to bring the business activity 'in-house'.

The Authority expects regulated entities to outsource material functions or activities for various reasons, including to take advantage of economies of scale or expertise. A regulated entity should implement this Guidance in proportion to the risks, size, nature, and complexity of its business, following an appropriate risk assessment of the outsourcing arrangement. The Authority may, on a case-by-case basis, impose additional requirements on a regulated entity depending on its assessment of the potential negative impact of the outsourcing arrangement on the entity or its investors/clients.

A regulated entity should maintain the same level of oversight and accountability with respect to the outsourcing of any material function or activity as it would apply to its non-outsourced material functions or activities. The Authority's supervisory functions and legal obligations should not be hindered by the outsourcing of any material function or activity by a regulated entity.