Circular outlining expectations relating to outsourcing arrangements, infrastructure dependencies, vendor governance, operational resilience, and third-party control oversight.
This circular establishes expectations relating to outsourcing structures, critical vendor relationships, operational dependencies, hosted infrastructure arrangements, and third-party governance controls.
The objective is to ensure that licence holders understand, document, monitor, and manage operational dependencies that may materially affect continuity, integrity, security, client servicing, or control effectiveness.
| Area | Expectation |
|---|---|
| Vendor Identification | Critical vendors and dependencies should be documented clearly. |
| Ownership | Internal ownership of each outsourced relationship should exist. |
| Review | Vendor relationships should be reviewed periodically. |
| Monitoring | Operational performance and dependency risk should be monitored. |
| Continuity | Fallback or contingency considerations should exist for critical services. |
Entities should identify and maintain visibility over critical operational dependencies, including where relevant:
Entities should maintain sufficient visibility into:
Vendor relationships should not operate as invisible black boxes after onboarding.
Entities are expected to:
Material outsourcing changes should be internally tracked and reviewed.
For clarification regarding outsourcing governance or operational dependency expectations:
This circular takes effect immediately upon publication.
