Part The outsourcing agreement - Banking, Insurance and Life Insurance (prudential standard) determination No. 1 of 2014 - Prudential Standard CPS 231 - Outsourcing - The outsourcing agreement

The outsourcing agreement

Except where otherwise provided in this Prudential Standard, all outsourcing arrangements must be contained in a documented legally binding agreement. The agreement must be signed by all parties to it before the outsourcing arrangement commences.
At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:

(a) the scope of the arrangement and services to be supplied;

(b) commencement and end dates;

(d) pricing and fee structure;

(e) service levels and performance requirements;

(f) audit and monitoring procedures;

(g) business continuity management;

(h) confidentiality, privacy and security of information;

(i) default arrangements and termination provisions;

(j) dispute resolution arrangements;

(k) liability and indemnity;

(l) sub-contracting;

(m) insurance; and

(n) to the extent applicable, offshoring arrangements (including through sub-contracting).

A regulated institution that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any sub-contracting by a third-party service provider of the outsourced function will be the responsibility of the third-party service provider, including liability for any failure on the part of the sub-contractor.
The requirements in paragraph 25 do not apply to an outsourcing arrangement with a related body corporate unless:

(a) after having consulted with the regulated institution, APRA notifies the regulated institution, in writing, that the outsourcing arrangement must be evidenced by a documented legally binding agreement;

(b) another prudential standard requires the arrangement to be undertaken under a documented legally binding agreement; or

(c) in the case of a general insurer, the outsourcing arrangement is between a Category D insurer[8] and a related body corporate.

Where a foreign ADI, Category C insurer or EFLIC enters into an outsourcing arrangement with its head office, the requirements of subparagraph 24(d) and 25 do not apply.
Where a regulated institution enters into an outsourcing agreement as a result of an unexpected extreme event that results in:

(a) the regulated institution invoking its Business Continuity Plan; or

The outsourcing agreementThe outsourcing agreement

Get a plain-English read of The outsourcing agreement

The outsourcing agreement