The outsourcing agreementThe outsourcing agreement

The outsourcing agreement

19. Except where otherwise provided, all outsourcing arrangements must be evidenced by a written, legally binding agreement. The agreement must be executed before the outsourcing arrangement commences.

20. At a minimum, the agreement (including arrangements with related bodies corporate) must address the following matters:

(a) the scope of the arrangement and services to be supplied;

(b) commencement and end dates;

(c) review provisions;

(d) pricing and fee structure;

(e) service levels and performance requirements;

(f) audit and monitoring procedures;

(g) business continuity management;

(h) confidentiality, privacy and security of information;

(i) default arrangements and termination provisions;

(j) dispute resolution arrangements;

(k) liability and indemnity;

(l) subcontracting;

(m) insurance; and

(n) to the extent applicable, offshoring arrangements (including through subcontracting).

21. An ADI that outsources a material business activity must ensure that its outsourcing agreement includes an indemnity to the effect that any subcontracting by a third party service provider of the outsourced function will be the responsibility of the third party service provider including liability for any failure on the part of the subcontractor.

22. The requirements in paragraph 19 do not apply to an outsourcing arrangement with a related body corporate unless:

(a) after having consulted with the ADI, APRA notifies the ADI, in writing, that the arrangement must be evidenced by a written legally binding agreement; or

(b) another prudential standard requires the arrangement to be undertaken using a written legally binding agreement.

23. Where an ADI enters into an outsourcing agreement as a result of an unexpected extreme event which results in:

(a) the ADI invoking its Business Continuity Plan;[4] or

(b) the sudden financial or operational failure of an existing service provider,

then paragraphs 17 to 22 inclusive, 27 and 28 need only be complied with to the extent that is reasonably possible having regard to the nature of the extreme event. The ADI must notify APRA as soon as practicable of any such outsourcing arrangement.

APRA access to service providers

24. An outsourcing agreement must include a clause that allows APRA access to documentation related to the outsourcing arrangement. In the normal course, APRA will seek to obtain whatever information it requires from the ADI; however, the outsourcing agreement must include the right for APRA to conduct on-site visits to the service provider if APRA considers this necessary in its role as prudential supervisor. APRA expects service providers to cooperate with APRA’s requests for information and assistance. If APRA intends to undertake an on-site visit to a service provider, it will normally inform the ADI of its intention to do so.