(1) An institution must, depending on the type, scale, complexity, and risk content of an outsourcing of activities and processes to another undertaking that are material to conducting banking business, financial services, or other services typical of institutions, take adequate precautions to avoid excessive additional risks. An outsourcing may not impair either the propriety of these transactions and services or the business organisation within the meaning of section 25a(1). In particular, adequate and effective risk management by the institution that includes the outsourced activities and processes must remain ensured. As part of its risk management, an institution must maintain an outsourcing register; all material and non-material outsourcings must be recorded in it.
(2) The outsourcing may not result in a transfer of the managers' responsibility to the outsourcing undertaking. On an outsourcing, the institution remains responsible for compliance with the statutory provisions to be observed by the institution.
(3) The outsourcing may not prevent the Federal Institute from performing its tasks; its rights to information and examination, and its powers of control, in relation to the outsourced activities and processes, must be ensured by suitable precautions even where the outsourcing is to an undertaking with its registered office in a state of the European Economic Area or in a third country. The same applies to the performance of the tasks of the institution's auditors. An outsourcing requires a written agreement setting out the institution's rights necessary to comply with the foregoing conditions, including rights of instruction and termination, and the corresponding duties of the outsourcing undertaking. Where, in the case of a material outsourcing, an outsourcing undertaking has its registered office in a third country, it must be ensured by contract that the outsourcing undertaking names a domestic agent authorised to accept service, to whom notifications and service of documents by the Federal Institute can be effected.
(4) Where the Federal Institute's rights of examination and powers of control are impaired by outsourcings, the Federal Institute may, in the individual case, issue orders that are suitable and necessary to remove this impairment. The Federal Institute's powers under section 25a(2), second sentence, remain unaffected.
(4a) The Federal Institute may also issue orders directly to outsourcing undertakings to which material activities and processes within the meaning of subsection (1), first sentence, have been outsourced, in the individual case, that are suitable and necessary
1. to prevent or stop breaches of supervisory provisions, or
2. to prevent or remove deficiencies at the institution that could endanger the safety of the assets entrusted to the institution or impair the proper conduct of banking business or financial services.
(5) The Federal Ministry of Finance is empowered, in consultation with the Deutsche Bundesbank, to issue a statutory instrument, not requiring the consent of the Bundesrat, setting out further provisions on:
1. when an outsourcing exists,
2. the precautions to be taken on an outsourcing to avoid excessive additional risks,
3. the limits of what may be outsourced,
4. the inclusion of the outsourced activities and processes in risk management, and
5. the design of outsourcing agreements. The Federal Ministry of Finance may transfer this power, by statutory instrument, to the Federal Institute, on condition that the statutory instrument is issued in agreement with the Deutsche Bundesbank. The institutions' umbrella associations must be heard before the statutory instrument is issued.