Outsourcing of activities and processes; authorisation to issue statutory instruments

(1) Depending on the nature, scale, complexity and risk content of the outsourcing of decisive and important operational tasks within the meaning of Article 30(1) of Delegated Regulation (EU) 2017/565 (material outsourcing), a securities institution must take appropriate precautions to avoid excessive additional risks. Outsourcing may impair neither the orderliness of that business and those services nor the business organisation. In particular, appropriate and effective risk management by the securities institution must continue to be ensured. A securities institution must, as part of its risk management, maintain an outsourcing register. All material and non-material outsourcing arrangements must be recorded in it.
(2) More detailed provisions on material outsourcing are contained in Articles 30 to 32 of Delegated Regulation (EU) 2017/565. Where, in the case of a material outsourcing arrangement, an outsourcing undertaking has its seat in a third country, it must be ensured by contract that the outsourcing undertaking designates a domestic agent for service of process, to whom notices and service by the Bundesanstalt may be effected.
(3) The Bundesanstalt may, in an individual case, issue orders to a securities institution, and also directly to an outsourcing undertaking to which material outsourcing has taken place, that are suitable and necessary 1. to prevent or put a stop to breaches of supervisory provisions; 2. to remedy an impairment of the examination rights or monitoring options of the Bundesanstalt; or 3. to prevent or eliminate undesirable developments at the securities institution or outsourcing undertaking that could jeopardise the safety of the assets entrusted to the securities institution, or that impair the proper conduct of the investment services, ancillary investment services or ancillary business.
(4) The Federal Ministry of Finance is authorised, by statutory instrument not requiring the consent of the Bundesrat, in consultation with the Deutsche Bundesbank, to make, in addition to the requirements of Articles 30 to 32 of Delegated Regulation (EU) 2017/565, more detailed provisions on 1. when an outsourcing arrangement exists; 2. the precautions to be taken in the event of outsourcing to avoid excessive additional risks; 3. the limits of what may be outsourced; 4. the inclusion of outsourcing arrangements in risk management; and 5. the design of outsourcing contracts. The Federal Ministry of Finance may transfer this authorisation, by statutory instrument, to the Bundesanstalt, on condition that the statutory instrument is issued in agreement with the Deutsche Bundesbank. The leading associations of the institutions must be heard before the statutory instrument is issued.