Outsourcing

(1) An institution must, depending on the type, scope, complexity and risk content of an outsourcing of activities and processes to another undertaking that are material to the carrying out of payment services, e-money business or other services typical of institutions under this Act, including ICT systems, take appropriate measures to avoid excessive additional risks. An outsourcing may not impair the orderliness of these transactions and services, or the business organisation. In particular, appropriate and effective risk management by the institution must continue to be ensured, encompassing the outsourced activities and processes, and the outsourcing may not result in a delegation of the responsibility of the managers or of the other persons named in section 10(2), first sentence, no. 14 and in section 11(2), second sentence, no. 5, to the outsourcing undertaking. The institution remains responsible for compliance with the legal provisions applicable to it. BaFin may not be impeded by the outsourcing in performing its tasks; its rights to information and examination and its powers of control must be ensured, in respect of the outsourced activities and processes, by appropriate arrangements, also in the case of outsourcing to an undertaking with its registered office abroad; the same applies to the performance of the tasks of the institution's auditors. An outsourcing requires a written agreement laying down the institution's rights, including rights of instruction and termination, necessary to ensure compliance with the foregoing conditions, together with the corresponding obligations of the outsourcing undertaking. Where, in the case of a material outsourcing, an outsourcing undertaking has its registered office in a third country, it must be contractually ensured that the outsourcing undertaking designates a domestic agent for service, to whom notifications and service by BaFin can be effected. An institution must, as part of its risk management, maintain an outsourcing register; all material and non-material outsourcings must be recorded in it.
(2) Where an institution intends to outsource material operational tasks relating to payment services or the e-money business, it must inform BaFin and the Deutsche Bundesbank of this. An operational task is material where its inadequate or omitted performance would materially impair the institution's continued compliance with the licensing requirements or other obligations under this Act, its financial capacity, or the soundness or continuity of its payment services or e-money business.
(3) Where facts justify the assumption that an outsourcing impairs BaFin's rights of examination and powers of control, BaFin may issue to the institution the orders that are appropriate and necessary to remove the impairment and to prevent future impairments. Where the measures do not prove sufficient to ensure BaFin's rights of examination and powers of control, BaFin may order that the outsourced activities be brought back in-house. BaFin's powers under section 27(3) remain unaffected.
(3a) BaFin may also, in an individual case, issue orders directly against outsourcing undertakings that are appropriate and necessary
1. to prevent or put a stop to breaches of supervisory provisions, or
2. to prevent or eliminate shortcomings in an institution that could jeopardise the safety of the assets entrusted to the institution, or that impair the proper conduct of payment services, the e-money business or other services typical of institutions under this Act.
(4) Where the use of bodies to which activities are outsourced changes, the institution must notify BaFin and the Deutsche Bundesbank of these changes in writing or electronically without delay.