Outsourcing by FIs: Framework for risk management amended

The State Bank of Pakistan (SBP) has made amendments to Framework for Risk Management in Outsourcing Arrangements by Financial Institutions.

Since the issuance of the framework, FIs are increasingly using third party service providers including group companies to carry out various activities, functions and processes under the ambit of this framework. Consequently, it has increased risk profile of FIs due to their dependence on third parties and group companies.

The State Bank, with the objective to further facilitating FIs for outsourcing with third parties including group companies and effectively manage the risks arising out of these arrangements, has revised a number of sections of the Framework for Risk Management in Outsourcing Arrangements by Financial Institutions.

The amendment has been made in sections including definition of Personally Identifiable Information (PII), disclosure of customers' information, outsourcing outside Pakistan, group outsourcing, information technology outsourcing, insourcing of card production activity, insourcing of data centre and insourcing of Information Technology & systems audit.

The SBP said that henceforth, all new outsourcing arrangements by FIs will be governed under the amended provisions of the framework with immediate effect.