Charta is on Google Play: practise on the go. Get the app
Charta

Set out the subjects and clauses that a contract with a third-party service provider should cover.

FRM® Part II · Operational Risk and Resilience · Guidance on Managing Outsourcing Risk · FRM2.ORR.12.c

The idea

The contract is the bank's main tool to control what it cannot do itself. It should be written, reviewed by legal counsel, and proportionate to the risk of the activity. Subjects to cover include the precise scope of services, and measurable performance standards and service levels with consequences for misses. They also include reporting and incident notification, and audit and access rights for the bank, its auditors and its supervisors. Further subjects are compliance with laws, confidentiality, data security, and ownership and location of data. The contract should also cover business continuity and disaster recovery obligations, rules on subcontracting, and default and termination rights with transition assistance and return of data. Indemnification, liability limits and insurance belong in it too. So do dispute resolution and governing law, which matter most for foreign providers. The usual mistake is accepting a liability cap or a force majeure clause so wide that the provider bears little real consequence.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which contract provision gives a bank, its auditors and its supervisors the right to inspect a provider's operations and records to verify compliance and controls?

  1. Confidentiality clauseWhy not: Protects information from disclosure; it does not grant inspection rights.
  2. Service level agreementWhy not: Sets measurable performance targets; it does not by itself give any right to inspect the provider's records.
  3. Indemnification clauseWhy not: Allocates compensation for losses; it gives no right to verify compliance or controls.
  4. Audit and access rights - correct

Audit and access clauses let the bank and its supervisors examine the provider, which is essential to oversight and to supervisory reviews.

A harder one

A bank outsources payment processing and finds that the draft contract is silent on the provider's disaster recovery. Which addition best addresses the gap?

  1. A confidentiality clause covering all bank data held by the provider, including a requirement that the provider encrypt every record it stores or processes on the bank's behalf.Why not: Protects data from disclosure but does nothing to restore service after an outage.
  2. A broad force majeure clause excusing the provider from liability for any service interruption.Why not: Moves in the opposite direction: it would weaken the provider's recovery obligations.
  3. A duty to maintain and test business continuity and disaster recovery plans, share the results, meet recovery times aligned with the bank's needs, and notify the bank of incidents. - correct
  4. A right to terminate only after one year of continuous poor performance.Why not: A slow exit right is not a continuity measure and does not oblige the provider to plan or test recovery.

Continuity needs specific obligations on planning, testing, recovery times and notification. Confidentiality or termination terms do not secure continuity of the service.

The hardest tier

A bank outsources processing to a provider based in another country, which will handle customer data in a third country through a subcontractor. Which set of contract provisions is most important to address this arrangement?

  1. Governing law of the provider's country only, with ownership of processed data vested in the provider.Why not: Gives away the legal position and data control, exactly the cross-border risks the contract should manage.
  2. Fee caps, volume discounts and service levels, since legal and data issues fall to the provider to manage.Why not: Focuses on price and performance and leaves cross-border legal and data risks unaddressed.
  3. A ban on subcontracting plus a confidentiality clause, leaving out regulator access because foreign regulators cannot be bound.Why not: Omits supervisory access, which the bank needs, and uses a blanket ban instead of managed subcontracting.
  4. Governing law and dispute resolution acceptable to the bank, ownership and location of data, regulator and audit access to records, and subcontracting approval with obligations flowing down. - correct

Cross-border processing raises legal, data and supervisory-access issues. The contract must fix governing law, data ownership and location, access rights, and flow-down of terms to subcontractors.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Guidance on Managing Outsourcing Risk