- know which jurisdictions the service provider’s business premises are located in (including all locations from which data may be accessed) and how that affects the Firm’s outsourcing arrangements. Firms may wish to consider placing limitations on countries from which the service may be provided and potentially reserve the right to object to any changes or to require changes if political circumstances in a particular country change adversely, thereby increasing risk;

- identify all service providers related to the regulated activity being provided in the supply chain and ensure that the regulatory requirements on the Firm can be complied with throughout the supply chain;

- monitor ‘concentration risk’ (ie the risk presented by many competitors using the same service provider and technology) and consider what action it would take if the Firm’s service provider failed.

Oversight of service provider and data security

Firms should:

- be clear about the service being provided and where responsibility and accountability between the Firm and its service provider begins and ends;

- consider how data will be segregated (if using a public cloud);

- take appropriate steps to mitigate security risks so that the Firm’s overall security exposure is acceptable;

- consider data sensitivity and how the data is transmitted, stored and encrypted, where necessary;

- follow the Guidance on the use of cloud computing from the Information Commissioner’s Office (“ICO”);

- where relevant, also consult the ICO’s Guidance on sending personal data outside the European Economic Area;

- comply with the Data Protection Act 1998 (“DPA”). Although not set out in the FCA Guidance, note in particular:

- the DPA requires any Firm (since they will, without exception, be data controllers) to have a written contract with the data processor service provider with a requirement that the “data processor is to act only on instructions from the Firm” and that “the data processor will comply with security obligations equivalent to those imposed on the Firm”;

- the Firm must take “appropriate technical and organisational measures against the unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data”. The contract must therefore require the same commitment from service providers;

- reasonable steps must be taken by the Firm to ensure compliance with those commitments. In practice this means a right of audit although the ICO does explicitly recognise that audits by each and every customer in a cloud context are impractical and that a single independent audit organised by the service provider may be sufficient if it enables a Firm to make an informed choice as to whether the security measures are appropriate. This express recognition of the value of a single independent audit seems sensible. However, similar recognition is not present in the FCA Guidance (see below) and arguably it does not remove the obligation to reserve additional, specific audit rights;

- under the DPA, the definition of “processing” is incredibly broad and includes not just holding information but also simply “consulting or using data”.

Effective access to data

Firms should ensure that:

- notification requirements on accessing data are reasonable and not overly restrictive;

- there are no restrictions on the number of requests the Firm, its auditor or the regulator can make to access or receive data;

- ensure that data is not stored in jurisdictions that may inhibit effective access to data for UK regulators.

Access to business premises/rights of audit

Firms should ensure that:

- contracts allow for access by the Firm, including physical assess, to business premises which are relevant for the exercise of effective oversight of the service provider. This right should not be restricted. Such access does not necessarily include access to all business premises but may include head offices and operations centres. Service providers may, for legitimate security reasons, limit access to some sites – such as data centres. However, the business premises most likely to be relevant to the exercise of effective oversight will be the service provider’s data centre(s), many of which will be used for several customers who will all want to ensure their data is secure.

It has been suggested this could therefore be onerous and impractical for the service provider to comply with but the FCA does not consider it appropriate to seek to narrow the scope of this requirement and by specifying a Firm should be able to request an ‘onsite’ visit, the FCA does not appear to be willing to accept remote access to data as meeting the regulatory duty.

- regulator access to the service provider’s premises is permitted if the regulator deems it necessary and it is required under applicable legal and regulatory requirements.

Note:

- A Firm can be required to provide reasonable prior written notice of a visit but not when there is an emergency or crisis situation (ie notice cannot be required in all circumstances).

- A Firm may elect for its auditor to undertake the visit. This must not be an auditor appointed by the service provider. Service providers can make sure that they reserve the right to object to the identity of the auditor on reasonable grounds.

- The service provider should commit to cooperate with the reasonable requests of the regulator during such a visit.

- The regulator can commit to visits occurring during business hours and at a time specified by the service provider or with reasonable notice, except in an emergency or crisis situation.

- The regulator should be permitted to view the provision of services to the Firm.

- The regulator can commit to minimising disruption to the service provider’s operations.

- The FCA Guidance does not contain the same provision as in the ICO’s Guidance referred to above regarding a single independent audit organised by the service provider. However, even if it did, it is likely (given the broad nature of the statements above and the lack of clarity over the inter-relationship between the FCA Guidance and that from the ICO), that the Firm would still want to reserve additional audit rights both for itself and its regulators where ‘necessary’, particularly in an ‘emergency or crisis’ (eg if it has suspicions about a loss of, or unauthorised access to, data).

Continuity and business planning

Firms should:

- document their strategy for maintaining continuity of their operations, including recovery from an event, and their plans for communicating and regularly testing the adequacy and effectiveness of this strategy;

- regularly update and test arrangements to ensure their effectiveness;

- put in place arrangements to ensure the regulator has access to data in the event of insolvency or other disruption.

Note: In practice this means that similar obligations must be imposed in contracts with service providers. There must also be a commitment from service providers to update and test their business continuity plans relevant to the services in issue (and report back to the Firm on the outcome of such tests) on a regular basis.

Resolution (where applicable)

The ‘resolution’ regime applies when a Firm is failing (ie insolvent) or is likely to fail. Assessment of this is made by the FCA. The Bank of England has a framework available to it to ‘resolve’ failing Firms. This includes using so-called ‘stabilisation powers’ which could mean that part or all of the business of a Firm could be compulsorily transferred to a solvent third party.

- and any subcontractor should agree that neither the entry into ‘resolution’ nor a subsequent change in control arising from the Firm’s entry into ‘resolution’ will constitute a termination event;

- should agree to continue to provide services to the Firm (or such other entity as necessary) for an appropriate transitional period following the ‘resolution’.

Note: Effectively these provisions place a constraint on the ability of a service provider to object in such circumstances to an assignment or to seek to terminate the contract early. Presumably the intent is that the service provider would be limited to a claim for damages. It is unclear what an ‘appropriate’ transitional period might be but arguably in most cases we suspect it would be at least six months. Presumably any contract could provide for the service provider to be able to claim any additional costs it incurs as a result of any such change or assignment.

Exit plan

Firms should:

- ensure that they are able to exit outsourcing plans, should they wish to, without undue disruption to their provision of services or their compliance with the regulatory regime;

- have exit plans and termination arrangements that are understood, documented and fully tested;

- know how they would transition to an alternative service provider and maintain business continuity;

- have a specific obligation on the service provider to cooperate fully with both the Firm and any new service provider(s) to ensure there is a smooth transition;

- know how they would remove data from the service provider’s systems on exit.

Note: A contractual requirement on the service provider to develop an exit plan at an early stage in the contractual relationship and update the same periodically is not untypical. Presumably any contract could entitle the service provider to compensation for any time spent providing co-operation.