New Bank of Portugal Notice no. 8/2023 on the register and communication to the Bank of Portugal of outsourcing agreements

Outsourcing of functions entails risks which, in the case of credit, payment and electronic money institutions assume increased relevance since, particularly when critical or important functions are involved, they may pose a threat to the stability of financial markets if the subcontracted functions are not adequately monitored by the subcontracting institutions.

In this regard, the European Banking Authority had already published the EBA/GL/2019/02 Guidelines of 25 February, which were accepted and disseminated by the Bank of Portugal to the institutions by Bank of Portugal Circular Letter no. CC/2019/00000065 of 15 October 2019.

It is in this context that Banco de Portugal Notice no. 8/2023 (the “Notice“) was published on 18 December and came into force on the following day, 19 December 2023. This Notice aims to simplify the regulatory framework and contribute to the standardisation of procedures and requirements applicable to supervised institutions, while strengthening the Bank of Portugal’s supervisory powers. To this end, it establishes the minimum requirements to be included in the records of information on outsourcing agreements and the model to be followed for communicating this information to the Bank of Portugal.

The Notice applies to:

• credit institutions with their head offices in Portugal, except those considered significant by Regulation 1024/2013 of the European Parliament and of the Council;
• payment institutions;
• electronic money institutions; and
• branches with registered offices in countries that are not Member-States, authorised to operate in Portugal.

Registration is required not only for outsourcing agreements executed after the Notice came into effect but also for all existing outsourcing agreements and those that concluded within the past 12 months.

The register must include all outsourcing agreements, including those relating to functions outsourced to entities within the same group.

The information to be included in this register is in Annex I of the Notice and the Bank of Portugal may, at any time, ask the Entities to provide either the complete register or particular sections of it. Information on the outsourcing of internal control functions must also be included in the register. In accordance with Bank of Portugal Notice no. 3/2020, the subcontracted tasks, the entities providing the service, the level of criticality and the place where the service is provided must be identified and described.

In addition to the obligation to make this register available to the Bank of Portugal whenever requested, there is an obligation to notify the Bank of Portugal of the intention to subcontract critical or important functions, which must be done at least 15 working days before the outsourcing agreement is signed. Communication is also mandatory and must be immediate when the outsourced functions become critical or important. These communications will always be accompanied by a legal opinion either confirming compliance with the European Banking Authority Guidelines (EBA/GL/2019/02) or justifying non-compliance with any of the provisions contained in these Guidelines.

All these communications to the Bank of Portugal must be made through the “Prudential Supervision – Reports” feature of the BPnet system and the format in which they must be made is set out in Annex II to this Notice.