DRAFT. Classification: Restricted. Prepared with corp-reg-change v1.0.0. Not signed off.
Outsourcing Guideline, Amendment 2. Meridian Prudential Authority. Final, issued 2 October. Starts 1 July, no transition [S1 para.1].
Bottom line
Material outsourcing must now have a tested exit plan, and the authority must be told 20 business days before signing rather than 10. First date that matters: any contract signed from 1 July.
What the rule changes
| Topic | Earlier | New |
|---|---|---|
| Notice to authority | 10 business days [S1 para.12, as struck out] | "must notify at least 20 business days before signing" [S1 para.12] |
| Exit plan | "should maintain" [S1 para.18, as struck out] | "must maintain and test at least annually" [S1 para.18] |
Does it apply to us
Applies: the guideline covers all authorised banks [S1 para.2]. Final call: Head of Compliance.
Affected areas
Outsourcing Policy v6 sections 4 and 7 [S2]. Three contracts on the material list [S3]. System changes: none shown in the sources.
Gap assessment
| Requirement | Current position | Gap |
|---|---|---|
| 20-day notice | Policy says 10 days [S2 s.4.2] | Yes |
| Annual exit test | Exit plans required; testing not mentioned [S2 s.7] | Yes |
| Test records for three material contracts | No source supplied | Unknown |
Actions
| Action | Owner | Due |
|---|---|---|
| Amend Policy v6 s.4.2 and s.7 [PROPOSED] | Head of Third-Party Risk | 31 March |
| Confirm exit-test status for three contracts [PROPOSED] | Contract owners | 28 February |
Open questions
Does "test" require a live failover, or is a desktop exercise enough? For counsel, then the authority.
Sources. S1 Amendment 2. S2 Outsourcing Policy v6. S3 Material contracts list.
Sign-off. Head of Compliance: ____ Chief Risk Officer: ____