Banks remain responsible when cooperating with third parties

Banks increasingly work with third parties

The banking sector is becoming more open. First of all, banks outsource parts of bank activities to specialised parties, ranging from mortgage administration to payment processing for account holders. The use of specialised parties may lead to improved cost efficiency and thus eventually result in lower prices for banking services. A case in point of this trend is that banks are increasingly adopting cloud computing for various IT services such as data storage and processing capacity. The number of cloud computing outsourcing agreements reported to DNB tripled to almost 180 between 2015 and 2017.

Secondly, banks are increasingly partnering with innovative market players. Increased openness of the banking sector – also spurred on by the introduction of PSD2 – offers opportunities for technological innovations to improve banking services. For instance, artificial intelligence applications may shorten the processing time of loan applications and offer consumers digital budget planners to gain more insight in their finances. A more open banking sector thereby contributes to more user-friendliness and efficiency improvements in services to consumers and companies.

Banks remain accountable for risks

At the same time, banks remain responsible for the activities and processes that are needed to supply their products and services to the consumer. This applies regardless of whether activities are carried out in partnership or fully performed by a third party, as is the case with outsourced IT infrastructure or purchased risk models. The management boards of banks cannot transfer accountability for the risks to third parties, i.e. they are not allowed to become "empty shells." This means banks at least have to know who they are working with, which risks they are exposed to and whether they are able to monitor and control these risks on an ongoing basis. Banks also need to have sufficient knowledge and devote attention to assessing the quality of services delivered by third parties, especially if innovative technologies are being used.

Outsourcing may also give rise to “single points of failure”, for example if multiple banks outsource critical processes to a single party. If such a party ends up in trouble, it may jeopardise continuity of services for several institutions at the same time. This would undermine confidence in the financial sector, even more so if vital functions are affected such as the payment system. Concentration risks could increase even further if banks outsource activities to parties that in turn are reliant on the same service providers.

Supervisors map concentration risks

Together with the other European supervisory authorities, DNB will systematically identify where outsourcing results in the build-up of potential concentration risks. Under new EBA guidelines to be introduced in mid-2019, banks will be obliged to register all outsourcing, which will enable DNB to monitor the concentration rate of service providers at a national level. Concentration at specific service providers may also prompt international investigation if these institutions could be regarded as too big to fail or if it would be desirable to supervise them. This requires a coordinated international approach, as it concerns cross-border services, and concentration risks are therefore global risks.