APRA Prudential Standard CPS 231 Outsourcing

This Prudential Standard requires that all outsourcing arrangements involving material business activities entered into by an APRA-regulated institution and a Head of a group be subject to appropriate due diligence, approval and ongoing monitoring. All risks arising from outsourcing material business activities must be appropriately managed to ensure that the APRA-regulated institution, or the group it heads, is able to meet its financial and service obligations to its depositors and/or policyholders.

The Board of an APRA-regulated institution and the Board of a Head of a group, respectively, have ultimate responsibility for the outsourcing policy of the institution or group.

The key requirements of this Prudential Standard are that an APRA-regulatedinstitution and a Head of a group must:

• maintain a policy, approved by the Board, relating to outsourcing of material business activities;
• have sufficient monitoring processes in place to manage the outsourcing of material business activities;
• for all outsourcing of material business activities with third parties, have a legally binding agreement in place, unless otherwise agreed by APRA;
• consult with APRA prior to entering into agreements to outsource material business activities to service providers that conduct their activities outside Australia; and
• notify APRA after entering into agreements to outsource material business activities.

Where an APRA-regulated institution is the Head of a group, this Prudential Standard requires that any outsourcing arrangements involving material business activities entered into by members of the group must be subject to appropriate due diligence, approval and ongoing monitoring, and the provisions of this Prudential Standard are
applied appropriately throughout the group, including in relation to institutions that are not APRA-regulated. In addition, where specified, the Head of a group must comply with the requirements on a group basis.