March 2, 2007 - Hong Kong

Hong Kong: Outsourcing Obligations in Hong Kong

"Outsourcing" is defined as an event in which the regulated financial services firm (the "outsourcing entity"), contracts with a service provider to perform any aspect of the outsourcing entity's regulated or unregulated functions that could otherwise be undertaken by the entity itself.

The service provider may be a related party within a corporate group, or an unrelated third party entity.

The SFC has not published any Hong Kong specific guidelines on outsourcing, however, in a press release dated 16 February 2005, their representative endorsed the Principles on Outsourcing of Financial Services for Market Intermediaries ("the Principles") which was published by the International Organisation of Securities Commissions (IOSCO) in February 2005 for creating, "a framework that will assist regulated entities in determining the steps they should take when considering outsourcing activities."

The Principles stress the importance of proper due diligence in the selection and monitoring of the service provider and recommend certain provisions that should be included in the contract with the outsourcing service provider. They also stress a need to ensure there are mechanisms in place to protect IT security, preserve client confidentiality, maintain business continuity, and grant a right for the regulator and the outsourced entity to retain access to books and records.

IOSCO recommends the Principles be applied, in whole or in part, according to the degree of materiality of the outsourced activity to the ongoing business of the outsourcing firm and its regulatory obligations.

It is important to remember that the outsourcing firm and its management retain full legal liability and accountability to its clients and regulators for all functions that the firm may outsource to a third party, to the same extent as if these functions were performed in-house.

In recent cases, where a new SFC licence applicant declares that certain business, technical and operational services will be outsourced, whether to third parties or internally, the SFC has asked the applicant to provide a formal undertaking, in favour of the SFC, that it will meet certain obligations, in relation to the outsourcing that it is intending to put in place. At of the time of writing, there was no indication from the SFC, on whether these undertaking requirements will be applied more broadly.