Gulf region

SAMA Rules on Outsourcing; SAMA Cyber Security Framework (third party cyber security)

Banks licensed by SAMA, under the SAMA Rules on Outsourcing (15 December 2019); finance companies under separate SAMA Rules on Outsourcing for Finance Companies; insurers are supervised by the Insurance Authority, with existing SAMA insurance rules in place until it replaces them.

SAMA’s outsourcing rules expect a board-approved outsourcing policy, a materiality assessment, due diligence on the provider and a written agreement. Material outsourcing needs SAMA’s written no-objection, applied for at least 15 business days ahead for domestic banks and 30 days for foreign banks, and any outsourcing to a provider outside the Kingdom also needs SAMA’s written no-objection. The SAMA Cyber Security Framework covers third party cyber security in section 3.4: contract and vendor management, outsourcing and cloud computing. Review data location, confidentiality, business continuity and exit against the applicable rules.

Trestec connects the provider record, assessment, evidence and contract review. You can record each regime against the entity it applies to; rules specific to each regulator are being added. Check the current rulebook before relying on dates and references.

CBUAE Outsourcing Regulation for Banks and accompanying Standards; DFSA General Module (GEN) outsourcing rules in DIFC; FSRA General Rulebook (GEN) outsourcing rules and guidance in ADGM

All banks operating in the UAE, under the CBUAE Outsourcing Regulation for Banks; Authorised Firms in the DIFC regulated by the DFSA; Authorised Persons in ADGM regulated by the FSRA.

Each regime is separate. The CBUAE Outsourcing Regulation for Banks and its Standards (Circular No. 14/2021) set expectations on governance, materiality, due diligence, agreements, data, business continuity and exit. Material outsourcing needs the CBUAE’s prior non-objection, and customers’ confidential data may not leave the UAE without CBUAE approval and customer consent. In the DIFC, an Authorised Person stays responsible for outsourced functions and must inform the DFSA about any material outsourcing arrangement (DFSA GEN 5.3.21 to 5.3.22); the contract must give the DFSA access to information and premises. In ADGM, the FSRA General Rulebook sets outsourcing rules, including within a group (GEN 3.3.31 to 3.3.32) Check notice timing with your regulator..

Trestec connects the provider record, assessment, evidence and contract review. You can record each regime against the entity it applies to; rules specific to each regulator are being added. Check the current rulebook before relying on dates and references.

QFCRA rules for firms in the Qatar Financial Centre; Qatar Central Bank instructions to banks and financial institutions on outsourcing

QFCRA-authorised firms in the Qatar Financial Centre, and banks and financial institutions regulated by Qatar Central Bank.

Treat the Qatar Financial Centre and Qatar Central Bank regimes separately. Both expect governance and accountability for outsourced functions, assessment of material outsourcing, due diligence and written agreements that preserve access for the firm and the regulator. In the QFC, outsourcing sits within the QFCRA’s Governance and Controlled Functions Rules 2020 (CTRL). Qatar Central Bank may require approval before outsourcing certain activities, and has issued a cloud computing regulation. Review data location and confidentiality requirements, including any restrictions on processing data outside Qatar Check notice periods, approval and data location rules with your regulator..

Trestec connects the provider record, assessment, evidence and contract review. You can record each regime against the entity it applies to; rules specific to each regulator are being added. Check the current rulebook before relying on dates and references.

CBB Rulebook, outsourcing requirements in the operational risk management module of the relevant volume

CBB licensees, including conventional and Islamic banks, insurance licensees and investment business firms, under the volume that applies to their licence. For banks, the rules sit in Module OM (Operational Risk Management), Chapter OM-3; other volumes place them differently.

The CBB Rulebook sets outsourcing requirements covering the outsourcing policy, board oversight, risk assessment, due diligence, outsourcing agreements, access for the CBB and auditors, business continuity and exit. Material outsourcing needs the CBB’s prior written approval (the CBB aims to respond within six weeks), and non-material outsourcing needs prior written notification. Material intragroup outsourcing needs approval at least six weeks before commitment. Outsourcing outside Bahrain may attract specific conditions, and some functions may not be outsourced Check restricted functions and offshore conditions with the CBB..

Trestec connects the provider record, assessment, evidence and contract review. You can record each regime against the entity it applies to; rules specific to each regulator are being added. Check the current rulebook before relying on dates and references.