The AFM’s investigation on outsourcing activities

What is this about?

On 28 November 2019, the Dutch Authority for the Financial Markets (AFM) provided feedback about its investigation at 300 investment firms, AIFMs and UCITS management companies on the risks of outsourcing certain activities.

The investigation focused on the control measures that these firms must implement if they decide to outsource any activities.

The AFM published a letter in which it elaborates on the key findings of the investigation, which is discussed in this client briefing.

Which parties should care?

The feedback of the AFM is relevant for investment firms, AIFMs and UCITS management companies that outsource activities.

What should they do?

These firms should consider the outcomes of the investigation, as included in the final report and letter published by the AFM.

Risks

The AFM points out that outsourcing brings about the following risks:

• Inherent risks. A higher degree of outsourcing leads to further dependency on third parties, where a lower degree of outsourcing leads to lower quality. The AFM concludes that, generally speaking, there is no increased inherent risk at a (financial) sector level.

• Concentration risks. The AFM concludes that the fact that a large number of firms depend on a few specialised firms, does not amount to a significant risk.

• Management risks. Management risks will arise if firms do not (or not adequately) take necessary control measures. The AFM concludes that the majority of the firms investigated do have in place relevant measures, but that in some cases those measures are implemented inadequately. 

Clarification on outsourcing rules

The results of the investigation indicate that for some firms that are involved in the outsourcing process, it remains unclear which rules apply. The AFM aims to provide clarity by:

• Giving examples of activities that amount to outsourcing. The AFM points out that the starting point is that when third parties carry out functions that are usually carried out by the relevant firm this amounts to outsourcing. Examples are the compliance function, investment advice or advice on the development of the value of model-portfolios which will be adopted without any alterations.

• Stating that provisions of applicable legislation constitute a clear guideline when implementing control measures. For example, UCITS management companies must comply with the Dutch Financial Supervision Act (Wft) and the Market Conduct Supervision Decree (Bgfo), whereas investment firms and AIFMs must also comply with delegated Regulations.

• Clarifying (some) specific outsourcing rules by providing six items that firms must focus on:

  • identifying, analyzing, monitoring and controlling the relevant outsourcing risks;

  • implementing adequate outsourcing policies, which should be assessed and, if necessary, modified from time to time;

  • implementing an adequate selection procedure in relation to the selection of potential outsourcing partners. Such procedure enables the outsourcing firm to verify whether the potential partner meets all the necessary requirements, including compliance with the licensing requirement and the requirement to have in place an adequate business operation;

  • entering into a (written) agreement with the third party performing the outsourced activities, which agreement should include provisions on reporting obligations, escalation schemes and exit-procedures;

  • implementing an adequate policy on the possible conflict of interests, which covers all the third parties to which the activities will be outsourced; and

  • preserving an independent position in relation to the third party performing the outsourced activities by keeping its own expertise and the supervision on that third party up to date.

When does this become relevant?

The risks and control measures related to outsourcing activities in the financial sector apply continuously and should therefore be taken into account any time. Furthermore, the AFM intends to consult industry bodies to further specify and narrow the focus points as mentioned above.

Any further thoughts?

The AFM stated that the supervision on outsourcing will increase in the near future because the investigation made clear that this subject is of relevance for the entire financial sector.

The letter published by the AFM is available here (in Dutch).