ECB Advises Banks To Be Vigilant About Outsourcing Risks

The European Central Bank (ECB) has issued a warning to banks. The ECB stated that banks must improve their management of outsourcing risk, with a high concentration on the use of personal data.

ECB Advices Financial Entities To Address Vulnerabilities

In line with its regulatory focus for 2024, the ECB stated that institutions must tackle susceptibilities arising from their growing operational dependence on third-party vendors.

To strengthen its endeavors, the central bank has distributed the highlights of last year’s data collection activity to every supervised bank.

This information revealed that there was an increase in the number of outsourcing contracts for the past few years. There was also a surge in the amount budgeted by banks for their outsourcing tactics, particularly for the outsourcing of crucial functions.

Despite the increasing number of external vendors rendering their services in the EU, over 30% of the overall outsourcing budget of top banks is focused on 10 vendors.

While Information Technology is rife, over 80 top banks outsource administrative and critical payment services, and a majority of the banks outsource several of their investment and lending services.

Of the entire contracts with external vendors covering crucial functions, approximately 50% are related to time-critical activities. About 20% cannot be Reincorporated in the financial entities in case a problem arises, and approximately 5% cannot be replaced.

Cloud Service Seeks To Adopt Outsourcing Strategies in Banking

The ECB highlighted that the nation from which the services are provided along with the third-party service providers’ headquarters can be an additional risk driver for the bank. The team emphasized that approximately 73 notable institutions are leveraging critical services, offered by non-EU nations.

Additionally, about 22% of all extra-group and outsourced critical services are provided by non-EU nations, mostly from the United States and the United Kingdom, but also from India and Switzerland.

An associated observation is banks’ escalating interest in services offered in the cloud. Moreover, most notable institutions leverage cloud services, with most of its providers situated beyond the EU. Cloud service incorporate about 15% of all outsourcing contacts.

Concerning the strict data protection guidelines provided by the EU, the ECB expressed certainty about securing personal data. The ECB noted that while 70% of outsourcing contracts involve personal information, over 70% of notable banks outsource such important services to providers beyond the EU.

Additionally, while investigating the bank’s risk control, the ECB found out that over 10% of contracts encompassing critical services are not compliant with the related rules.