ECB Urges Vigilance Among Banks Regarding Outsourcing Risks

The European Central Bank (ECB) is warning financial institutions to improve their management of outscoring risk, particularly on the processing of personal information.

As part of 2024 managerial priorities, the ECB highlights the necessity of institutions in addressing vulnerabilities. These exposures rise from their growing operational dependence on third-party providers, considering the rising complexity of supply chains and potential risks associated with concentration.

ECB Emphasizes Urgency For Banks To Address Outsourcing Risks

To reinforce its initiative, the ECB has publicly listed a 2023 data collection exercise shared across all supervised banks. This showcases a significant increase in the number of outsourcing contracts over recent years. As well as the amount allocated by banks for their outsourcing approach, particularly for the outsourcing of crucial operations.

Despite an increasing number of services offered by external providers within the EU, over 30% of the total outsourcing budget of top banks is focused on ten providers. According to the report, most of the banks are headquartered outside the EU.

Although IT-related outsourcing is common, over 80 top banks outsource administrative and critical payment services, with over half of the banks outsourcing certain of their investment and lending services.

Of all agreements with external providers encompassing crucial operations, approximately 50% pertain to time-critical functions. Moreover, about 29% cannot be reintegrated by the banks in the event of issues, and about 5% cannot be replaced, especially through other providers.

ECB Raises Concerns Over Outsourcing Risks And Data Protection

ECB noted that the country from which the third-party service providers are provided and the location of the service headquarters can be additional risk drivers for banks.

A total of 73 major institutions are utilizing critical services offered by countries outside the EU. About 22% of the overall outsourced critical and extra-group services are provided by non-EU nations, mainly from the United States and the United Kingdom, as well as India and Switzerland.

And there is an increasing interest in banks’ services offered in the cloud. Nearly all top institutions utilize cloud services, with most of the providers situated outside the EU. Moreover, cloud services account for about 15% of overall outsourcing contracts.

Given the strict data protection regulations in the EU, the ECB reported that 70% of outsourcing contracts entail the processing of personal information, with over 79% of major banks outsourcing such critical operations to providers located outside the EU.