What rules apply when an investment firm outsources critical or important functions?

A function is critical or important where poor performance or a breakdown would materially weaken the firm's ability to keep meeting its authorisation conditions and other obligations, its financial results, or the soundness or continuity of the services it provides.

Two groups are excluded. The first is advisory services and other services that are not part of the firm's investment business, such as legal advice, training of staff, billing, and guarding the firm's premises and people. The second is buying standardised services, for example market information or price feeds. These are not treated as critical or important functions, so the extra conditions for outsourcing critical or important functions do not apply to them.

The firm remains fully responsible for all its obligations. The outsourcing may not result in senior management delegating its responsibility, may not change the firm's relationship with and obligations to its clients, and may not undermine or alter the conditions of its authorisation. Law 87 adds that the firm must take reasonable steps to avoid undue additional operational risk and must not materially impair the quality of its internal control or CySEC's ability to supervise it.

The firm must use due skill, care and diligence in choosing and managing the provider, which must have the ability, capacity, resources, organisation and any authorisation needed to do the work reliably and professionally. The firm keeps enough know-how and resources in-house to oversee the outsourced function and manage the risks, can terminate the arrangement with immediate effect when that is in its clients' interests without harming continuity, and ensures cooperation with the authorities, access to data and premises for itself, its auditors and CySEC, confidentiality, and tested contingency and backup plans.

Rights and obligations are set out in a written agreement that keeps the firm's rights to give instructions, terminate, obtain information, inspect, and enter premises and see the books. The provider may sub-outsource only with the firm's written consent. Within a group, the firm may take into account how far it controls or influences the provider. CySEC can ask for all the information it needs about outsourced activities.

Outsourcing functions related to portfolio management for clients to a provider outside the EU is allowed only if the provider is authorised or registered for that service in its home country and effectively supervised there, and an appropriate cooperation agreement exists between CySEC and that supervisor. The agreement must at least let CySEC obtain information on request, access relevant documents, learn promptly of breaches and cooperate on enforcement, and supervisors publish the list of such agreements.

Since 17 January 2025, ICT services, including outsourced ICT functions, are also governed by the Digital Operational Resilience Act. The firm remains fully responsible, keeps a register of all its contracts for ICT services, files it with CySEC every year by 28 February (reference date 31 December), informs CySEC in good time of planned contracts for ICT services that support critical or important functions, and includes the mandatory terms in all its ICT contracts, with additional terms for those supporting critical or important functions. Since October 2023 CySEC has also applied the European Banking Authority's outsourcing guidelines to CIFs subject to an initial capital requirement of €150,000 or €750,000.