Article 35 — Outsourcing

Financial servicesLevel 1RegulationEMIRIn forceVerifiedOfficial source

1.Where a CCP outsources operational functions, services or activities, it shall remain fully responsible for discharging all of its obligations under this Regulation and shall ensure at all times that:

Copy link

35(1)(a)

(a)outsourcing does not result in the delegation of its responsibility;

Copy link

35(1)(b)

(b)the relationship and obligations of the CCP towards its clearing members or, where relevant, towards their clients are not altered;

Copy link

35(1)(c)

(c)the conditions for authorisation of the CCP do not effectively change;

Copy link

35(1)(d)

(d)outsourcing does not prevent the exercise of supervisory and oversight functions, including on-site access to acquire any relevant information needed to fulfil those mandates;

Copy link

35(1)(e)

(e)outsourcing does not result in depriving the CCP from the necessary systems and controls to manage the risks it faces;

Copy link

35(1)(f)

(f)the service provider implements equivalent business continuity requirements to those that the CCP must fulfil under this Regulation;

Copy link

35(1)(g)

(g)the CCP retains the necessary expertise and resources to evaluate the quality of the services provided and the organisational and capital adequacy of the service provider, and to supervise the outsourced functions effectively and manage the risks associated with the outsourcing and supervises those functions and manages those risks on an ongoing basis;

Copy link

35(1)(h)

(h)the CCP has direct access to the relevant information of the outsourced functions;

Copy link

35(1)(i)

(i)the service provider cooperates with the competent authority in connection with the outsourced activities;

Copy link

35(1)(j)

(j)the service provider protects any confidential information relating to the CCP and its clearing members and clients or, where that service provider is established in a third country, ensures that the data protection standards of that third country, or those set out in the agreement between the parties concerned, are comparable to the data protection standards in effect in the Union.

Copy link

A CCP shall not outsource major activities linked to risk management unless such outsourcing is approved by the competent authority.

35(2)

2.The competent authority shall require the CCP to allocate and set out its rights and obligations, and those of the service provider, clearly in a written agreement.

Copy link

35(3)

3.A CCP shall make all information necessary to enable the competent authority to assess the compliance of the performance of the outsourced activities with this Regulation available on request.

Copy link