MORNBFI Vol. 1 - Planters Development Bank

APP. Q-3709.12.31DUTIES AND RESPONSIBILITIES OF BANKS AND THEIR DIRECTORS/OFFICERSIN ALL CASES OF OUTSOURCING OF BANKING FUNCTIONS[Appendix to Sec. 4162Q (2008 - 4192Q), 4190S, 4190P and 4190N]a. When outsourcing of bankingfunctions is allowed by law, banks shall:(1) Carry out the same in accordancewith proper standards, ensuring theintegrity of the data, systems and controlsof the banks and subject to thesupervisory, regulatory and administrativeauthority of the BSP over the banks andtheir directors/officers;(2) Be responsible for the performancethereof in the same manner and to the sameextent as it was before the outsourcing;(3) Comply with all laws andregulations governing the quasi-bankingactivities/services performed by thequalified service providers in its behalf suchas, but not limited to, keeping of recordsand preparation of reports, signingauthorities, internal control and clearingregulations; and(4) Manage, monitor and review on anongoing basis the performance by thequalified service providers of the outsourcedbanking activities/services.b. Prohibition against outsourcingcertain banking functions. No bank orany director, officer, employee, or agentthereof shall outsource inherent bankingfunctions.For purposes of this Section,outsourcing of inherent banking functionsshall refer to any contract between the bankand a service provider for the latter tosupply, or any act whereby the lattersupplies, the manpower to service thedeposit substitute transactions of theformer.Banks cannot outsource managementfunctions except as may be authorized bythe Monetary Board when circumstancesjustify.c. Outsourcing of informationtechnology systems/processes. Subject toprior approval of the Monetary Board,banks may outsource all informationtechnology systems and processes exceptfor functions excluded in Item “1”.(1) Certain functions affecting the abilityof the bank to ensure the fit of technologyservices deployed to meet its strategic andbusiness objectives and to comply with allpertinent banking laws and regulations, suchas, but not limited to, strategic planning forthe use of information technology;determination of system functionalities;change management inclusive of qualityassurance and testing; service level andcontract management; and security policyand administration, may not be outsourced.Subject to prior approval of the MonetaryBoard and submission of the samedocumentary requirements in Item “(2)”hereof, consultants and/or service providersmay be engaged to provide assistance/support to the bank personnel assigned toperform such functions.(2) Documentary requirements. Abank intending to outsource informationtechnology systems and processes shallsubmit the following documents to BSPwhich shall treat the same as strictlyconfidential:(a) Proposed contract between thebank and the service provider whichshould, at a minimum, include all thefollowing:(i) Complete description of the work tobe performed or services to be provided;(ii) Fee structure;(iii) Provisions regarding on-linecommunication availability, transmissionline security, and transaction authentication;Manual of Regulations for Non-Bank Financial InstitutionsQ RegulationsAppendix Q-37 - Page 1