MORNBFI Vol. 1 - Planters Development Bank

App. Q-5510.12.31c. Ensure that the EMNSP employs ahigh degree of professional care inperforming the outsourced activities as ifthese were conducted by the EMI itself.This would include, among others, makinguse of monitoring and control proceduresto ensure compliance at all times withapplicable BSP rules and regulations;d. Ensure that the EMNSP has anaccreditation process in the selection ofagents participating in the retail networkfor the conversion of cash to e-money andits monetization and that the EMNSP hasinstituted mechanism to manage sufficientliquidity in the system/network.e. Ensure that the EMNSP enforces aprogram that requires all cash-in and cashout agents under its network to undergoAML trainings and re-trainings every two(2) years; andf. Comply with all laws and BSP rulesand regulations covering the activitiesoutsourced to the EMNSP, especially oncompliance with anti-money laundering(AML) requirements.V. Due diligence and continuingoperational review. Prior to entering intoan outsourcing arrangement with anEMNSP, an EMI should conductappropriate due diligence review to assessthe capability of an EMNSP in performingthe service to be outsourced. The duediligence should take into considerationboth qualitative and quantitative factorsaffecting the performance of theoutsourced service, such as the financialcondition and results of operation for theprevious year/s, risk managementpractices, technical expertise whichinvolve monitoring the velocity ofe-money transactions and aggregation ofmonthly limits, among others, marketshare, reputation (both the company andits stockholders) and compliance withanti-money laundering requirements andBSP rules and regulations.An EMI should make sure that theEMNSP adheres to international standardson IT governance, information security, andbusiness continuity in the performance ofits outsourced activities. An EMI shouldendeavor to obtain independent reviews andmarket feedback on the EMNSP tosupplement its own findings.Operational review by an EMI of theEMNSP should be undertaken at least onan annual basis as part of riskmanagement. This review should bedocumented as part of an EMI’smonitoring and control process.VI. Delineation of responsibilities.The EMI and EMNSP shall identify,delineate and document theresponsibilities and accountabilities ofeach party as regards the outsourcingarrangement, including planning forcontingencies. Notwithstanding anycontractual agreement between an EMIand an EMNSP on the sharing ofresponsibility, the EMI shall be responsibleto its customers, without prejudice to furtherrecourse, if any, by the EMI to the EMNSP.VII. Confidentiality and security. AnEMI should review and monitor the securitypractices and control processes of theEMNSP on a regular basis, includingcommissioning or obtaining periodic expertreports on adequacy of security to maintainthe confidentiality and integrity of data,and compliance with internationallyrecognizedstandards in respect to theoperations of the EMNSP. Consideringthat the EMNSP may service more thanone EMI, the EMI should ensure thatrecords pertaining to its transactions aresegregated from those of other EMIs.The EMI and EMNSP shall identifycircumstances under which each party hasthe right to change securityrequirements. An EMNSP should berequired to report immediately anysecurity breaches to the EMI.App. Q-55 - Page 2Manual of Regulations for Non-Bank Financial Institutions