Pursuant to Monetary Board Resolution No. 2076 dated November 24, 2000, the following rules and regulations are hereby issued to implement Section 55.1(e) of Republic Act (R.A.) No. 8791, the General Banking Law of 2000.

SECTION 1.       Duties and Responsibilities of Banks and their Directors/Officers in All Cases of Outsourcing of Banking Functions. - When the outsourcing of banking functions is allowed by law and under this circular, all banks concerned shall:

(1)       carry out the same in accordance with proper standards, ensuring the integrity of the data, systems and controls of the banks and subject to the supervisory, regulatory and administrative authority of the Bangko Sentral ng Pilipinas (BSP) over the banks and their directors/officers;

(2)       be responsible for the performance thereof in the same manner and to the same extent as it was before the outsourcing;

(3)       comply with all laws and regulations governing the banking activities/services performed by the qualified service providers in its behalf such as but not limited to keeping of records and preparation of reports, signing authorities, internal control and clearing regulations; and

(4)       manage, monitor and review on an ongoing basis the performance by the qualified service providers of the outsourced banking activities/services.

SECTION 2.       Prohibition Against Outsourcing Certain Banking Functions. -

Section 2.1.         No bank or any director, officer, employee, or agent thereof shall outsource inherent banking functions. For purposes of this circular, outsourcing of inherent banking functions shall refer to any contract between the bank and a service provider for the latter to supply, or any act whereby the latter supplies, the manpower to service the deposit transactions of the former.

Section 2.2.         Banks cannot outsource management functions except as may be authorized by the Monetary Board when circumstances justify.

SECTION 3.       Outsourcing of Information Technology Systems/Processes . - Subject to prior approval of the Monetary Board, banks may outsource all information technology systems and processes except for functions excluded in Section 3.1.

Section 3.1.         Certain functions affecting the ability of the bank to ensure the fit of technology services deployed to meet its strategic and business objectives and to comply with all pertinent banking laws and regulations, such as but not limited to strategic planning for the use of information technology; determination of system functionalities; change management inclusive of quality assurance and testing; service level and contract management; and security policy and administration, may not be outsourced. Subject to prior approval of the Monetary Board and submission of the same documentary requirements in Section 3.2 hereof, consultants and/or service providers may be engaged to provide assistance/support to the bank personnel assigned to perform such functions.

Section 3.2.         A bank intending to outsource information technology systems and processes shall submit the following documents to BSP which shall treat the same as strictly confidential:

(1)     Proposed contract between the bank and the service provider which should, at a minimum, include all the following:

(a)     Complete description of the work to be performed or services to be provided;

(b)     Fee structure;

(c)     Provisions regarding on-line communication availability, transmission line security, and transaction authentication;

(d)     Responsibilities regarding hardware, software and infrastructure upgrades;

(e)     Provisions governing amendment and pretermination of contract;

(f)      Mandatory notification by the service provider of all systems changes that will affect the bank;

(g)     Details of all security procedures and standards;

(h)     Responsibility, fines, penalties and accountability of the service provider for errors, omissions and frauds;

(i)      Confidentiality clause covering all data and information; solidary liability of service provider and bank for any violation of R.A. No. 1405, the Bank Deposits Secrecy Law; actions that the bank may take against the service provider for breach of confidentiality or any form of disclosure of confidential information; and the applicable penalties;

(j)      Segregation of the data of the bank from that of the service provider and its other clients;

(k)     Disaster recovery/business continuity contingency plans and procedures;

(l)      Adequate insurance for fidelity and fire liability;

(m)    Ownership/maintenance of the computer hardware, software (program source code), user and system documentation, master and transaction data files;

(n)     Guarantee that the service provider will provide necessary levels of transition assistance if the bank decides to convert to other service providers or other arrangements;

(o)     Access to the financial information of the service provider;

(p)     Access of internal and external auditors to information regarding the outsourced activities/services which they need to fulfill their respective responsibilities;

(q)     Access of BSP to the operations of the service provider in order to review the same in relation to the outsourced activities/services;

(r)      Provision which requires the service provider to immediately take the necessary corrective measures to satisfy the findings and recommendations of BSP examiners and those of the internal and/or external auditors of the bank and/or the service provider; and

(s)     Remedies for the bank in the event of change of ownership, assignment, attachment of assets, insolvency, or receivership of the service provider.

(2)            Minutes of Meetings of the Board of Directors of the bank concerned signed by majority thereof, certified by the Secretary and attested by the President documenting their discussions on the following:

(a)     The benefits and advantages of outsourcing with respect to, among others, its role and contribution to the accomplishment of the strategic and business plans of the bank as well as the economy, efficiency and quality of its over-all operations;

(b)     The careful and diligent evaluation, prior to selecting the service provider with which it is entering into an outsourcing contract, by the bank of various service providers and their proposals, including their reputation, financial condition, cost for development, maintenance and support, internal controls, recovery processes, service level agreements, availability of competent, technically qualified and experienced personnel, strategic or convenient location of support services and such similar other considerations;

(c)     The creation, organization and membership of a senior management oversight committee to handle and oversee the efficient implementation and monitoring of the applications/operations of the service provider to ensure that the same is in accordance with the existing information technology initiatives, policies and guidelines of the bank; the list of the members of such committee, its organizational chart, and a detailed description of the roles and responsibilities of its members must be included in the Minutes of the Meeting or submitted as attachments thereto;

(d)     The creation, organization and membership of a help desk to resolve all queries, problems and other concerns arising from the applications/operations rendered by the service provider; and

(e)     The systems and user acceptance tests that will be conducted by the service provider before full implementation of the outsourced systems/processes and the unsatisfactory results of which shall be valid ground to rescind the contract with the service provider.

(3)            Profile of the selected service provider or the non-bank partner, in case of joint ventures and other similar arrangements, which should include:

(a)     Most recent and complete financial and operational information;

(b)     Track record;

(c)     List of clientele, particularly banks and the services provided thereto by the service provider; and

(d)     At the option of the service provider or non-bank partner, other documents demonstrative of its competence and reputation in the field of information technology as applied to banking operations .

SECTION 4.       Outsourcing of Other Banking Functions . -

Section 4.1.         Subject to prior approval of the Monetary Board, banks may outsource data imaging, storage, retrieval and other related systems; clearing and processing of checks not included in the Philippine Clearing House System; printing of bank deposit statements; and such other activities as may be determined by the Monetary Board. The bank concerned must submit the same documentary requirements listed in Section 3.2 hereof, except where they exclusively pertain to information technology operations.

Section 4.2.         Banks may outsource credit card services; printing of bank loan statements and other non-deposit records, bank forms and promotional materials; credit investigation and collection; processing of export, import and other trading transactions; transfer agent services for debt and equity securities; property appraisal; property management services; messenger, courier and postal services; security guard services; vehicle service contracts; janitorial services; and such other activities as may be determined by the Monetary Board.

SECTION 5.       Service Providers . - When allowed by law and under this circular, banks may enter into outsourcing contracts only with service providers with demonstrable technical and financial capability commensurate to the services to be rendered.

SECTION 6.       Review of Subsisting Outsourcing Contracts . - Within six (6} months from the effectivity of this circular:

(1)       all banks should submit a list of all their existing contracts with service providers, detailing the:

(a)   Services/activities being outsourced;

(b)   Terms of the contracts;

(c)   Measures, if any, undertaken by the bank and/or service provider to ensure the secrecy of bank deposits and confidentiality of all other data and information; and

(d)   Such other information as may be necessary to show compliance with the pertinent provisions of this circular or be required by the Monetary Board; and

(2)       for outsourcing contracts not in accordance with this circular, the following alternative courses of action are available to the bank concerned:

(a)   preterminate said contracts;

(b)   renegotiate or remedy the same to comply with this circular and submit the amendments thereto or new contracts to the BSP; or

(c)   submit a program of compliance to the BSP.

SECTION 7.       Penalties . - Violation of this circular shall be subject to Sections 34, 35, 36 and 37 of R.A. No. 7653, the New Central Bank Act. If the offender is a director or officer or a bank, the Monetary Board may also suspend or remove such director or officer.

SECTION 8.       Repeal of Section X169 of the Manual of Regulations for Banks (MORB). - This circular supersedes the provisions of Section X169 of the MORB.

SECTION 9.       Effectivity . - This circular shall take effect immediately.

Adopted: 5 Dec. 2000

(SGD.) RAFAEL B. BUENAVENTURA
Governor