The Monetary Authority of Singapore's guidelines on outsourcing compliance functions are put under the microscope by two sets of experts.

The following article is by Chris Hamblin, editor of Offshore Red and Compliance Matters, sister publications to this news service. (To view Compliance Matters, see here. To view Offshore Red, click here.)

Singapore’s financial regulator and de facto central bank has set out guidelines for outsourcing of compliance services – a hot issue right now in the Asia region, as explained in a recent bulletin by Laven Partners, a firm specialising in giving advice on such matters.

On each of the MAS points that Laven has highlighted, it has also drawn comments from Suvendu Ganguli,  chief operating officer of Temaswiss Wealth, the recently-launched organisation providing training for private bankers in the region.

The major points
The guidelines describe how fund-management companies should assess the degree of 'materiality' in an outsourcing arrangement. Material outsourcing constitutes arrangements which if disrupted, could have a significant effect on the firm’s business, operations, reputation or profitability.

The MAS recommends that fund firms should consider the following points when assessing the materiality of an outsourcing arrangement:

-- the importance of the business activity to be outsourced;

-- the potential effect of the outsourcing on earnings, solvency, liquidity, funding and risk profile;

-- the effect on the firm’s reputation and brand value should the service provider fail to perform its services;

-- aggregate exposure to a particular service provider in cases where the firm outsources various functions to the same one; and

 --  the ease with which the firm can maintain appropriate internal controls and obey regulations if the service provider were to experience operational problems.

The determination and reporting of material outsourcing

Laven Partners note that the MAS must be notified in writing of all material outsourcing. Outsourcing of all or substantially all risk management and internal control functions including compliance, internal audit and financial accounting is considered material and firms must report it.

Suvendu Ganguli said most large organisations are notified of the requirement, yet the true challenges lie elsewhere. He said: “Firstly, in Singapore's banking industry, outsourcing and ‘smart-sourcing’ (the later typically refers to outsourcing to an affiliate or subsidiary entity of the group) has been going on for years in a piece-meal and increasingly complex fashion without a corresponding rise in centralised tracking and necessary governance. Most banks are now scrambling to put such controls in place in instances where there are up to 3 layers of outsourcing that makes use of many jurisdictions and many entities, sometimes all relating to a single process.”

“Although the regulator does acknowledge any notification of material outsourcing, its response (as one might expect) is typically in a standardised letter that reminds the institution of its obligations to monitor the outsourcing and periodically subject it to scrutiny by internal audit,” he said.

He continued: “Audit’s function is clearly not to manage a compendium of outsourcing relationships (this is a business responsibility) and therefore, in view of the current turmoil, it is anybody’s guess whether any one function at this-or-that organisation has a full picture of all outsourcing relationships and knows whether all assessments of 'materiality' have been done consistently. In essence, this is very much a 'work in progress’ with open manholes all around.”

The need for “due diligence”
Laven Partners said firms should perform formal “due diligence” on service providers. For this purpose, each fund firm should establish a process for doing so. This should, amongst other things, lead to a written record of each service provider’s technical expertise, its independence from the firm or lack of it, its familiarity with MAS regulations and whether it is likely to be accessible to the MAS during any audits that might take place.

Ganguli says: “Interestingly, what this guidance does not consider is that 68 per cent of global outsourcing in the financial services industry is cross-border and multi-jurisdictional (and – yes – an outsourcing from the Dubai International Financial Centre to 'UAE onshore' under Central Bank jurisdiction also counts here). Most regulators in Asia (India, Thailand, Indonesia and Malaysia to name but a few) also have their specific guidelines on outsourcing.”

“In this field, again, two items need highlighting. Firstly, in each outsourcing set-up process, the firm has to consider both the sending location’s regulatory requirements for 'due diligence' and those of the receiving location. I have seen circumstances where such requirements conflict with each other and cross-border 'oversight requirements' also pose challenges,” Ganguli continues.

“Secondly, although the best-known guidelines for transfer pricing come from the Organistion for Economic Co-operation and Development and awareness outside of the OECD region is still somewhat lacking, it has to be kept in mind that recognition of income and costs is only the flip-side of robust risk recognition, even if there is an outsourcing or cross-border context. Since the events at Lehman Brothers in 2008, most regulators have increased their insistence on the effective segregation of client monies and trades from proprietary monies and trades and the scrutiny thereof, but there are no globally consistent rules for 'materiality' assessments to offset outsourcing risks,” he said.

Always ensure independence
An established relationship with existing service providers may seem like a natural fit for outsourcing, but these existing relationships may create a conflict of interest. Every outsourcing exercise must assess both the technical expertise of the provider and determine whether any other duties that it performs will create any conflict of interest. For instance, if a fund firm wishes to outsource its internal audit, it should consider whether any conflict might arise from outsourcing it to the service provider that already performs its financial audits, says Laven Partners.

Suvendu Ganguli notes that the UK's Bribery Act, which is global in scope, has focused people's minds on the arms-length conduct that ought to surround (and the conflicts of interest that might surround) the hopefully neutral selection of an outsourcing/service provider/vendor and has generally improved governance on the subject. In the IT and other specialised technical sectors of India, to take one random example, there are still pockets of doubt about how (and by whom) technology vendors are introduced to their clients, about who owns the firm and who is related to whom. The wining-and-dining that precedes the award of a contract does not seem to have died down much recently.

In the context of fund management, banking and trust advisory services, the strangest of examples can arise out of the complex relations between parties. If, for instance, a customer takes legal action against a nominee entity (which is a subsidiary of a large bank or fund) for mismanagement, mis-selling, tampering with statements or fraud, the nominee entity may in turn find itself having to take legal action against the owning parent company in its capacity as the custodian of the client’s assets.

The performance of periodic reviews
Laven Partners says each outsourced service provider should have established records that are accessible to the fund management firm and can be used to review, amongst other things, the details of the engagement and the continuing performance of the service provider. In particular, the performance of the service provider should be formally reviewed on a periodic basis and someone should carry out a regular review of the arrangement to determine whether any changes to it have caused 'non-material' outsourcing to be considered material. The MAS never uses the term “immaterial”.

Ganguli says anyone who thinks of outsourcing as a benign process that can only lead to cost-savings should think again. The funds industry has “material outsourcing” in almost every vital area, from the gathering of economic intelligence/analyst views to accounting, auditing and the production of performance statements. The MAS expects a periodic review for each and every material aspect. In February of this year, clients' statements that belonged to one Asia-based lender were stolen whlie in the care of a third-party service provider – the pain (and the volume of explanation to be made to the regulator) was enormous.

The responsibility is always with the fund firm
Laven Partners says responsibility for a function, whether performed internally or outsourced, lies ultimately with the fund-management company in question. The senior managers and board are the parties who carry responsibility for the management of any risks associated with the firm, so all outsourcing efforts should be considered in the firm’s “risk management framework”. Proper “due diligence,” a focus on expertise and independence and a never-ending stream of periodic reviews of the service-providers (perhaps every year or two) should be helping to mitigate any risk.

Suvendu Ganguli heartily agrees, but believes that two years is very long – any review should take account of regulatory expectations. The criteria for selecting outsourcing vendors (and subsequent auditing/periodic reviews) are typically weak in respect of the assessment of business continuity, of the vendor's/service provider's plans and of the effective risk-mitigation of the vendor’s continuity plans.