Can the information systems to be used by a payment institution or electronic money institution be outsourced?
Provided that the provisions of Articles 11 and 16 of the Information Systems Communiqué and Article 13 of the Regulation are complied with, a payment or electronic money institution may outsource its information systems.
Who remains responsible when outsourcing?
Even if the service is obtained from an external provider, the institution cannot transfer its responsibility. The contract must clearly set out service levels, data security, audit rights, incident reporting and an exit plan.
The institution must also restrict the provider's access to critical systems and monitor it regularly. If data is kept abroad, the data localization rules in the legislation must also be checked.
These contracts and oversight records may be reviewed during independent audits.
Preparing for outsourcing
Before choosing a provider, a security assessment, reference checks and an exit strategy should be prepared. This preparation shows during audits that management is exercising oversight.
