Skip to main content

Chapter 4: Outsourcing Policy

No: 65338/99 Date(g): 13/1/2019 | Date(h): 7/5/1440 Status: In-Force
11-The finance company should establish proper safeguards to protect the confidentiality of consumers’ data and retrieve or destroy all such data upon the expiration or termination of the outsourcing contract for whatever reason.
 
12-The Outsourcing Policy should include in particular the following:
 
a.Terms of reference and responsibilities of the Board of Directors and senior management with regard to outsourcing.
 
b.The functions allowed to be outsourced and the eligibility criteria of the External Service Provider by conducting due diligence on the following:
 
 1)Experience and financial and technical capabilities of the External Service Provider;
 
 2)Impact of the outsourcing on the overall risk profile of the finance company, risk identification criteria and risk mitigation measures;
 
 3)Impact of the outsourcing on systems and controls within the finance company;
 
 4)Rules for the continuous control and monitoring of the outsourced operations;
 
 5)Criteria to identify conflicts of interest as well as rules and procedures which ensure safeguarding the interests of the finance company and not putting the interest of the other party over the company's interest;
 
 6)Procedures to protect information and maintain confidentiality and privacy;
 
 7)A clear mechanism to verify the External Service Provider’s compliance with the laws and instructions relevant to the outsourced services whether issued by SAMA or any other authority, including the Finance Consumer Protection Principles; and
 
 8)All requirements of these Rules.