III. Governance
F. Board of Directors
11. The Board of Directors of the bank retains the ultimate responsibility for the outsourcing policy and all outsourcing arrangements, including compliance with all relevant legal and regulatory requirements. The bank and the Board are responsible for complying with all prudential requirements relating to the outsourced business activity.
12. The Board of Directors should ensure that appropriate policies are developed and implemented within the proper risk management framework for outsourcing arrangements. The Board or its delegated authority must approve the bank's outsourcing policy, which must set out its approach to outsourcing of Material business activities, including a detailed framework for managing all outsourcing arrangements.
G. Reporting Requirements
13. Banks are required to notify SAMA of any breaches of legal or regulatory requirements in their outsourcing arrangements. In such event, SAMA may require the bank to modify or cancel the arrangement, or re-integrate an outsourced function into the organization.
14. All Banks are required to provide annual report of their outsourcing activities using the prudential return in Annex 1 as of the end of each year within 30 business days to be sent to BankingDataSection@SAMA.GOV.SA.