| 18. | Banks should document all their outsourcing arrangements through a written and legally binding agreement. As a minimum, the contract should incorporate the following:
|
| | a) | Scope of the Contract;
|
| | b) | Regulatory status (legal entity & registered) of the third party service provider
|
| | c) | Service levels and performance requirements;
|
| | d) | Audit and monitoring procedures;
|
| | e) | Business continuity plans;
|
| | f) | Default arrangements, termination clause and minimum periods to execute a termination provisions. The clause should take into account insolvency or any material changes.
|
| | g) | Pricing and fee structure;
|
| | h) | Dispute resolution mechanisms;
|
| | i) | Liability and indemnity;
|
| | j) | Confidentiality, privacy and security of information;
|
| | k) | Ensuring access to SAMA and the Bank's internal and external auditors;
|
| | l) | Compliance with all applicable regulatory and legal requirements;
|
| | m) | Contractual obligations of the third-party service provider in case of subcontracting all or part of the outsourcing;
|
| | n) | Mechanisms for reporting and escalation;
|
| | o) | Commitment of the third-party service provider to report to the bank any control weaknesses or adverse developments in its financial performance;
|
| | p) | Commitment of foreign third-party service provider that there are no regulatory impediments to the data and record access as per Article 33 and 34 of these rules.
|
| 19. | The contract should allow for renewal, renegotiation, default termination and early exit, to enable the bank to retain control over the outsourced function or activity and should include provisions that prohibit sub-contracting of the Material outsourcing under the contract without the prior approval of the Bank and no objection from SAMA.
|
| 20. | The contract should also incorporate a clause for providing SAMA access to documentation and accounting records in relation to the outsourcing arrangements. The contract should require the third-party service provider to cooperate with SAMA.
|
| 21. | The contract should preferably include Saudi Arabia as the legal jurisdiction of the contract.
|
| 22. | Banks should institute a defined internal mechanism for receipt and resolution of any customer complaints regarding their outsourced services and the outsourcing contract should include appropriate clauses to ensure that the third party service provider will facilitate the resolution mechanism.
|
