1accountable
The licence holder stays responsible
Outsourcing a function does not outsource the regulatory responsibility for it. CIMA expects regulated entities to oversee their providers.
Source: CIMA rules and guidance on outsourcing
- Home
- VASP Readiness
- Outsourcing and provider oversight
Outsourced is not out of your hands.
VASPs depend on cloud platforms, custody technology, blockchain analytics and administrators. The regulatory responsibility stays with you. Oversight means knowing each provider's risks and being able to prove you manage them.
What it covers
Outsourcing and provider oversight
Provider inventory
Every material provider listed with the service, the data it holds and the impact if it fails.
Due diligence
Security, resilience, financial standing and certifications reviewed before onboarding, and refreshed periodically.
Contract terms
Audit rights, incident notification, data location, exit and subcontracting terms checked and negotiated.
Ongoing monitoring
Service reports, certifications and incidents tracked, with an annual review of each material provider.
Exit planning
A realistic plan to move away from a critical provider if you have to.
- SOC 2
- ISO/IEC 27001
- CIMA guidance on outsourcing
How we do it
List
All providers inventoried and rated.
Review
Due diligence and contracts assessed.
Fix
Gaps in terms and controls closed.
Monitor
Annual reviews and ongoing tracking.
Field notes
Worth knowing
What you receive
- Provider inventory and risk rating
- Due diligence records
- Contract review findings
- Annual provider review schedule
- Exit plans for critical providers
Questions
Which providers count as material?
Generally those whose failure would disrupt client services, compromise client assets or data, or affect regulatory compliance. We help you rate each one.
Is a SOC 2 report enough due diligence?
It is a strong input, but not the whole picture. You still need to check the scope, exceptions and complementary controls that are your responsibility.
How often should providers be reviewed?
Material providers at least annually, and after any significant incident or change in service.
More on VASP Readiness
Talk to us about outsourcing and provider oversight
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222