BSP Rules on Banking Function Outsourcing

Outsourcing of "inherent banking functions" is strictly prohibited; defined as outsourcing manpower for servicing deposit transactions.
Management functions may not be outsourced except with Monetary Board authorization and justified circumstances.

Banks may outsource IT systems/processes with prior Monetary Board approval, except for key strategic and control IT functions.
Non-outsourcable IT functions include strategic planning, system functionality determination, change management, contract and security policy administration.
Consultants may assist bank personnel in non-outsourcable IT functions subject to approval.

Banks must submit a comprehensive outsourcing contract detailing scope, fees, security measures, responsibilities, confidentiality, disaster recovery plans, insurance, hardware/software ownership, audit access, BSP access, corrective measures, and remedies for service provider insolvency.
Board of Directors' minutes must document benefits, evaluations of service providers, oversight and help desk structures, and testing procedures.
Detailed profile of the selected IT service provider must be submitted including financials, track record, clientele, and competence evidence.

With Monetary Board approval, banks can outsource data imaging, check processing (excluding Philippine Clearing House System), printing of deposit statements, and other board-determined activities.
Additional permissible outsourcing includes credit card services, printing of loan statements, credit investigations, collections, export/import processing, securities transfer agent services, property appraisal/management, courier/security/janitorial services, and other activities as determined.

Outsourcing contracts must be entered only with providers demonstrating sufficient technical and financial capability appropriate to the service scope.

Within six months from effectivity, banks must submit a complete list of outsourcing contracts with details on services, contract terms, confidentiality measures, and compliance information.
Non-compliant contracts must be either pre-terminated, renegotiated and submitted to BSP, or a program of compliance submitted.

Violations are subject to penalties under Sections 34-37 of R.A. No. 7653 (New Central Bank Act).
Monetary Board may suspend or remove directors/officers who violate the circular.

This circular supersedes Section X169 of the Manual of Regulations for Banks (MORB).