Jersey outsourcing [OSP] rules – BEWARE "newly caught" Supervised Persons have SIX [6] months to act

JFSC Feedback on Revised Outsourcing Policy [OSP] Follow-on Consultation was published on 04 July 2023, and will the updated OSP will be effective from 1 January 2024, after a six-month transition period.

However, where Supervised Persons

• Who are "NEWLY CAUGHT" by the Revised OSP and
• Have existing outsourced services BUT HAVE NOT NOTIFIED the JFSC under the current OSP [no requirement to notify].
• Must NOW make a full Outsourcing Notification ON OR BEFORE the expiry of the six-month transition period,

On this matter, the JFSC says:-

• Paragraph 6.4 relating to 'Material Change to Outsourcing Notification' has been amended in the final form Revised OSP to provide as follows:
  • "6.4.1 A Material Change to Outsourcing Notification form is available and must be made via myJFSC in the event of:-
    • ANY MATERIAL CHANGE(S) to an existing Outsourcing arrangement in respect of which, either
      • A No Objection has been granted or,
      • In respect of which an Outsourcing Notification has been submitted but which did not require a No Objection in accordance with paragraph 3.6.5:-
        • "3.6.5 Where a Business Outsources the performance of Outsourced Activity in the form of
          • Cloud Services, Data Centre Services, Cyber Security Services or E-ID Services to a Service Provider,
        • Whilst the relevant Business must still submit an Outsourcing Notification in respect of such Outsourced Activity, IT WILL NOT REQUIRE A NO OBJECTION.
        • As such, the submission of an Outsourcing Notification in respect of THE FOLLOWING will be a straight-through process.
          • Cloud Services, Data Centre Services, Cyber Security Services or E-ID Services
        • PLEASE NOTE
          • No Outsourcing Notification will be required for Cloud-based email services, which are standardised and pre-packaged services available to the general public, such as Microsoft 365."
        • 4.4 Where a No Objection was not previously required but is now required under the OSP (for example where a Supervised Person is newly caught by the OSP in respect of its Outsourced Activity),
          • An Outsourcing Notification will be required in all circumstances.
        • Only once an Outsourcing Notification in respect of the relevant Outsourced Activity has been submitted, and a No Objection granted, where required,
          • Does the Material Change to Outsourcing Notification become relevant
        • Unless, as set out under paragraph 6.4.1,
          • There is new Outsourced Activity in which case, the Business must submit a new Outsourcing Notification and obtain a further No Objection.

See attached – revised OSP

• Clean version
• Redline version

Read the follow-on consultation and revised outsourcing policy feedback here:-

• https://www.jerseyfsc.org/media/6745/follow-on-consultation-on-revised-outsourcing-policy-osp.pdf
• https://www.jerseyfsc.org/news-and-events/feedback-on-revised-outsourcing-policy-follow-on-consultation-published/

NOTES

1. The JFCS has published feedback on the follow-on Consultation to its Revised Outsourcing Policy (OSP).
2. This feedback shows the JFSC response to comments received to the Follow-on Consultation from Industry participants.
3. The final revised OSP is in Appendix A and is effective from 1 January 2024 after a six-month transition period.