JFSC 2025 Outsourcing Examination Feedback – Key findings and what firms need to do

The Jersey Financial Services Commission (JFSC) has published feedback from its 2025 thematic examination programme on outsourcing. The examination assessed how firms complied with

• Legal and regulatory requirements under the applicable Codes of Practice and
• The seven core principles of the Outsourcing Policy (OSP).

Speed read   

• The JFSC's 2025 thematic examination of outsourcing arrangements found a generally acceptable level of compliance across the eight firms reviewed. Still, findings were identified in five of the eight examinations, with all but one of those minor.
• The issues that did arise cluster around five areas: failure to identify and notify in-scope outsourcing activity, inadequate or untested contingency plans, group policies not tailored to Jersey-specific requirements, gaps in evidencing SAR-reporting awareness among service providers and missed notifications of material changes to outsourcing arrangements.
• None of these point to a systemic problem — but each is a control gap the JFSC has now flagged publicly, which raises the bar for what it will expect firms to demonstrate next time.

What firms should do now?

• Map your outsourcing population.
• Confirm every arrangement in scope of the Outsourcing Policy has been identified and, where required, notified — cloud and cyber security services are an area the JFSC specifically called out as commonly missed.
• Stress-test contingency plans.
• Don't just hold a plan — evidence that it's been reviewed and, where appropriate, tested, and that group-level plans have been tailored to the Jersey business rather than inherited wholesale.
• Localise group policies and procedures.
• Where outsourcing policies sit at group level, confirm they've been adapted to meet OSP-specific requirements, not just adopted as-is.
• Check SAR-reporting lines with service providers.
• Confirm — and be able to evidence, e.g. via training records or SLA clauses — that outsourced providers know how and when to escalate suspicion of ML/TF/PF to your MLRO or deputy MLRO.
• Review your notification triggers.
• Make sure termination or other material changes to outsourcing arrangements are captured by your procedures and notified to the JFSC as they happen, not retrospectively.

Firms should treat this as a self-assessment prompt rather than a compliance formality:

• The JFSC has said explicitly that in future engagements it may ask firms to demonstrate the steps taken in response to this feedback, and that it may revisit the theme in future supervisory work.

Long read  

The Jersey Financial Services Commission (JFSC) has published feedback from its 2025 thematic examination programme on outsourcing. The examination assessed how firms complied with legal and regulatory requirements under the applicable Codes of Practice and the seven core principles of the Outsourcing Policy (OSP).

The feedback paper provides:

• An overview of the examination and key findings
• Statistics on the findings
• An overview of outsourcing obligations
• A table with detailed findings and examples of best practice
• Key questions to help firms assess their own systems and controls

Examination approach

• The JFSC conducted desk-based reviews of policies, procedures and supporting documentation, followed by on-site examinations involving interviews with key persons, board members and staff.
• All eight firms examined received direct feedback. Where deficiencies were identified, firms were required to submit formal remediation plans.

Overall finding

• The examinations found a generally acceptable level of compliance.
• Findings were identified in five of the eight examinations, and all but one of those findings were minor.

Key findings (summary of the main categories where issues were identified)

• Identification of activities caught by the outsourcing policy — instances of activities caught by the OSP but not notified to the JFSC.
• Contingency plans — instances where contingency plans were inadequate or lacked evidence of periodic testing.
• Policies and procedures — instances where reliance was placed on group outsourcing procedures with no tailoring to the specific requirements of the OSP.
• Awareness of suspicious activity reporting (SAR) obligations — instances where firms could not evidence that SAR reporting obligations had been communicated to outsourced service providers.
• Material changes to outsourcing notification — instances where a material change to an outsourcing arrangement (including termination) was not notified to the JFSC.

What the feedback paper also covers

• It restates the seven core principles of the OSP (responsibility/accountability, fit and proper service providers, outsourcing agreements, ongoing capacity and resources, contingency plans, notification/no-objection requirements, and preservation of the JFSC's regulatory powers).
• It distinguishes obligations for registered persons (under sector Codes) and supervised persons (particularly in respect of AML/CFT/CPF-related outsourcing). It includes examples of practices observed that worked well (e.g. assessment checklists, centralised registers of outsourced arrangements, tailored contingency plans, periodic testing, and clear contractual SAR reporting clauses).

Key questions the JFSC encourages firms to ask themselves

1. Have you identified all outsourced activity within the scope of the outsourcing policy?
2. Can you demonstrate that you remain responsible and accountable for outsourced activity (including sub-outsourcing) and have appropriate oversight arrangements?
3. Have you satisfied yourself that appropriate due diligence has been conducted and maintained, and that service providers continue to be fit and proper, adequately resourced, and compliant with applicable regulatory and AML/CFT/CPF requirements?
4. Can you evidence that outsourcing arrangements are supported by appropriate contractual agreements documented before services commence, and that notification and no-objection requirements have been met where applicable?
5. Have you established proportionate contingency and exit arrangements, and tested them where appropriate?

Next steps for firms

The JFSC encourages all supervised persons to:

• Review the full feedback paper
• Assess their own systems and controls against the findings and good-practice examples
• Identify and implement any necessary enhancements (proportionate to the nature, scale, complexity and risks of their outsourced activities)
• Ensure any remediation is sustainable and considers broader implications

In future engagements, the JFSC may ask firms to demonstrate the steps taken in response to this (and other) feedback. The theme may be revisited in future supervisory work.

Read the official material.

• JFSC news update: https://www.jerseyfsc.org/news-and-events/outsourcing-key-findings-from-our-examinations/
• Full examination feedback page: https://www.jerseyfsc.org/industry/examinations/examination-findings-and-questionnaires/2025-outsourcing-examination-feedback/
• PDF feedback paper (issued 30 July 2026): https://www.jerseyfsc.org/media/ut4krxwj/2025-outsourcing-examination-feedback.pdf

(Source material is the JFSC's own published feedback. Firms should read the full paper for the detailed findings table, statistics, and complete examples of good practice.)