# Outsourcing / Third-Party Oversight Regulatory Source Index

Prepared by: OI
Workspace: `/data/workspace/outsourcing-initiative`
Purpose: working source pack for outsourcing, third-party risk, cloud/ICT, operational resilience and critical third-party oversight for an Italian bank operating in the UK.

Important caveat: this is a current working source pack, not a legal inventory. It prioritises authoritative regulatory sources most relevant to banking outsourcing oversight. Legal/Compliance should confirm applicability to the specific UK entity/branch, group structure, activity permissions, materiality and contract facts.

## 1. UK: PRA / Bank of England / FCA

| Source | Status / type | Local file | Outsourcing relevance |
|---|---|---|---|
| PRA / Bank of England, SS2/21, `Outsourcing and third party risk management`, March 2021; local copy is March 2026 update | PRA supervisory expectation | `01-source-regulation/uk/pra-ss2-21-outsourcing-third-party-risk-management-march-2026-update.pdf` | Core PRA expectations for outsourcing and third-party risk management: governance, proportionality, material outsourcing, pre-outsourcing due diligence, written agreements, access/audit/information rights, sub-outsourcing, data/security, business continuity, exit plans, registers and notifications. |
| PRA / Bank of England, SS2/21 landing page | Regulator landing page | `01-source-regulation/uk/pra-ss2-21-landing.html` | Confirms current SS2/21 publication page and historic/current versions. |
| Bank of England / PRA / FCA, PS16/24, `Operational resilience: Critical third parties to the UK financial sector`, November 2024 | Policy statement | `01-source-regulation/uk/boe-pra-fca-ps16-24-critical-third-parties.pdf` | Cross-authority UK critical third party regime; relevant where outsourced/third-party providers may be designated as CTPs and for firm/provider resilience expectations. |
| PRA, PS16/24 Appendix 1 | Rules / instrument appendix | `01-source-regulation/uk/pra-ps16-24-appendix-1-critical-third-parties-rules.pdf` | PRA rule instrument material for the CTP regime. |
| Bank of England / PRA, PS16/24 Appendix 3 | Supervisory/policy appendix | `01-source-regulation/uk/boe-pra-ps16-24-appendix-3-supervisory-material.pdf` | Supporting supervisory/policy materials for CTP oversight. |
| FCA, FG16/5, `Guidance for firms outsourcing to the cloud and other third-party IT services`, July 2016 | FCA finalised guidance | `01-source-regulation/uk/fca-fg16-5-cloud-other-third-party-it-services.pdf` | FCA guidance for cloud/IT outsourcing, including risk assessment, legal/regulatory access, data security, oversight, change management, exit and concentration considerations. |
| FCA Handbook, SYSC 8, `Outsourcing` | Binding FCA Handbook rules/guidance depending on provision | `01-source-regulation/uk/fca-handbook-sysc-8-outsourcing.html` | FCA outsourcing rules/guidance, including responsibilities, service provider arrangements, controls and oversight. |
| FCA Handbook, SYSC 15A, `Operational resilience` | Binding FCA Handbook rules/guidance depending on provision | `01-source-regulation/uk/fca-handbook-sysc-15a-operational-resilience.html` | Relevant where outsourcing supports important business services, impact tolerances, mapping, testing and resilience remediation. |
| FCA Handbook, CTPS sourcebook, `Critical Third Parties` | FCA Handbook rules/guidance | `01-source-regulation/uk/fca-handbook-ctps-critical-third-parties.html` | FCA critical third-party sourcebook under the UK CTP regime. |

## 2. EU / EBA / DORA / ECB context

| Source | Status / type | Local file | Outsourcing relevance |
|---|---|---|---|
| EBA, `Guidelines on outsourcing arrangements`, EBA/GL/2019/02, 25 February 2019 | EBA Guidelines | `01-source-regulation/eu/eba-gl-2019-02-guidelines-on-outsourcing-arrangements.pdf` | Core EBA framework for outsourcing arrangements: governance, outsourcing policy, conflicts, business continuity, internal audit, register, critical/important functions, due diligence, contracts, audit/access, sub-outsourcing, exit. Relevant for EU group/Italian parent context and historically for EU banking outsourcing. |
| EBA, `Guidelines on ICT and security risk management`, EBA/GL/2019/04, 28 November 2019 | EBA Guidelines | `01-source-regulation/eu/eba-gl-2019-04-ict-security-risk-management.pdf` | ICT governance/security control expectations relevant to ICT outsourcing and provider oversight. Note: DORA has superseded significant parts of EU ICT risk framework for in-scope financial entities from 17 January 2025; confirm current local implementation/supervisory transition. |
| EU, Regulation (EU) 2022/2554, `Digital Operational Resilience Act` (DORA), 14 December 2022; applies from 17 January 2025 | Binding EU Regulation | Official EUR-Lex URL retained in manifest; local fetch blocked by EUR-Lex WAF. See `01-source-regulation/eu/regulation-eu-2022-2554-dora-fetch-note.txt` | Binding EU framework for ICT risk management, incident reporting, digital operational resilience testing, ICT third-party risk management, register of information, contractual provisions and oversight of critical ICT third-party providers. Highly relevant for Italian/EU banking group context. |
| ECB / SSM | Supervisory context | Not downloaded in this pass | ECB directly supervises significant institutions and uses EU framework/NCA implementation. A separate ECB-specific document set should be confirmed if the Italian parent is an SSM significant institution or if ECB cloud/ICT outsourcing expectations are applicable. |

## 3. Italy: Bank of Italy

| Source | Status / type | Local file | Outsourcing relevance |
|---|---|---|---|
| Banca d'Italia, `Circolare n. 285 del 17 dicembre 2013 - Disposizioni di vigilanza per le banche`, full text to 51st update, 3 February 2026 | Bank of Italy supervisory provisions for banks | `01-source-regulation/italy/bank-of-italy-circular-285-51-update-full-text.pdf` | Core Italian banking supervisory provisions. Relevant to governance, internal controls, operational risk, ICT/security, outsourcing/esternalizzazione and group oversight depending on chapter. Requires detailed extraction against outsourcing chapters/sections. |
| Banca d'Italia, Circular 285 landing page | Regulator landing page | `01-source-regulation/italy/bank-of-italy-circular-285-landing.html` | Confirms current version/updates page for Circular 285. |

## 4. Immediate practical interpretation for the portal

For an outsourcing registry portal, the above sources generally drive these minimum evidence domains:

1. Classification: outsourcing/non-outsourcing; materiality or critical/important function; ICT/cloud flag; intra-group/external; regulated activity/business service supported.
2. Governance: business owner, outsourcing referent, risk owner, approvals, committee records, conflicts assessment.
3. Due diligence: financial stability, competence, security, resilience, data protection, location/cross-border, concentration and substitutability.
4. Contract evidence: written agreement, service description, SLAs/KPIs, audit/access/information rights, regulator access, data/security, incident notification, sub-outsourcing, BCP/DR, termination and exit assistance.
5. Oversight: ongoing monitoring, service reviews, SLA breaches, risk assessments, audit findings, issue remediation, annual attestations.
6. Resilience/exit: mapping to important business services, impact tolerance support, exit plan, stressed exit feasibility, alternative providers, data return/deletion.
7. Register/notification: complete register fields, material outsourcing notifications where required, EU DORA register of information alignment where applicable.

## 5. Files created

- Manifest: `01-source-regulation/metadata/source_manifest.json`
- Fetch results: `01-source-regulation/metadata/fetch_results.json`
- SHA256 checksums: `01-source-regulation/metadata/sha256sums.txt`
- This index: `03-analysis/source-index-outsourcing-oversight.md`

## 6. Known gaps / next extraction tasks

1. DORA official text: EUR-Lex returned HTTP 202 CloudFront WAF challenge from this environment. The official URL is retained; download manually or via a browser if needed.
2. DORA Level 2 technical standards: this pass did not yet collect all ESA RTS/ITS final texts on ICT third-party risk, register of information, subcontracting, threat-led penetration testing and incident reporting. These should be added in the next pass.
3. ECB-specific documentation: not confirmed/downloaded in this pass. Need determine whether the Italian parent is an SSM significant institution and whether any ECB cloud/outsourcing guide applies.
4. Bank of Italy Circular 285 needs detailed chapter-level extraction in Italian, especially outsourcing/ICT/internal-controls provisions.
5. PRA/FCA rulebook extraction should be mapped into portal fields and evidence requirements.