BSP Outsourcing Regulation
Definition
BSP Outsourcing Regulation
BSP outsourcing regulation refers to the rules the Bangko Sentral ng Pilipinas applies when a supervised financial institution has another company perform part of the work it is licensed to do. Supervision follows the function, not the corporate boundary around it.
The Philippines is simultaneously a major outsourcing destination and a market whose own banks outsource heavily.
That double position shapes the rules. The central bank has to supervise banks that buy services and, indirectly, the providers that sell them.
The governing detail sits in the Manual of Regulations for Banks rather than in the statute — Section 112 carries the title Management Contracts and Outsourcing.
Key takeaways
- Outsourcing rules for Philippine banks live in the Manual of Regulations rather than the central bank law.
- The examination power extends to subsidiaries and affiliates engaged in allied activities.
- Outsourcing is permitted, and it is treated as a governed arrangement rather than a free choice.
- Data handled by a bank’s provider also falls under the Philippine Data Privacy Act.
How it works
The statutory foundation is broad. The central bank shall have supervision over the operations of banks and exercise such regulatory and examination powers as provided in the law and other pertinent statutes.
That examination power reaches further than the bank itself. It covers regular or special examinations of banking institutions and quasi-banks, including their subsidiaries and affiliates engaged in allied activities.
The operational rules then sit in the manuals. The central bank publishes the Manual of Regulations for Banks alongside separate manuals for non-bank financial institutions, payment systems and foreign exchange transactions.
| Layer | Where it lives | What it settles |
|---|---|---|
| Supervisory authority | The central bank law | Who may examine and on what basis |
| Outsourcing rules | Manual of Regulations, Section 112 | Governance of management contracts and outsourcing |
| Issuance updates | Circulars and memoranda | Amendments between manual editions |
| Data handling | The Data Privacy Act | Obligations attaching to customer information |
| Provider obligations | The bank’s contract | Access, reporting and service standards |
Read the current Section 112 before designing an arrangement — thresholds and notification mechanics have been amended by circular more than once, and the manual carries the operative text.
A second regime applies at the same time — customer information processed by a provider brings the bank’s privacy obligations with it, which is a separate compliance track from the prudential one.
Examples
Philippine banks outsource across the full range, from card operations and collections to core platforms. Every arrangement below was examined by a supervisor who asked an unwelcome question.
A universal bank contracts card dispute handling to a domestic provider. The bank builds examination access into the contract, because a supervisor will not accept being told the records sit elsewhere.
A thrift bank moves its contact centre to a shared facility operated by a third party. Supervision reaches the function, so the bank documents how it oversees a floor it does not manage.
A rural bank uses a technology provider for its core banking platform. The dependency is structural, and the bank’s exit planning has to be more than a clause about notice periods.
A foreign bank branch consolidates back office work into a regional hub. The arrangement is intra-group, and intra-group does not remove the supervisory interest in how it is governed.
Related terms
Philippine regulatory vocabulary mixes prudential, privacy and labour concepts in one conversation. Each definition here narrows a word that is otherwise doing far too much work.
- Bangko Sentral ng Pilipinas: the central bank and supervisor behind these rules.
- Banking outsourcing: the general practice these rules govern locally.
- Data Privacy Act Philippines: the parallel regime covering customer information.
- Regulated outsourcing: supervised sector outsourcing generally, of which this is one case.
- Compliance outsourcing: contracting the compliance function rather than an operational one.
- Philippines BPO: the provider market Philippine banks buy from.
- PEZA: the zone authority many providers register with, on a separate track.
FAQ
Can a Philippine bank outsource any function?
Outsourcing is permitted and regulated rather than open. The current Manual of Regulations sets the governance expectations and the treatment of material arrangements.
Does the central bank examine service providers?
Its examination power reaches banks, quasi-banks and their subsidiaries and affiliates in allied activities. Access to provider records is secured through the bank’s contract.
Where are the current rules written?
In the Manual of Regulations for Banks, with amendments issued by circular. Section 112 covers management contracts and outsourcing.
Do privacy rules apply as well?
Yes. Customer information handled by a provider engages the Data Privacy Act, and the controller remains accountable under it.
Is intra-group outsourcing treated differently?
It is still an outsourcing arrangement. Group ownership may simplify diligence but does not remove supervisory interest in governance.
What should a provider prepare for?
Contractual access, reporting obligations and questions it cannot answer with a brochure.
Browse source partners in the Outsource Accelerator hubs directory and choose partners who can explain the local supervisor’s expectations.
Independent
