Regulated Outsourcing
Definition
Regulated Outsourcing
Regulated outsourcing is the contracting of a function that sits under a supervisor’s rules, so the deal itself has to satisfy conditions the regulator sets out. Banking, insurance, and healthcare all limit what may be delegated and who stays answerable for it.
The defining feature is that a third party now holds an opinion on your contract. Ordinary commercial terms are not enough, because a supervisor can require notification, access rights, exit plans, and evidence of ongoing oversight.
Accountability never moves. Regulators are consistent on this point across jurisdictions: you can contract out the activity, but you cannot contract out the responsibility for it.
US banking supervisors set out their expectations in the interagency guidance on third-party relationships, SR 23-4, issued on 6 June 2023 by the Federal Reserve, the FDIC, and the OCC.
Key takeaways
- Regulated outsourcing is contracting a function that a supervisor’s rules already govern.
- Accountability stays with the regulated firm regardless of who performs the work.
- Contracts typically need audit access, exit provisions, and sub-outsourcing controls.
- Material arrangements often require notification to the regulator before they start.
How it works
The firm rates the arrangement by materiality, runs due diligence proportionate to that rating, and writes regulator-required clauses into the contract. Oversight then runs continuously, with evidence kept, because supervisors examine monitoring rather than intention.
Materiality assessment drives everything downstream — a cleaning contract and a core banking platform are both outsourcing, and only one of them will interest a supervisor.
Concentration risk is assessed at two levels — your own dependence on one provider matters, and so does the number of regulated firms all sitting on the same platform.
The UK’s Financial Conduct Authority sets expectations for firms on outsourcing and operational resilience, covering how firms identify important business services and manage third-party dependency.
| Requirement | What supervisors expect | Common failure |
|---|---|---|
| Materiality rating | A documented, defensible classification | Everything rated low |
| Due diligence | Proportionate to criticality | A questionnaire and nothing more |
| Audit access | Contractual right for firm and regulator | Absent or diluted |
| Exit plan | Tested, funded, and realistic | Written once, never rehearsed |
| Sub-outsourcing | Notification and approval rights | Silent chains three deep |
Examples
Regulated outsourcing arises wherever a supervisor already governs the underlying activity, and the same pattern repeats across very different sectors. Four cases show the range of arrangements.
A retail bank moved card dispute handling offshore in 2024. The programme took nine months, most of which was regulatory notification and evidence preparation rather than transition.
An insurer contracted claims assessment but kept the final claims decision, because delegating that authority would have required separate permission it did not want to seek.
A hospital network outsourced medical coding under a business associate agreement, with audit rights and breach-notification timelines written into the contract.
An asset manager discovered its fund administrator had sub-contracted reconciliation to a fourth party. Nothing was wrong operationally, and the missing notification was the finding.
The pattern in all four was evidence. Supervisors did not ask whether oversight existed; they asked to see what it produced last quarter.
Related terms
Regulated outsourcing intersects a set of compliance, resilience, and sector-specific disciplines that shape how such contracts are written. The list below marks the boundaries.
- Compliance Outsourcing: contracting the compliance function itself, rather than a supervised activity.
- Banking Outsourcing: the sector where these rules are most developed.
- HIPAA Compliance: the US healthcare regime governing delegated handling of patient data.
- GDPR: the data protection rules that follow personal data offshore.
- Insurance Outsourcing: another heavily supervised delegation environment.
- Business Continuity Plan (BCP): what supervisors expect to see tested, not just written.
- Service Level Agreement (SLA): the contractual measurement layer regulators inspect.
FAQ
What is regulated outsourcing?
It is outsourcing a function that a supervisor’s rules already govern, so the arrangement must meet regulatory conditions as well as commercial ones. The regulated firm stays accountable.
Can accountability be transferred to the provider?
No. Every major supervisory regime holds the regulated firm responsible for outsourced activity, whoever performs it day to day.
What makes an arrangement material?
Broadly, whether failure would disrupt a critical service, harm customers, or breach obligations. Firms must document the assessment rather than assert a conclusion.
Do regulators need to be told in advance?
Often, for material arrangements. Requirements differ by jurisdiction and sector, so the timing question belongs early in the project rather than late.
What is sub-outsourcing?
It is a provider contracting part of the work onward to a fourth party. Most regimes require notification and some require approval.
Why do exit plans matter so much?
Because a provider failure without a rehearsed exit becomes a service failure — supervisors increasingly ask for evidence the plan has actually been tested.
Finding providers with genuine experience of supervised environments is worth doing carefully. The Outsource Accelerator directory lets you compare specialists before making contact.
Independent
