Sets the HKMA's supervisory approach to outsourcing and the nine concerns an AI must address before and during an outsourcing: accountability stays with the board and senior management; a risk assessment of the arrangement; the ability and financial soundness of the service provider; a written outsourcing agreement covering performance, confidentiality, termination and the HKMA's access; customer data confidentiality under the Banking Ordinance and the Personal Data (Privacy) Ordinance; control over the outsourced activity through monitoring and audit rights; contingency planning for the provider's failure; access to outsourced data by the AI, its auditors and the HKMA; and the additional concerns of overseas outsourcing (legal and regulatory environment, data access, the HKMA's ability to examine). The Seventh Schedule obligations on adequate systems of control and prior consultation with the HKMA on material outsourcing apply. Classification: a non-statutory guideline issued as a guidance note; version V.1, 28.12.01; applies to all AIs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.