2.

Member States shall require investment firms to exercise due skill, care and diligence when entering into, managing or terminating any arrangement for the outsourcing to a service provider of critical or important operational functions or of any investment services or activities. Investment firms shall in particular take the necessary steps to ensure that the following conditions are satisfied: the service provider must have the ability, capacity, and any authorisation required by law to perform the outsourced functions, services or activities reliably and professionally; the service provider must carry out the outsourced services effectively, and to this end the firm must establish methods for assessing the standard of performance of the service provider; the service provider must properly supervise the carrying out of the outsourced functions, and adequately manage the risks associated with the outsourcing; appropriate action must be taken if it appears that the service provider may not be carrying out the functions effectively and in compliance with applicable laws and regulatory requirements; the investment firm must retain the necessary expertise to supervise the outsourced functions effectively and manage the risks associated with the outsourcing and must supervise those functions and manage those risks; the service provider must disclose to the investment firm any development that may have a material impact on its ability to carry out the outsourced functions effectively and in compliance with applicable laws and regulatory requirements; the investment firm must be able to terminate the arrangement for outsourcing where necessary without detriment to the continuity and quality of its provision of services to clients; the service provider must cooperate with the competent authorities of the investment firm in connection with the outsourced activities; the investment firm, its auditors and the relevant competent authorities must have effective access to data related to the outsourced activities, as well as to the business premises of the service provider; and the competent authorities must be able to exercise those rights of access; the service provider must protect any confidential information relating to the investment firm and its clients; the investment firm and the service provider must establish, implement and maintain a contingency plan for disaster recovery and periodic testing of backup facilities, where that is necessary having regard to the function, service or activity that has been outsourced.

← art_14__para_1__point_d__text_1 · All articles · art_14__para_2__text_1 →

Source: EUR-Lex (Cellar) · retrieved 2026-10-29 · Text as adopted (Official Journal); later amendments are not incorporated in this text.