Outsourcing Policy for Central Recordkeeping Agency Under NPS

Pension Fund Regulatory & Development Authority 1st Floor, ICADR Building, Plot No. 6, Vasant Kunj Institutional Area, Phase - II, New Delhi - 110070 Tel : 011-26897948/26897949 Fax : 011-26897938

CIRCULAR

PFRDA/2016/4/CRA/TB/2

Date: 29th January, 2016

Subject: Outsourcing Policy for Central Recordkeeping Agency (CRA) under NPS

1. PFRDA (Central Recordkeeping Agency) Regulations, 2015 provides details of role and responsibilities of CRA with a view that they shall render at all times with high standards of service and exercise due diligence and ensure proper care in their operations.

2. It has been observed that often CRA resort to outsourcing with a view to reduce costs, and at times, for strategic reasons. However, there is no outsourcing policy prescribed for the CRA as on date.

3. The department has examined the outsourcing practice of the CRA under NPS on various parameters and has come out with the principles of outsourcing for CRA, based on which the CRA are advised to ensure the following:

• i. The CRA shall formulate and document an outsourcing policy duly specifying the reasons for such an outsourcing and how it is going to be beneficial to the ultimate subscriber and the NPS as a system. Such policy has to be approved by their Board of the CRA based on the guidelines given below and the principles of outsourcing outlined at annexure-1.
• ii. The CRA desirous of outsourcing their activities shall not however, outsource their core business activities and compliance functions. The indicative list of core and non-core activities of CRA has been identified by the authority, shall include but not limited to those listed in Annexure -II:
• iii. Information Technology support infrastructure / activities for running the activities of CRA(other than software development and hardware) shall not be outsourced to the extent possible. Wherever, they are outsourced the same shall form part of the outsourcing policy approved by the Board of CRA.
• iv. The CRA shall conduct appropriate due diligence in selecting the third party to whom activity is proposed to be outsourced and ensure that only reputed entities having high delivery standards are selected. However, it may be noted that the liability of the CRA and outsourced

activity towards any errors of omission and commission is joint and several vis-à-vis the subscribers and in terms of the PFRDA (Central recordkeeping agency) Regulations, 2015.

• v. The CRA shall ensure that risk impact analysis is undertaken before outsourcing any activity and appropriate risk policy and mitigation measures.
• vi. An effective monitoring of the entities selected for outsourcing shall be done to ensure that there is check on the activities of outsourced entity. The CRA shall strive to automate their processes and workflows to the extent possible which shall enable real time monitoring of outsourced activities. Also, CRA shall devise the processes in such a manner that there is a maker and checker system between the outsourced entity and the CRA to the extent possible.
• vii. The outsourcing policy document shall act as a reference for audit of the outsourced activities. Audit of implementation of risk assessment and mitigation measures listed in the outsourcing policy document and outsourcing agreement/ service level agreements pertaining to IT systems shall be part of System Audit of the CRA.
• viii. Other Obligations

(a) Reporting To Financial Intelligence Unit (FIU) and reporting under FATCA - The CRA shall be responsible for reporting of any suspicious transactions / reports to FIU or and other competent authorities in respect of subscriber contributions and related data.

(b) Need for Self-Assessment of existing Outsourcing Arrangements – In view of the changing business activities and complexities of National pension System (NPS), CRA shall conduct a self-assessment of their existing outsourcing arrangements within a time bound plan and submit the Board approved outsourcing policy of the CRA to the Authority on or before 31st March, 2016 and bring all such activities as are covered under the board approved policy in line with the requirements.

(c) The outsourcing entities shall be evaluated at periodic intervals at-least quarterly and the exceptions and improvements in processes suggested shall be placed to the Board for review of the outsourcing policy at least annually.

[Image omitted. See the official document.]

(Venkateswarlu Peri) General Manager, PFRDA Date: $29/1/16$

Annexure I

Principles for Outsourcing for CRA

1. The CRA seeking to outsource activities shall have in place a comprehensive policy to guide the assessment of whether any activity needs to be outsourced in terms of long term nature of the relationship between CRA, how it is going to be beneficial to ultimate subscriber and how these activities shall be outsourced. The Board of the CRA shall have the responsibility for the outsourcing policy and related overall responsibility for activities undertaken under that policy.

2. The CRA shall establish a comprehensive outsourcing risk management programme to address the outsourced activities and the relationship with the third party.

3. The CRA shall ensure that outsourcing arrangements neither diminish its ability to fulfill its obligations to customers and regulators, nor impede effective supervision by the regulators.

4. The CRA shall conduct appropriate due diligence in selecting the third party and in monitoring of its performance. Any outsourcing so done with the approval of the Board shall not be further delegated without the concurrence of the Board.

5. Outsourcing relationships shall be governed by written contracts / agreements /terms and conditions (as deemed appropriate) {hereinafter referred to as "contract"} that clearly describe all material aspects of the outsourcing arrangement, including the rights, responsibilities and expectations of the parties to the contract, client confidentiality issues, termination procedures, etc.

6. The CRA and its outsourced entity shall establish and maintain contingencyplans, including a plan for disaster recovery and periodic testing of backup facilities.

7. The CRA shall take appropriate steps to require that third parties protect confidential information of both the intermediary and its customers from intentional or inadvertent disclosure to unauthorized persons.

8. Potential risks posed where the outsourced activities of multiple CRA are concentrated with a limited number of third parties.

[Image omitted. See the official document.]

Annexure II

• The indicative list of Core and Non-core activities for CRA.