CBI Thematic Inspection of Outsourcing Risk

On 6 March 2026, the Central Bank of Ireland (the Central Bank) issued a letter outlining the results of its Thematic Inspection of Outsourcing Risk - Fund Administrators and Depositaries (the Thematic Inspection). The Thematic Inspection focuses on Fund Administrators and Depositaries (each an FSP) and forms part of the Central Bank's integrated and sectoral approach to supervision and regulation, which prioritises areas presenting heightened operational and resilience risks.

Purpose and Scope

The Thematic Inspection assessed the robustness of FSPs' outsourcing oversight frameworks, taking into consideration:

• the Cross‑Industry Guidance on Outsourcing, and
• for Fund Administrators, Part 4, Chapter 2 of the Investment Firms Regulations 2023 and related Central Bank guidance.

The Central Bank assessed the outsourcing oversight frameworks in place across FSPs, focusing on governance, risk management and operational processes relating to outsourced activities; and examined these areas across three core components:

(i) outsourcing lifecycle (including risk and criticality assessments, due diligence, contractual arrangements and ongoing KPI/KRI monitoring);

(ii) governance and Board‑level reporting of outsourcing risks; and

(iii) day‑to‑day operational oversight of key outsourced activities (such as NAV calculation and sub‑custodian monitoring).

Key Findings

The Central Bank found that material deficiencies remain across outsourcing oversight frameworks, emphasising that weaknesses in governance, controls, and monitoring can expose firms to significant operational resilience risks. 

Examples of Good Practice

The Central Bank also set out non‑exhaustive examples of good practices observed as part of the Thematic Inspection, including:

• Outsourcing forums / committees: Dedicated outsourcing forums/committees to oversee outsourced activities.
• Outsourcing Manager: Appointment of a dedicated Outsourcing Manager, proportionate to the scale and risk profile of the FSP's outsourcing universe.
• Role of Second Line of Defence: Second‑line sign‑off on outsourcing proposals and risk assessments, as well as independent compliance assurance work.
• Outsourcing Risk Appetite Limits: Defined outsourcing risk appetite limits (at activity, outsourcing provider, and location level) to manage concentration and dependency risks.
• Risk Metrics: Multi‑layered risk metrics (e.g., outsourcing provider staffing levels, concentration data, incident monitoring, vendor performance).
• Due Diligence and Risk Assessments: Regular due diligence and risk assessments for all outsourcing arrangements, not only those deemed critical or important. For depositaries, sample testing of due diligence reports of the sub‑custody network and related legal advice.
• Outsourcing Oversight Documentation: Tailored outsourcing oversight documentation established such as Outsourcing Policy and Outsourcing Oversight Framework.  
• NAV Oversight: for Fund Administrators, strong NAV oversight, including automated maker‑checker processes with appropriate segregation and seniority.
• Outsourcing registers: for Depositaries, inclusion of prime broker arrangements within outsourcing registers.

Next Steps for Firms

The Central Bank expects FSPs to:

• bring the letter to the attention of the Board / Management Body;
• review the good practices alongside internal frameworks;
• evaluate whether enhancements are required across governance, oversight, documentation, and risk monitoring; and

If you would like support with assessing your outsourcing oversight framework or implementing enhancements, our team is available to assist.

Simmons & Simmons: Supporting Clients Across Ireland and Europe

Almost all firms across Ireland and the EU outsource and there is growing reliance on third party service providers for the delivery of key activities. While outsourcing can provide efficiencies, it also presents risk. Maintaining a robust outsourcing framework and ensuring effective management of outsourcing risk is a key element to ensuring not only effective risk management, but also a firm's operational resilience. 

At Simmons & Simmons, our Irish and pan-European teams advise clients on all aspects of outsourcing and operational resilience.

For further insights or to discuss how Simmons & Simmons can support your firm, please contact our Dublin or European Financial Service Regulatory teams.