Clear Principles. Systematic Management. Regulatory Compliance.

Outsourcing Policy: Regulatory Compliance Framework

A well-founded outsourcing policy forms the foundation for structured and regulatorily compliant outsourcing management.

  • 01Clear principles and decision criteria for outsourcing arrangements
  • 02Compliance with regulatory requirements and best practices
  • 03Transparent governance and control structures
  • 04Systematic risk minimization in outsourcing arrangements
View services
11+Years of experience
120+Employees
540+Projects
ISO 27001certified

Outsourcing Policy: Regulatory Requirements and Implementation

The outsourcing policy is the central governance framework for all outsourcing activities of a financial institution. It defines principles, decision criteria and governance structures under MaRisk AT 9 and KWG 25b. Since the 6th MaRisk amendment in 2021 and with DORA effective from 2025, BaFin requirements for systematic outsourcing management have increased substantially.

Our support in developing an outsourcing policy encompasses the analysis of existing structures and guidelines, the identification of relevant regulatory requirements, the development of tailored principles and guidelines, as well as support during the implementation and communication of the policy within the organization.

3 service modules

What we take on for you

Bookable individually or as an end-to-end programme.

01

Development of a Tailored Outsourcing Policy

We develop an outsourcing policy tailored to your specific requirements that fulfills regulatory requirements and is practical to implement.

  • Analysis of your current outsourcing landscape and processes
  • Identification of relevant regulatory requirements and best practices
  • Development of tailored principles and guidelines
  • Drafting of a comprehensive outsourcing policy
02

Revision of Existing Outsourcing Policies

We support you in revising and updating your existing outsourcing policy to integrate new regulatory requirements and improve effectiveness.

  • Gap analysis of the existing outsourcing policy
  • Identification of areas for improvement and regulatory gaps
  • Integration of new regulatory requirements and market developments
  • Optimization of the structure and applicability of the outsourcing policy
03

Implementation Support and Change Management

We accompany you in the successful introduction and implementation of your outsourcing policy in day-to-day business operations.

  • Development of an effective change management strategy
  • Creation of communication materials and training documents
  • Conducting awareness workshops for relevant stakeholders
  • Support during integration into existing processes and systems

5 phases

Our Approach

When developing an outsourcing policy, we proceed systematically and collaboratively to achieve a result that is both regulatorily sound and practically applicable.

  1. Analysis of the status quo and regulatory requirements

  2. Stakeholder interviews and requirements gathering

  3. Development of the core elements of the outsourcing policy

  4. Review and alignment with relevant business units

  5. Finalization and support during implementation

Sarah Richter

Your contact

Sarah Richter

Head of Information Security, Cyber Security

10+ years of experience, CISA, CISM, Lead Auditor, DORA, NIS2, BCM, Cyber and Information Security

+49 69 913 113-01 info@advisori.de LinkedIn
A well-designed outsourcing policy is more than a regulatory requirement — it is a valuable management instrument. It creates clarity on objectives, principles, and responsibilities, and enables well-founded decisions that are aligned with the corporate strategy.

Our Strengths

  • 01Extensive experience with regulatory requirements across various industries
  • 02Combination of best practices and individual adaptation to your organizational structure
  • 03Practice-oriented implementation with a focus on applicability in day-to-day business operations
  • 04Integration of current trends and regulatory developments

Expert Tip

An effective outsourcing policy should not only fulfill regulatory requirements, but also be practical and integrable into day-to-day operations. Pay attention to clear, understandable language and ensure that the policy is understood and accepted by all relevant stakeholders. A policy that is overly complex or disconnected from practice often remains ineffective.

7 QUESTIONS, BRIEFLY ANSWERED

Frequently asked questions about Outsourcing Policy

What must an outsourcing policy under MaRisk AT 9 contain?

An outsourcing policy under MaRisk AT 9 must include: Strategic principles for outsourcing decisions, criteria for distinguishing material from non-material outsourcing arrangements (materiality criteria), risk analysis requirements prior to each outsourcing, governance structure with clear roles and responsibilities including an outsourcing officer, minimum contractual requirements per KWG 25b, specifications for the outsourcing register and processes for ongoing monitoring and annual reporting to the management board.

What is the difference between material and non-material outsourcing?

Under MaRisk AT 9, an outsourcing arrangement is material when the outsourced activity could significantly impair the institution's financial position, business strategy or regulatory compliance if it fails or is performed inadequately. Material outsourcings are subject to stricter requirements: comprehensive risk analysis, detailed contracts with audit and access rights, mandatory notification to BaFin via the MVP portal since 2023 and ongoing monitoring. Non-material outsourcings require simplified risk analysis and documentation but must still be recorded in the outsourcing register.

What role does BaFin play in outsourcing governance?

BaFin supervises compliance with outsourcing requirements by credit institutions and financial service providers. Specifically, BaFin requires: A documented outsourcing policy as part of risk management, notification of material outsourcing arrangements via the MVP portal (mandatory since 01.01.2023 under FISG), a current outsourcing register covering all material and non-material outsourcings, annual reports to the management board on all material outsourcing arrangements. BaFin reviews the adequacy of outsourcing management during special examinations and annual audits (Section 44 KWG).

How does outsourcing differ from third-party procurement under MaRisk?

Under MaRisk, outsourcing exists when another company is tasked with performing activities and processes related to banking business, financial services or other institution-typical services that the institution would otherwise perform itself. Third-party procurement (sonstiger Fremdbezug) covers services that do not constitute banking business and do not replace institution-typical activities, such as facility cleaning or catering. This distinction is critical because only outsourcing arrangements are subject to the strict MaRisk AT 9 requirements.

What additional requirements does DORA impose on the outsourcing policy?

Since January 2025, the Digital Operational Resilience Act (DORA) supplements MaRisk requirements for ICT services. DORA additionally requires: An ICT third-party register (Register of Information), stricter requirements for ICT providers with critical functions, incident reporting within 4 hours for major ICT incidents, regular Threat-Led Penetration Tests (TLPT) and exit strategies for critical ICT outsourcings. Institutions must extend their outsourcing policy with DORA-specific provisions and manage the parallel governance of MaRisk outsourcings and DORA ICT third-party arrangements.

What must be documented in the outsourcing register?

The outsourcing register is a mandatory document under MaRisk AT 9. It must contain: Description of the outsourced activity and its criticality classification, name and location of the outsourcing provider, contract duration and termination periods, risk analysis results, information on sub-outsourcing arrangements, assignment to the responsible outsourcing officer. Since the 6th MaRisk amendment, the register must cover both material and non-material outsourcings and be kept up to date. For ICT outsourcings, DORA additionally requires a separate Register of Information.

How does ADVISORI support outsourcing policy development?

ADVISORI supports banks and financial institutions in developing and implementing a MaRisk-compliant outsourcing policy: Gap analysis of the existing policy against MaRisk AT 9, KWG 25b, EBA Guidelines and DORA requirements, drafting or revision of the outsourcing policy with practical materiality criteria, setup of the outsourcing register and BaFin notification processes, implementation of governance structures and monitoring processes, training of relevant departments and alignment with internal audit. Our approach combines regulatory compliance with operational efficiency.