Cross-border outsourcing and risk management for banks

U.S. banks are increasingly outsourcing an expanding range of their operations to third-party service providers. Recent industry estimates show that outsourcing by U.S. banks accounts for almost 20 percent of their information technology services spending. Importantly, the prospect of considerable cost savings and access to scarce information processing and development resources has led a growing number of banks to consider making greater use of foreign-based service providers – that is, of engaging in ‘cross-border outsourcing’. Notwithstanding the potential cost savings that can result from outsourcing offshore, banks face significant risk management challenges from these activities. Some of these challenges are unique to cross-border outsourcing while others, associated with risk management for domestic service providers, may take on added significance for cross-border outsourcing. Managing the risks associated with cross-border outsourcing is extremely important, especially in the case of the banking industry where problems can take on systemic significance and can affect confidential customer or bank records. In consequence, the Office of the Comptroller of the Currency has published risk management guidelines for banks engaging in cross-border outsourcing. This article summarizes that guidance, placing the discussion in the context of the recent rapid growth in outsourcing. Among the most important risk management challenges to assess and address are: 1) the strategic fit that cross-border outsourcing will provide for a bank’s overall operations; 2) country risk, which includes social, economic, and political instability; 3) legal and compliance risks related to the potential applicability of foreign jurisdictional laws to the outsourced activities; and 4) operational risks related to security and confidentiality of bank and customer information.