Outsourcing Rules When a Platform Uses a Foreign Custodian
Outsourcing a function does not outsource the obligation. Four requirements that follow a platform wherever it sends the work.
Platforms commonly use third parties for custody, technology and screening. The rules on this are consistent across frameworks.
Requirement one: responsibility is retained
The authorised firm remains responsible to its customers and to the supervisor for an outsourced function, exactly as if it performed the function itself.
In plain terms: the platform cannot point at its custodian when something goes wrong.
Requirement two: due diligence on the provider
The firm must assess the provider’s competence, capacity and financial soundness before appointing it, and keep that assessment current.
This is a documented process, not a commercial judgement.
Requirement three: a written agreement
Specifying the service, performance standards, access rights, confidentiality, and termination. In particular the supervisor’s right of access to the provider’s records.
A supervisor unable to examine an outsourced function cannot supervise the firm.
Requirement four: notification and material outsourcing
Material outsourcing arrangements generally require notification to, or approval from, the supervisor. Custody of client assets is material by any reasonable test.
What this means in a chain
Where a custodian itself outsources, the obligations follow. A firm that cannot say who ultimately holds client assets has not met the first requirement.
What a customer can ask
Who holds the assets, whether they are held directly, and whether the supervisor has been notified. The third question is unusual and informative.
Where the law is less clear
The treatment of technology providers whose failure would halt the service without touching client assets. Materiality tests differ and practice is still forming.
Why the rules exist in this form
Because outsourcing was historically used to move activity beyond a supervisor’s reach, and the rules are written to prevent exactly that.
What to look for
A platform that names its custodian and can describe the arrangement. Platforms that collect the documents the regulator expects are generally the ones that have documented the outsourcing too.
A licensed exchange under a named supervisor has filed these arrangements whether or not it publishes them, and Collect & Exchange operates inside a framework that requires it.
This page restates a published requirement. It is not the requirement itself and it is not legal advice. Rules change, and some take effect on a date later than their publication.