Outsourcing notification: documents to prepare
An outsourcing notification file needs four elements before it goes anywhere: a description of the function being outsourced, the risk assessment behind that choice, the contract with the provider, and evidence that the provider was checked before signature. A file missing any one of these four items is returned for completion, not reviewed on the merits. The fastest filings are the ones prepared before the provider is chosen, not after.
What changes once the outsourcing arrangement exists
Once a function moves to an external provider, the supervised entity keeps the responsibility. The notification does not transfer accountability — it records that the entity has assessed the risk and can still answer for the outcome. This matters most where the outsourced function touches client data or transaction processing, because an incident at the provider is treated as an incident at the entity itself. A separate question, worth understanding before the notification is drafted, is how such an incident is defined and reported: Incident data protection explained.
A second consequence follows from the first. If the provider fails, is acquired, or changes its own subcontracting chain, the notification file is usually the first document the supervisor asks to see again. Keeping it current is cheaper than rebuilding it under pressure.
Documents to prepare
| Document | Purpose | Prepared by |
|---|---|---|
| Function description | States what is outsourced and why it is not performed in-house | Business owner of the function |
| Risk assessment | Records the risks identified and how they are mitigated | Risk or compliance function |
| Provider due diligence file | Evidence the provider was checked before signature — financial standing, security posture, subcontracting chain | Compliance function, with input from the provider |
| Contract or draft contract | Sets out service levels, audit rights, exit terms and data handling | Legal function, negotiated with the provider |
| Exit plan | Describes how the function is brought back in-house or moved elsewhere | Risk or compliance function |
| Internal sign-off | Confirms the arrangement was approved at the appropriate level before notification | Management body or delegated committee |
What to do
- The business owner drafts the function description before the provider is finalised, so the notification is not written retrospectively.
- The compliance function runs due diligence on the shortlisted provider and records the findings, even where the outcome is positive.
- The legal function drafts or finalises the contract in parallel with due diligence, not after it, so gaps found late can still be closed in the text.
- The risk function completes the assessment and the exit plan once the contract terms are known.
- Management signs off the arrangement internally before the notification is sent.
- The compliance function submits the file and tracks the acknowledgement date — this is the reference point for any later questions.
Who decides
The notification is addressed to the supervisor responsible for the entity's authorisation. In practice, the file is reviewed by a supervisory case officer, who may request clarification before treating the notification as complete. A notification is not an approval request in the ordinary sense — the supervisor is not asked to say yes. It is asked to note the arrangement and reserve the right to object within a set window. Silence past that window is not the same as approval; it is the absence of an objection, and the distinction matters if the arrangement is challenged later.
Point of no return
The point of no return is not the day the contract is signed. It is the day the outsourced function goes live and client-facing processes start relying on it. Before that day, a defective notification can still be corrected without operational disruption. After it, correcting a gap in the file means correcting it while the function is already running, under supervisory attention rather than before it.
Where the file typically runs into trouble
If the provider's core service depends on a registered mark or licensed technology that is later challenged, the due diligence file needs to show that this risk was considered, not discovered afterwards. The steps for challenging such a registration are described separately: Invalidity and revocation step by step.
If the provider's technology was built by a founder or engineer who has since left the company, ownership of that technology may be less settled than the contract assumes. A related situation, outside outsourcing but instructive on what a register does and does not confirm, is discussed here: Industrial manufacturing — when a founder leaves with the prototype.
If the outsourced function involves custody or transfer of tokenised assets, ownership of the underlying token can be less clear than the transaction record suggests, and the notification file should reflect that this was checked, not assumed. See: When the buyer of a token is not the rights owner.
What this page does not cover
This page covers the documents and the sequence for a straightforward outsourcing notification. It does not cover what happens when the arrangement changes hands entirely — a change of control at the entity itself follows a different notification path with different documents and a different point of no return: Change of control approval step by step. It also does not set out the precise regulatory basis for the notification duty in any given jurisdiction — that depends on the entity's authorisation and is confirmed case by case, not summarised generically here.
Verified
This overview reflects current administrative practice as observed in supervisory filings within the EU digital asset framework, last reviewed on 2025-05-14. It does not cite specific statutory provisions; the applicable notification duty and timing should be confirmed against the entity's own authorisation terms.
Frequently asked questions
How long does outsourcing notification take in practice?
The internal preparation stage — due diligence, contract, risk assessment — usually takes longer than the supervisory review itself. Entities that start the file before choosing the provider tend to notify within weeks of signature; entities that start afterwards often need months to close the gaps found during review.
Which documents are needed to start?
Start with the function description and the provider due diligence file. Both can be drafted before the contract is final, and both shape what the contract needs to say about audit rights, data handling and exit.
What happens if the other side does not respond?
If the supervisor does not raise an objection within its review window, the entity may proceed, but this is not a formal approval and does not appear as one in the file. Keep the acknowledgement date and the content of the submission, since these are what a later review will look at.