Outsourcing notification: what the decision maker looks at
When a firm notifies its regulator about an outsourcing arrangement, the decision maker checks three things: whether core functions stay under the firm's own control, whether the provider is fit for the assigned tasks, and whether the notification arrived before the arrangement went live. Miss any of the three and the file stalls at intake.
How the file is assessed
The review does not start from a blank page. The case officer checks the file against the authority's published outsourcing framework and against the risk profile the firm already has on record. A firm with a clean supervisory history moves through intake faster than a firm under active monitoring. The officer is not deciding whether outsourcing is allowed in principle — that question was settled at authorisation. The officer is deciding whether this specific arrangement keeps the firm accountable for the outsourced function, and whether the firm can still answer for it if the provider fails.
Two things carry more weight than the rest of the file. First, whether the firm keeps genuine oversight of the outsourced task, rather than handing over decision-making along with the task itself. Second, whether the provider's own controls are documented well enough for the authority to form a view without asking a second round of questions.
Stages and who is involved
Four stages structure most files, though the names vary between authorities and the stages sometimes overlap in practice.
| Stage | Who handles it | What sets its length |
|---|---|---|
| Intake check | Case officer | Whether the file is complete on first submission |
| Substantive review | Supervisory team | How central the outsourced function is to the firm's licence |
| Internal sign-off | Senior reviewer | Whether the arrangement needs escalation |
| Outcome communicated | Registry office | Standard drafting and clearance time |
A file that clears intake on the first pass rarely needs the escalation step at all. A file that comes back at intake restarts the clock from the beginning, not from where it left off.
What to prepare and submit
- List every outsourced function and the receiving entity, one line per function. Compliance officer.
- Attach a risk assessment covering the provider's ability to perform the function reliably. Outsourcing owner.
- Submit the notification before the arrangement starts operating, not after it has already gone live. Authorised representative.
- Confirm who is entitled to sign on the firm's behalf; a mismatched signatory is a common reason for a file to be returned. How that authority is documented elsewhere in the registry is covered in Representation requirements in ownership of results. Legal team.
- Keep the underlying outsourcing contract on file and ready for inspection, even where it is not submitted with the initial notification. Legal team.
- Track the acknowledgement and answer any clarification request inside the stated window. Case owner.
Who decides and how
The case officer makes the first call. Complex or high-impact arrangements go to a senior reviewer inside the same department, sometimes with input from an internal risk committee. Communication runs in writing throughout; a hearing is uncommon and used only when the file raises a point the written record cannot settle on its own. The authority sets its own review window and can pause it once, in writing, if the file is incomplete or if the answer to an earlier question raises new questions.
Common forks
- If the outsourced function is critical to the firm's licensed activity, expect a closer look at the provider's resilience and at the firm's exit plan if the provider fails.
- If the provider sits outside the EU or EEA, expect extra questions about access to data and about audit rights over the provider's systems. A step-by-step approach to that particular check is covered separately in Transfer mechanism assessment step by step.
- If the case officer flags the file as incomplete, the review clock resets and the file returns to intake rather than moving forward on a partial record.
What this page does not cover
This page describes the notification stage only. It does not cover the cost or the commercial terms of the underlying outsourcing contract, and it does not cover a challenge to an arrangement the authority has already accepted. That later kind of review follows a different logic, closer to how a decision maker revisits a right that already exists; see Invalidity and revocation step by step for how that pattern runs in a different registry. It also does not replace the firm's own legal review of the outsourcing agreement itself, which should happen before the notification is drafted, not after.
Verified
Checked against publicly available supervisory guidance and the authority's own published outsourcing framework as of the current review cycle. Practice varies between authorities and between types of arrangement notified. Treat the stages above as the common pattern rather than a fixed timetable, and confirm the current window with the specific authority before relying on it for a deadline.
Related publications
A related decision-maker review sits nearby in the same practice area. See Change of control approval step by step for how that notification is assessed by the same authority.
FAQ
How long does outsourcing notification take in practice?
There is no fixed countdown published for every case type. The length depends on how complete the file is at submission and how central the outsourced function is to the firm's licence. A clean, complete file moves through intake quickly. A file needing clarification takes longer, because the clock pauses while the authority waits for the answer.
Which documents are needed to start?
The core set is the notification form, a description of the outsourced function, the receiving provider's details, and a risk assessment covering the provider's ability to perform that function. The underlying contract should be ready for inspection even if it is not submitted with the initial file.
What happens if the other side does not respond?
If the provider does not confirm details requested by the authority, the case officer treats the file as incomplete rather than assessing it on the merits. The firm, not the provider, carries the risk of that silence, because the notification duty sits with the firm and cannot be delegated to the party being notified about.
Next step
Outsourcing notifications rarely stand alone; firms often review them alongside the wider authorisation file. If a referenced work has been pulled from an arrangement mid-file, see When the referenced work is removed for what to check first.