If an authorized institution intends to outsource, it should first complete an internal assessment to identify the relevant risks posed by the proposed outsourcing and how they will be addressed, including an assessment to determine whether the outsourcing is "material" in nature. An outsourcing of a banking-related activity (including back office activities) or significant changes to the scope of an existing outsourcing of such activities is more likely to be material in nature and should be notified in advance to the Hong Kong Monetary Authority ("HKMA"). The HKMA will need to be satisfied that all the major issues set out in the Supervisory Policy Manual SA-2 entitled "Outsourcing" and any other applicable requirements are appropriately addressed. It may need to preapprove or provide a letter of no objection for the plan before it is implemented. The HKMA typically requires at least one month's advance notice, but a longer period is advisable. 

Securities and Futures Commission ("SFC")

Where a licensed corporation regulated by the SFC proposes to keep regulatory records exclusively with an electronic data storage provider ("EDSP"), it will need to comply with the requirements of the Circular to Licensed Corporations on Use of External Electronic Data Storage dated 31 October 2019 and EDSP frequently asked questions. These include the following:

• Obtaining prior approval from the SFC for all the premises to be used for keeping such regulatory records
• Providing the SFC with an EDSP undertaking or a manager(s)-in-charge/responsible officer undertaking and having all supporting materials, including a data access map, prepared and available upon request