Under the Outsourcing Guidelines, a financial institution must obtain written approval from Bank Negara Malaysia before (a) entering into a new material outsourcing arrangement, or (b) making a significant modification to an existing material outsourcing arrangement. The financial institution will need to evaluate whether the arrangement is "material."
If the financial institution holds a capital markets and services license ("CMSL Holder"), it is only required to notify the Intermediary and Fund Supervision Division of the Securities Commission Malaysia ("SC") within two weeks of signing the service level agreement for any material outsourcing arrangement. In such instance, the required information for the notification is set out in the Licensing Handbook and should include the following:
- A description of the material outsourced functions
- An explanation of the rationale for outsourcing to the cloud service provider or subcontractor outside Malaysia and an explanation of why the specific function could not be undertaken domestically (if applicable)
A letter of undertaking is also required from the cloud service provider or subcontractor. The undertaking must state that the SC, stock exchange, derivative exchange and their agents will have access to all information, records and documents relating to the material outsourced arrangement(s). The letter of undertaking must be attached to the notification form.
The CMSL Holder must continue to notify the SC of any variation or termination of the contract with the service provider for the material outsourcing arrangement, or any adverse development arising in relation to the outsourcing arrangement of any outsourced function that could have a significant impact on the CMSL Holder within two weeks from the occurrence of the event.