Under the Regulations Governing Internal Operating Systems and Procedures for the Outsourcing of Financial Institution Operation (“Regulations”), any outsourcing arrangements involving offshore service providers are subject to the preapproval requirement of the Financial Supervisory Commission (FSC), regardless of whether the outsourced service would be considered material in nature.

According to the draft amendments to the Regulations ("Draft Amendments"), on one hand, a financial institution must apply to the competent authority (i.e., the FSC) for approval before outsourcing the IT system of its material consumer banking business to a service provider located in a foreign country. On the other hand, if the business is "nonmaterial," "nonconsumer banking business" or "non-overseas," a financial institution is not required to apply for preapproval from the FSC. 

Paragraph 5, Article 4 of the Draft Amendments provides that there will be "material" outsourcing in any one of the following situations:

• The outsourcing operation is unable to provide services or has information security concerns that have a significant impact on the financial institutions' business operations.
• The outsourcing operation involves a security incident involving customer information, which has a significant impact on the financial institutions, or customer rights.
• Other outsourcing operations occur that have a significant impact on financial institutions or the rights and interests of customers.

The Draft Amendments relax the requirement for "systems for corporate banking business" and "nonmaterial systems for consumer banking business" to apply for approval for overseas outsourcing. However, the FSC still appears to have reservations about the outsourcing of "material systems for consumer banking business" to foreign countries. The standard for what constitutes "material" systems for consumer banking business remains ambiguous under current regulatory guidance.