This article examines how Iraqi banks can outsource functions to service providers while retaining the accountability that the Central Bank of Iraq expects. Banks increasingly rely on third parties for core banking systems, card processing, cloud services, cash handling, collections and other functions. Outsourcing can reduce cost and improve capability. It does not, however, transfer the bank’s regulatory responsibility. When something goes wrong at a service provider, the regulator will look to the bank.
The challenge is to structure outsourcing so that the bank retains control over the risks it has delegated. That requires assessment before contracting, contract terms that preserve oversight and access, ongoing monitoring and a credible plan for exit. Without these elements, a bank may find itself unable to answer regulatory questions, unable to access its own data or dependent on a provider it cannot replace.
The Banking Law No. 94 of 2004 and the Central Bank of Iraq Law No. 56 of 2004 provide the framework for the Central Bank’s supervision of banks, including their use of third parties. Central Bank instructions on outsourcing, information technology risk, cybersecurity and business continuity set out detailed expectations. The Anti-Money Laundering and Counter-Terrorism Financing Law No. 39 of 2015 applies where outsourced functions involve customer due diligence or transaction monitoring. The Electronic Signature and Electronic Transactions Law No. 78 of 2012 is relevant to electronic records. Banking secrecy obligations apply to customer information shared with providers.
Identifying what is being outsourced
The first step is to determine whether an arrangement is outsourcing for regulatory purposes and how material it is. Relevant questions include:
- Is the function one the bank would otherwise perform itself? Buying office supplies is not outsourcing in the regulatory sense. Using a third party to operate the core banking system usually is.
- Is the function critical or important? A failure would materially affect the bank’s operations, compliance or customers.
- Does the provider access customer data? Arrangements involving customer information raise confidentiality and data protection concerns.
- Where will the function be performed? Offshore performance raises questions about data location, regulatory access and applicable law.
Material outsourcing may require notification to or approval from the Central Bank before implementation. Commercial and regulatory advice in Iraq can help classify arrangements and identify regulatory steps.
Conducting due diligence on the provider
Before contracting, the bank should assess the provider’s financial stability, technical capability, security controls, business continuity arrangements, reputation and ownership. For providers that will handle customer data, the assessment should include data security, sub-contracting practices and the jurisdictions where data will be stored or processed. The results should be documented, because the regulator may ask how the provider was selected.
Drafting contract terms that preserve accountability
The outsourcing contract is the primary tool for retaining control. Key terms include:
- Service levels and reporting. Measurable standards, regular reports and consequences for failure.
- Audit and access rights. Rights for the bank, its auditors and the Central Bank to access the provider’s premises, systems, data and records relevant to the service.
- Data ownership and confidentiality. Confirmation that the bank owns its data, restrictions on use and disclosure and obligations to comply with banking secrecy.
- Security and incident notification. Security standards and prompt notification of breaches or incidents.
- Sub-contracting. Restrictions on sub-contracting without consent and flow-down of obligations.
- Business continuity. Obligations to maintain and test continuity arrangements.
- Termination and exit. Rights to terminate, obligations to assist with transition and return of data in a usable format.
Providers, particularly large international technology providers, may resist some of these terms. The bank should prioritise those required by the regulator and those protecting its ability to respond to supervisory requests.
Managing data location and regulatory access
Where data will be stored or processed outside Iraq, the bank should confirm whether Central Bank requirements permit this, whether approval is needed and how the Central Bank will be able to access the data. Local data residency requirements, where applicable, may require certain data to remain in Iraq. Contracts should ensure that foreign law does not prevent the provider from giving the bank or the regulator access to data when required.
Monitoring performance and risk
Outsourcing requires ongoing oversight. The bank should assign responsibility for each material arrangement to a named manager, receive regular performance reports, conduct periodic reviews and audits and report material arrangements to the board or a board committee. Incidents and service failures should be recorded, analysed and addressed. The bank’s internal audit function should include outsourced activities in its audit plan.
Planning for exit
A bank should never become so dependent on a provider that it cannot leave. Exit plans should identify alternative providers or in-house options, the time and cost required to transfer and the data and assistance needed from the outgoing provider. For critical systems, the exit plan should be tested or at least reviewed periodically. Contracts should require the provider to continue services during a transition period after termination.
Handling intra-group outsourcing
Arrangements with group companies are outsourcing too, and should meet the same standards. Group membership does not guarantee continued service if the group restructures or sells the provider. Intra-group contracts should be documented, priced appropriately and subject to the same oversight. Corporate advice in Iraq can help structure intra-group arrangements consistently with regulatory requirements.
Addressing cybersecurity and incident response
Outsourcing technology functions increases the bank’s exposure to cyber incidents at the provider. A breach at a core banking or card processing provider may expose customer data, disrupt services and trigger regulatory reporting obligations. The bank remains responsible for responding to customers and the regulator, even if the incident occurred at the provider.
The outsourcing contract should therefore include specific cybersecurity provisions:
- Security standards. Minimum controls, such as encryption, access management and vulnerability testing, consistent with Central Bank requirements and recognised standards.
- Incident notification. Immediate notification of incidents affecting the bank’s data or services, with defined timeframes and content.
- Cooperation in response. Obligations to support investigation, containment and recovery, and to provide information needed for regulatory reports.
- Testing. Rights to review penetration test results and to participate in or require joint incident exercises.
The bank’s own incident response plan should cover incidents at providers, identifying who decides on customer communications, who reports to the Central Bank and how services will be restored or switched to backup arrangements. Testing these plans with key providers helps ensure that, when an incident occurs, responsibilities are clear and the response is fast.
Illustrative example. An Iraqi bank contracts with a foreign provider for a cloud-based core banking system. The contract, based on the provider’s standard terms, allows the provider to store data in several jurisdictions, gives the bank limited audit rights and contains no regulator access clause. When the Central Bank asks for transaction records during an inspection, the bank cannot obtain them promptly. The bank renegotiates the contract to include regulator access rights, defined data locations and an exit assistance obligation, and reports the arrangement to the Central Bank.
Conclusion & how Etihad Law Firm can help
Outsourcing can strengthen an Iraqi bank’s operations, but responsibility stays with the bank. Proper classification, provider due diligence, protective contract terms, active oversight and exit planning allow banks to benefit from outsourcing while meeting the Central Bank’s expectations.
Etihad Law Firm advises Iraqi banks and service providers on outsourcing arrangements, technology contracts and regulatory requirements. We help clients negotiate terms that preserve accountability and satisfy supervisory expectations.