76J.— (1) Subject to the other provisions of this section, a credit union may by an agreement in writing entered into with any person (in this section referred to as a "service provider") and upon such terms and conditions as may be specified in the agreement, provide for the performance by that person, subject to such terms and conditions (if any) as may be so specified, of such process, service or activity (in this section referred to as "outsourced activities") of the credit union as may be so specified.

(2) The respective rights and obligations of the credit union and of the service provider shall be clearly allocated and set out in a written agreement.

(3) A credit union shall exercise due skill, care and diligence when entering into, managing or terminating any outsourced activities with a service provider.

(4) A credit union shall not enter into an agreement with a service provider for the performance of any of the functions exercisable by the board of directors of the credit union under section 55(1) but, subject to any matter that may be prescribed by the Bank, this shall not prevent the credit union from entering into an agreement under subsection (1) with a service provider for the provision of services in respect of any business activity (other than any such function) that is preliminary to or consequential upon the exercise by that board of the function concerned.

(5) The following conditions shall form part of every agreement to provide outsourced activities between a credit union and a service provider:

(a) the service provider has the ability, capacity and any authorisation required by law to perform those activities reliably and professionally;

(b) the service provider will carry out those activities effectively;

(c) the service provider shall properly supervise the carrying out of those activities, and adequately manage the risks associated with the outsourcing;

(d) appropriate action shall be taken by the credit union if it appears to it or to the Bank that the service provider may not be carrying out those activities effectively and in compliance with any applicable laws and regulatory requirements;

(e) the service provider shall disclose to the credit union any development that may have a material impact on its ability to carry out the outsourced activities effectively and in compliance with applicable laws and regulatory requirements;

(f) the credit union may terminate the arrangement for outsourcing, where necessary, without detriment to the continuity and quality of its provision of services to members;

(g) the service provider shall, when required, co-operate with the Bank in connection with the outsourced activities;

(h) the credit union, its auditors and the Bank shall have effective access to data related to the outsourced activities, as well as to the business premises of the service provider;

(i) the Bank shall have without notice the right of access to the business premises of the service provider for the purposes of paragraph (g);

(j) the service provider shall keep any confidential information relating to the credit union or its members in a safe and secure manner.

(6) For the purposes of every agreement to provide outsourced activities between a credit union and a service provider, the credit union shall—

(a) ensure that the service provider has no conflicts of interest in relation to the outsourced activity,

(b) retain the necessary expertise to supervise the outsourced activities effectively, manage the risks associated with the outsourcing and supervise those activities and manage those risks,

(c) establish methods for assessing the standard of performance of the service provider, and

(d) be capable of resuming direct control over any outsourced activity or ensure that alternative arrangements are in place to provide the outsourced activities without detriment to the proper operation and functioning of the credit union or the continuity and quality of its provision of services to members.

(7) Where—

(a) an agreement under this section has been entered into between a credit union and a service provider, and

(b) it is necessary having regard to the activities that have been outsourced,

then the credit union and the service provider shall both establish, implement and maintain a business continuity plan and the credit union shall ensure that such plan is integrated, as necessary, within the business continuity plan referred to in section 76I.

(8) An outsourced activity shall not impair—

(a) the orderliness of the conduct of the credit union’s business,

(b) the credit union’s ability to manage and monitor its business,

(c) the ability of the board of a credit union to undertake its functions,

(d) the ability of the credit union to comply with requirements imposed under financial services legislation,

(e) the supervision of the credit union by the Bank, and

(f) the quality of the credit union’s internal controls.

(9) Where a credit union has outsourced activities, the credit union remains legally responsible for compliance with requirements imposed under financial services legislation in respect of those activities.

(10) Nothing in this section shall be construed—

(a) as applying to any person in his or her capacity as an officer of the credit union, or

(b) as affecting any contract (whether oral or in writing) entered into between the credit union and any person for the performance by that person of any minor non-business activity where a defect or failure in its performance could not impair—

(i) the continuing compliance with the conditions and obligations of the credit union’s registration or its other obligations under the financial services legislation,

(ii) the credit union’s financial performance,

(iii) the soundness or continuity of the credit union’s financial performance, or

(iv) the soundness or continuity of the credit union’s business.

(11) (a) A credit union shall notify the Bank, in writing—

(i) when it is proposed to outsource to a service provider a material business activity, or

(ii) of any material development affecting the service provider F223[and the service provider’s ability] to fulfil its obligations.

(b) In this subsection and subsection (12) "material business activity" means an activity where a defect or failure inits performance would materially impair—

(i) the continuing compliance with the conditions and obligations of its registration or its other obligations under the financial services legislation,

(ii) its financial performance,

(iii) the soundness or continuity of its financial performance, or

(iv) the soundness or continuity of its business.

(12) (a) The Bank may prescribe the matters that a credit union shall have regard to when selecting a service provider.

(b) Without prejudice to the generality of paragraph (a), requirements for the purposes of that paragraph may include any of the following:

(i) the formalities to be involved in engaging a service provider for the purposes of a proposed outsourced activity including, for the purposes of subsections (1) and (2), the nature and content of written agreements to be entered into between the credit union and the service provider prior to commencement of the outsourcing activity;

(ii) the arrangements for notifying the Bank in writing when a material business activity is proposed to be outsourced;

(iii) the arrangements for notifying the Bank in writing of a material development affecting a service provider and what constitutes a material development.

(13) In prescribing matters for the purposes of this section, the Bank shall have regard to the need to ensure that the requirements imposed by the regulations made by it are effective and proportionate having regard to the nature, scale and complexity of credit unions, or the category or categories of credit unions, to which the regulations will apply.]