SEC makes outsourcing rules more flexible

Vorapol Socatiyanurak, secretary-general of the Securities and Exchange Commission, said yesterday that in principle, the operators must have an apparent outsourcing policy, guidelines, service-provider supervision, and risk-management and business-continuity measures.
However, outsourcing does not discharge business operators from assuming responsibility for the outsourced activities.
The activities that can be outsourced include risk management, internal audit and control, and information-technology management. Some important activities or those requiring expertise can be outsourced only to subsidiaries, audit firms or financial institutions.
For example, outsourcing of risk management and compliance will be allowed only to subsidiaries, while investment managers’ back offices, if they possess important information from funds and customers, will be allowed to outsource only to their subsidiaries or financial institutions.
Outsourcing to other licensed securities firms or derivatives operators can be done without the SEC’s approval but only to the extent deemed necessary to increase efficiency. Outsourcing must not be utilised as if the operators do not operate the business themselves.
Outsourcing to non-licensees will also be permissible. The operators simply give the SEC advance notice if the outsourcees are financial institutions, subsidiaries of the operator, audit firms where SEC-approved auditors work, the Stock Exchange of Thailand or its subsidiaries, or service providers with at least five years of relevant experience.
In case of outsourcing to any other parties, the SEC’s prior approval is needed. The SEC’s consideration will focus on the operator’s qualifications in terms of sufficient personnel and operating systems, sound financial condition, and whether they are fit and proper.