The bill on regulation of IT outsourcing is prepared for the first reading

The law regulating the outsourcing of information technology and cloud services for the financial sector has been prepared for the first reading. It has become relevant in the face of problems with access to the services of foreign providers and removes a number of requirements for financial institutions, transferring them to suppliers. However, market participants are afraid of the concentration of this business in companies associated with the largest banks, and as a result, an increase in the cost of services.

The Council of the State Duma recommended for adoption in the first reading bill, which regulates the use of outsourcing of information technologies and cloud services for financial organizations (banks, professional participants in the securities market, financial institutions and others). The law aims to address “equipment supply chain disruptions” in the financial industry “by removing legal restrictions inherent in the use of outsourcing,” the explanatory note says.

According to the document, the Central Bank will determine the requirements for companies providing technologies and services. Moreover, the condition of having a “license to carry out activities for the technical protection of confidential information may not apply” if the service provider “is part of a banking group”.

Financial organizations receive the right, through outsourcing, to place, store, process information (except for classified as state secrets) without the consent of the persons to whom it relates.

As noted in the Bank of Russia, a “list of conditions for attracting providers of IT outsourcing and cloud services” by financial organizations is currently being developed. At the same time, they indicated that a number of conditions “related to the cross-border transfer of certain categories of information are already in effect.”

Experts note that it is necessary to regulate the work in terms of outsourcing of IT technologies and cloud services for financial market organizations. According to Fedor Muzalevsky, director of the RTM Group technical department, “after the demarche of services such as Azure and Google (in 2022 they announced the suspension of activities in the Russian Federation and did not renew service contracts, — “b”), businesses are extremely wary of outsourcing and clouds, as they fear that their data may not even be compromised, but inaccessible.”

Viktor Dostov, chairman of the Association of Electronic Money Market Participants and Money Transfers, notes that outsourcing regulation practices exist in a number of countries and contain many requirements, from supplier selection to emergency scenarios. “In Russia, outsourcing is less developed than in the EU, while in the current situation it is increasingly difficult for small and medium-sized banks to meet all their needs in house, so the share of outsourcing in the country will grow,” he said.

However, professional participants in the securities market do not express much concern about this. NAUFOR President Alexei Timofeev calls the bill “an important step in recognizing the possibility of outsourcing those functions that are auxiliary to the licensed services.” Dmitry Tonkogubov, IT director of Ingosstrakh Investments Management Company, believes that there will be less regulatory risks for professional participants, since responsibility will be assigned to service providers, among other things. Dmitry Lesnov, head of the Finam client service development department, hopes that the law will remove restrictions that “act as a deterrent for the activities of financial organizations.”

At the same time, bankers are evaluating the bill very cautiously. According to the head of the National Council of the Financial Market Andrey Yemelin, “so far the biggest obvious problem is the ban on outsourcing information on AML / CFT measures, which is completely unclear how to isolate it from the general array of banking data, taking into account possible broad interpretation.”

According to a Kommersant source in the banking market, the adoption of the law in its current form may lead to the fact that the entire outsourcing market will be divided among the largest players that are part of the ecosystems of leading credit institutions.

“Unless the state once again creates an alternative for its own money,” he clarifies.

The head of the board of the Financial Innovations Association, Roman Prokhorov, explains that any formalized requirements will lead to an increase in prices for the services of certified vendors: “In an environment that is already not too high and tends to reduce the margin for financial services, this is not the most pleasant gift, especially for small participants in the financial market.”

Maxim Builov, Ksenia Kulikova