18.5 Outsourcing Controls: Surge Capacity, RegTech, and Independent Testing

CAFCA sub-topic 5.5 covers the considerations of outsourcing controls, with three named examples: surge capacity, RegTechs and independent testing of the compliance framework. Outsourcing helps FinTechs scale quickly, but it is a frequent cause of failure when firms treat it as handing off the problem.

The principle: accountability stays in-house

Regulators across jurisdictions take the same line. The firm can delegate tasks but remains responsible. Examples include the UK FCA's systems and controls rules on outsourcing (SYSC 8), the EBA Guidelines on outsourcing arrangements (2019), the US interagency third-party guidance, and MAS outsourcing guidelines. Supervisors expect due diligence before signing, contracts that protect access and audit rights, ongoing oversight, and exit plans.

Three types of outsourcing

Surge capacity done well

• Scope: vendor analysts work defined first-level tasks, such as triage and documented closure under clear rules. SAR decisions stay with the firm's MLRO or BSA officer, and complex cases are escalated in-house.
• Standards: they use the firm's procedures, templates and decision criteria, not the vendor's own.
• Onboarding: screening of vendor staff, training on the firm's products and typologies, and certification before live work.
• Quality: higher QA sampling at first, calibration sessions, and pay or targets tied to quality as well as volume.
• Security: least-privilege access, no local downloads, monitoring of user activity (Chapter 6), and removal of access at the end of the engagement.

RegTech: buying a tool is not buying compliance

• Due diligence: capability, data sources, coverage, security certifications, financial stability, sub-processors and data location.
• Configuration ownership: the firm sets the thresholds, lists, rules and match settings, and documents why. Vendor defaults are a starting point, not a decision.
• Validation: test detection on known cases, run parallel tests before cut-over, and validate models, including any machine learning scoring. The firm needs enough explanation from the vendor to defend outcomes to examiners (Chapter 11).
• Change management: the vendor must notify the firm of model or list changes, which the firm then tests.
• Resilience: SLAs, outage procedures (fail-closed for sanctions), and contingency plans.
• Concentration risk: relying on one vendor for onboarding, screening and monitoring creates a single point of failure.

Independent testing

US BSA programmes must include independent testing. The UK Money Laundering Regulations require an independent audit function where appropriate to size and nature. Good practice:

• Independence: testers did not design or operate the controls they test. They may be internal audit, an outside firm or another qualified independent party.
• Competence in the FinTech's products, technology and typologies.
• Risk-based scope: risk assessment, CDD and beneficial ownership, screening, monitoring (including data integrity and rule logic), alert and SAR processes, training, governance and MI. It should also cover outsourced and vendor-run controls.
• Frequency: risk-based. Many firms test every 12 to 18 months, more often after major change.
• Reporting to the board or audit committee, with management responses and tracked remediation.

The contract checklist

Scope and service levels; quality standards; data protection and confidentiality, including how SAR-related material is handled; audit and access rights for the firm, its partner bank and regulators; sub-contracting approval; incident notification; business continuity; termination and exit assistance; data return and deletion; and the regulatory notification duties that apply to material outsourcing in some regimes.

Realistic exam scenario

To clear a 20,000-alert backlog, a FinTech hires a managed-service vendor whose analysts close alerts three times faster than the in-house team. QA then finds that 22% of vendor closures lack a rationale and that two missed SAR-worthy cases. The firm should pause bulk closures, re-review the affected population, strengthen vendor training and templates, and raise QA sampling. It should tie the vendor's targets to quality and report the issue to the board and partner bank. It cannot blame the vendor in place of fixing the control. Accountability remains with the firm.

Common exam traps

• "The vendor is responsible for compliance failures." The firm is accountable.
• Running vendor defaults without documenting why they fit.
• Letting surge analysts make SAR decisions.
• Independent testers who also designed the controls.