Prudential Standard SPS 231 Outsourcing (SPS 231) requires that an outsourcing agreement must, at a minimum, address a number of matters, including liability and indemnity, sub-contracting and insurance. Paragraph 22 of SPS 231 provides that there must be an indemnity to the effect that the service provider is responsible to the RSE licensee for the actions of any subcontractor. This requirement is independent of any rights or action the service provider may have against the subcontractor.

APRA’s view is that whilst SPS 231 requires the outsourcing agreement to cover ‘any liability’, this provision does not prohibit the RSE licensee and the service provider agreeing to a limit on the service provider’s liability and indemnities. This agreement between the RSE licensee and the service provider may, for example, be to reflect accepted business practices. This position is reflected in Prudential Practice Guide SPG 231 Outsourcing (SPG 231), which makes allowance for situations where liability for negligence may be limited and includes reference to sub-contracting arrangements. APRA also expects that any possible limitations in the liability and indemnity provided under the contract be considered within the RSE licensee’s risk management framework and when considering a suitable level for the operational risk financial requirement target amount and tolerance limit.