Outsourcing Officer

The Outsourcing Officer provides central oversight of a financial institution's outsourcing arrangements. The role exists because supervised institutions remain fully responsible for functions they hand to third parties, so they need a controlled view of every material outsourcing, its risks, its monitoring and its exit path.

The legal anchor is Section 25b of the German Banking Act (Kreditwesengesetz, KWG), which requires institutions to ensure that outsourcing does not impair the proper conduct of business, internal controls or the supervisor's ability to audit. Section 25b paragraph 1 sentence 4 KWG also obliges every institution to keep an outsourcing register covering material and non-material arrangements alike. The supervisory detail comes from the Minimum Requirements for Risk Management (MaRisk), in particular module AT 9 on outsourcing. AT 9 paragraph 12 is explicit: every institution that outsources must set up a central outsourcing officer inside the institution itself, with a central outsourcing management function added in support according to the nature, scale and complexity of the arrangements. An examination rarely asks whether those building blocks exist; it asks whether they fit together, whether the risk analysis matches the classification in the register, whether the contract carries the rights the analysis assumes, and whether monitoring has been documented without gaps.

For information and communication technology, the EU Digital Operational Resilience Act (Regulation (EU) 2022/2554, DORA) adds a directly applicable regime for ICT third-party risk: a register of information on all ICT service arrangements, mandatory contractual content, risk assessment of concentration and substitutability, and stricter rules for services supporting critical or important functions. DORA and MaRisk AT 9 overlap, so the officer manages one coherent framework rather than two parallel ones.

In practice the officer maintains the register, coordinates risk analyses, monitors provider performance and sub-outsourcing, keeps the exit arrangements workable, and reports on material outsourcing to the management board at least annually under AT 9 paragraph 13. The recurring weaknesses are familiar: a register that does not reflect the full contract population, a risk analysis written at signature and never revisited, an exit strategy with no named fallback, and sub-outsourcing the institution hears about only after the event. The role steers the provider relationship rather than auditing it independently, which keeps it distinct from internal audit. Insurance undertakings run a comparable function under a separate supervisory framework, where the German term is Ausgliederung.