Outsourcing and Regulatory Access Rights

Outsourcing and regulatory access rights concern the ability of a financial entity, and where DORA provides for it, its competent authority, to obtain information about, inspect, and audit an ICT third party arrangement that supports a regulated service. Outsourcing does not place a provider beyond examination. DORA's provisions on ICT third party risk therefore expect contracts to preserve rights of access, audit, and information, so that the firm can oversee its provider and a supervisor can examine the arrangement when needed. A contract that promises transparency in general terms, while limiting access to a provider summary, restricting audit to a narrow window, or excluding sub-providers, does not preserve those rights in a usable form. Access that cannot be exercised when it matters is not access.

Access has several layers, and each layer serves a different purpose. Information rights give the firm ongoing data about performance, incidents, changes, and sub-provider arrangements. Audit rights give the firm, or an auditor acting for it, the ability to examine provider controls and evidence in depth. Inspection rights, where they apply to a competent authority, allow a supervisor to examine the provider arrangement directly. These layers are complementary, not interchangeable. Information rights support ongoing oversight. Audit rights support periodic assurance and investigation of a concern. Inspection rights support supervision of the regulated firm through its provider chain. A contract that provides only one layer leaves the other purposes unmet, and the gap will be discovered when the missing layer is needed.

Practical limits often narrow access more than contract headlines suggest. A provider may allow audit only through its own chosen auditor, only on its own premises, only with long notice, or only over a sample it selects. It may provide reports that describe controls in general terms without the underlying evidence a firm needs to judge a specific service. It may exclude sub-providers, so that the part of the chain that actually processes data or operates a component cannot be examined. Each limit may be commercially understandable, yet each limit needs to be understood, recorded, and compensated for, whether through alternative evidence, stronger monitoring, or a different arrangement. A firm that has never tested its access rights will not know which limits apply until it tries to use them under pressure.

A securities settlement illustration shows the stakes. Settlement depends on timely, accurate processing and on records that can be reconciled after the event. If a provider component fails and settlement is delayed or disputed, the firm needs provider logs, change records, and incident evidence to reconstruct what happened and to show its supervisor that the service was governed. If access to that evidence is limited to a summary report, or delayed until after records have been rotated, reconstruction becomes guesswork. The firm may still be able to describe its own actions, but it cannot show the provider part of the story, and the supervisor cannot examine the chain as a whole. Access rights are therefore part of incident evidence, not merely part of procurement.

Sub-provider access deserves explicit treatment. A provider that sub-contracts hosting, support, or processing creates a chain, and access rights that stop at the direct provider do not reach the part of the chain where data or operations actually sit. Contracts should therefore address how access extends through material sub-contracting, what information the direct provider must obtain from its sub-providers, and what happens if a sub-provider refuses access. The aim is not to audit every minor component. It is to ensure that the firm and, where applicable, its supervisor can examine the parts of the chain that matter to a service, without being blocked by a contractual gap the firm accepted at signing.

Exercising access rights periodically is what keeps them real. A firm can use information rights in regular governance, commission an audit or review where a concern arises, and test whether evidence can be obtained in a usable form and within a useful timeframe. Each exercise reveals whether the right works, whether the evidence answers the question asked, and whether any limit needs to be renegotiated at renewal. A right that is exercised, even modestly, is also easier to use during a disruption, because contacts, processes, and expectations are already known. A right that has never been used is a clause awaiting its first test, and a disruption is a poor moment for that test to occur.