The regulated financial institutions have till July 1, 2025, to comply with the directive or face an administrative penalty of one thousand penalty units, equivalent to GH?12,000.

The move by the Bank of Ghana emphasizes its commitment to ensuring that Ghana’s financial sector remains robust and adheres to stringent governance standards following the increasing tendency of banks and specialised deposit-taking institutions (SDIs), to outsource activities to reduce costs and improve efficiency.

The directive details specific functions that regulated financial institutions (RFIs) may outsource with prior approval and lists essential functions that are prohibited from being outsourced to maintain the integrity and independence of key decision-making roles.

For instance, a regulated financial institution shall not outsource to a Service Provider (strategic functions) including but not limited to Board and Senior Management functions such as strategic oversight, corporate planning, organization, management and control and decision-making functions, decisions on whether or not to grant credit, determining compliance with Anti-Money Laundering and Combating of Financing of Terrorism and Know Your Customer (KYC) norms for opening accounts.

Others include the internal audit function, risk management function, and cyber and information security management function.

Examples of functions which would not be considered as outsourcing arrangements under the directive include but are not limited to arrangements with payment card schemes such as Visa and MasterCard as well as clearing and settlement arrangements between clearing and settlement institutions and their members and similar arrangements between members and non-members.

The Bank of Ghana’s directive aims to mitigate risks associated with outsourcing, including strategic, reputational, and operational risks, by requiring RFIs to maintain control over high-stakes functions essential to their stability and resilience.

For transitional arrangements and effective implementation, the Central Bank has directed regulated financial institutions which include banks and specialized deposit-taking institutions to prepare well in advance of the July 2025 deadline to review current contracts and implement necessary adjustments to meet these regulatory standards on the earlier of either the renewal date of the contract or by 30th June 2025 and an RFI shall submit its materiality assessment framework to the BOG not later than 2nd June 2025.

RFIs shall not require the prior written approval of the BOG to enter into an outsourcing arrangement pertaining to a non-core function provided the function does not require approval under any other provision of Act 930 or any other legislation.

However, the RFI shall notify the BOG, in writing, within ten (10) working days prior to engaging the Service Provider.

New proposed outsourcing arrangements, including renewals, amendments and extensions of contracts or outsourcing agreements, with a Service Provider/ sub-contractor for a core function shall require the Bank of Ghana’s prior written approval as per section 60 (12) of Act 930.

Banks and specialized deposit-taking institutions are to ensure that no outsourcing arrangements shall result in the disclosure of customer information to third parties without the prior consent of the customer and it shall develop a basis for materiality assessment by which a function shall be considered as a core or non-core function.

An RFI that fails to comply with the requirements of the Outsourcing Directive shall be liable to pay to the Bank of Ghana an administrative penalty of one thousand penalty units as per section 60 (13) of Act 930 or section 57 (13) of Act 1032 which is equivalent to GH?12,000 as well as other relevant remedial measures and related sanctions as set out in Act 930 or Act 1032.