SUNANDO ROY – On Banking, Finance and Society

Intragroup outsourcing covers several distinct models that supervisors increasingly expect firms to map and manage separately, especially where cross‑border branches and subsidiaries are involved. The key distinctions turn on whether the service provider is part of the same legal entity (branch–head office) or a separate legal entity (parent–subsidiary or affiliate), which then drives how outsourcing rules bite, how contracts are structured, and how local management can evidence control.eba.europa+2​

Branch–head office relationships

In a pure branch–head office relationship, both units form a single legal entity, with the head office retaining ultimate responsibility for the whole firm’s governance, risk management, and regulatory compliance. Many frameworks therefore exclude “intra‑entity” arrangements, such as a branch relying on head‑office IT or risk models, from the formal definition of outsourcing, on the basis that these are internal allocations of functions rather than transfers to a third party.twobirds+2​

However, some authorities still require branches to document reliance on head‑office or other branch arrangements where this affects local operational resilience, data protection, or reporting obligations. This creates a grey area: while intra‑entity support may fall outside outsourcing rules, branches must still demonstrate that they can oversee services performed elsewhere in the same entity and meet local supervisory expectations.osfi-bsif+2​

Parent–subsidiary intragroup outsourcing

Parent–subsidiary outsourcing involves a regulated entity delegating activities to a separate legal entity within the same group, such as a parent company service centre or a shared‑services subsidiary. Most regulators treat this squarely as outsourcing: intragroup providers are subject to essentially the same requirements as external third parties, albeit with some recognition that group control and common governance may mitigate certain risks.pwc+2​

Even where a “lighter‑touch” approach is allowed, firms are expected to perform risk‑based due diligence, maintain written agreements, and ensure that intragroup arrangements do not create “letter‑box” entities that retain a licence but no real substance. Supervisors also emphasise that cross‑border intragroup outsourcing to a parent or global hub does not justify weakening exit strategies, concentration‑risk analysis, or data‑location assessments.bis+2​

Branch outsourcing vs intragroup

A branch that outsources to a separate group entity—such as a regional service company or the parent bank incorporated abroad—is usually treated as entering into intragroup outsourcing, because the counterparty is a distinct legal person even if it shares ownership and governance. In this case, outsourcing rules apply in full: the branch must identify critical or important functions, maintain a local outsourcing register, and ensure that contractual terms allow it and its home regulator effective access and audit rights.fca+2​

By contrast, where one branch relies on another branch or the head office within the same legal entity, some regimes explicitly state that this should not be regarded as outsourcing at all, though they may still expect appropriate documentation under broader governance or operational‑resilience standards. This divergence in treatment means that mapping the legal‑entity perimeter is critical before classifying a given arrangement as branch–head‑office support, intragroup outsourcing, or a combination of both in complex service chains.asifma+3​

Supervisory perspectives and arbitrage

Supervisors increasingly highlight that intragroup outsourcing is not inherently less risky than external outsourcing, particularly where critical functions, cross‑border data transfers, or centralised cloud or IT platforms are involved. Guidance from bodies such as the FSB, IOSCO, and the Basel Committee underlines that concentration risk, weak exit strategies, and opaque service chains can all arise within groups and may impair resolvability if not managed.iosco+3​

Industry bodies and some national frameworks nevertheless argue for calibrated obligations that reflect shared culture, integrated risk management, and the parent’s ability to influence intragroup service providers, especially for non‑critical support functions. This tension between “same‑risk, same‑rules” and “intragroup proportionality” creates scope for supervisory arbitrage, for example where firms structure services as intra‑entity branch support rather than parent–subsidiary outsourcing to avoid stricter documentation or location requirements.lw+2​

Intragroup outsourcing models

• Basel Committee on Banking Supervision and IOSCO. Outsourcing in Financial Services. February 2005. https://www.bis.org/publ/joint12.pdf.bis​