GB
In our second post we covered the contractual form and other structural requirements for regulated outsourcing arrangements, particularly those supporting critical or important functions. This time we turn to one of the more contested areas in fintech outsourcing agreements and financial services outsourcing contracts: audit rights.
As outsourcing does not transfer regulatory responsibility, the regulated entity will always stay fully accountable to its regulator for how the outsourced function is performed. For fintechs and other FCA regulated firms, this remains one of the most important aspects of outsourcing compliance and third-party risk management. Audit rights are therefore essential as they enable the regulated entity to verify the service provider's compliance with the outsourcing contract, and to demonstrate that compliance to its regulator.
The EBA Guidelines on Outsourcing Arrangements (EBA/GL/2019/02) (the “Guidelines”) set a clear standard when it comes to audit rights, but there is real room to shape these provisions in a way that is practical and proportionate for both sides. The debate in audit negotiations is rarely about whether an audit right exists. It is about how that right is exercised: by whom exactly, how often, at whose cost, and with what operational safeguards for the service provider. Getting this balance right matters both for regulatory compliance and for the long-term health of the commercial relationship.
Firstly, for critical or important outsourcing arrangements, the Guidelines are explicit. Paragraph 75(p) requires that the outsourcing agreement grants the financial entity and its regulators an ‘unrestricted right to audit’ the service provider with regard to in particular the critical or important outsourced function.
Paragraphs 87(a) and (b) flesh this out further. Regulators and their appointees have full access to relevant business premises including devices, systems, and data used to provide the outsourced services and the ability to monitor and verify the service provider’s compliance with all applicable regulatory and contractual requirements.
Additionally, paragraph 75(o) requires the outsourcing agreement to include an explicit reference to the resolution authorities' powers under Articles 68 and 71 of Directive 2014/59/EU (the Bank Recovery and Resolution Directive).
For the outsourcing of functions that are not critical or important, the Guidelines require the following:
These requirements will be familiar to many fintech companies, payment institutions and e-money institutions operating within regulated financial services environments, where outsourcing compliance obligations continue to attract significant regulatory attention.
The regulatory baseline described above sets the floor. What it does not determine is everything else:
All of the above is contractual territory and remains open to negotiation between the parties. That said, this contractual flexibility has some clear boundaries under the Guidelines:
(a) the outsourcing agreement must not ultimately impede or limit the effective exercise of audit rights by the institution, its regulators, or third parties appointed by them (Paragraph 89); and
(b) the institution's exercise of those rights (including the frequency and scope of audits) must itself be conducted on a risk-based basis and in accordance with recognised audit standards (Paragraph 90).
A regulated entity must be able to demonstrate to its regulator that it has genuine and effective access to its service provider’s operations. This is a key expectation under the EBA Outsourcing Guidelines and forms an important part of a firm's wider operational resilience and regulatory compliance framework.
Critically, its access must extend not only to the regulated entity itself but also to its regulator, any resolution authority, and any third-party auditors it may appoint. On that basis, it is incentivised to have in place very broad audit rights.
In practice, for critical or important outsourcing arrangements this translates into a demand for completely unrestricted rights of access to the service provider's premises, records, data, personnel, equipment, software and systems. Such access is preferably exercisable at any time during business hours on any business day, without being confined to specific triggers or prior notice requirements.
Regulated entities will also typically seek to extend audit rights to any subcontractors engaged in the delivery of the outsourced services. Note however that we will address subcontracting in more detail in a separate blog post.
The Guidelines suggest that regulated entities should provide “reasonable notice to the service provider, unless this is not possible due to an emergency or crisis situation or would lead to a situation where the audit would no longer be effective” (paragraph 95).
This framing leaves room for extensive negotiations. Regulated entities will want to resist long lead times as a default (i.e. anything longer than 30 days), with the negotiation rationale being that meaningful oversight requires the ability to audit promptly when circumstances demand it. They will typically aim to confine notice requirements to routine or planned audits and will resist any drafting that treats notice requirements as an absolute precondition regardless of the nature of the audit, which is consistent with the Guidelines.
A regulated entity's natural starting position is that audit costs should be borne by the service provider. Alternatively, where this is not feasible, the contract remains silent on cost allocation, or the regulated entity may insist on a more balanced approach: where the audit finds the service provider to be non-compliant, the service provider should bear both the cost of the audit and any subsequent remediation actions that may be necessary.
Service providers engaging with these requirements face a genuine tension. The regulatory framework is not their framework: they are not directly subject to the Guidelines, and the audit obligations they accept are essentially forced upon them contractually by their counterparties.
That does not mean that service providers should refuse to engage. On the contrary, it means they have a legitimate interest in ensuring that the rights they grant are proportionate and operationally manageable.
An audit right with no frequency cap can mean continuous interference with operations. Service providers will typically seek to limit audits to being planned and commonly restricted to once per year, with defined carve-outs for ad-hoc regulatory-driven audits. This is viewed as a commercially reasonable position and is consistent with the regulatory framework, which does not require an unlimited right to audit on demand.
Service providers will seek meaningful advance notice for planned audits, typically in the range of thirty to sixty days, with terms of reference to be provided beforehand. Shorter notice is often sought to be confined to circumstances where a regulator requires it or where the circumstances giving rise to the audit genuinely make prior notice unfeasible (as is contemplated by the Guidelines), rather than left as a general carve-out at the customer's sole discretion.
A broadly drafted audit right could in principle extend to the service provider's internal financial information, commercially sensitive data relating to other customers, or systems unrelated to the outsourced services.
Service providers must seek to limit audit scope to only those records, data, premises, personnel and systems that are relevant to the performance of obligations under the outsourcing agreement and will resist access to anything that would require disclosure of confidential information owed to other customers. These are sensible and legitimate constraints.
Where the regulated entity proposes to appoint an external auditor, service providers have a legitimate interest in knowing who that is. A proposed auditor who is a direct competitor is an obvious concern. Service providers will typically require advance notification of the auditor's identity and will seek a right to raise objections on reasonable grounds.
Unrestricted audit rights can create real operational strain if not managed carefully. Service providers should at the very least require robust confidentiality protections (including flow-down obligations to auditors) and for audit activity to align with their internal security requirements.
In multi-client environments, a genuine issue for large technology platforms and cloud providers, regulated entities must take particular care to avoid exposing other customers' systems, data or commercially sensitive information. Paragraph 96 of the Guidelines recognises this risk.
In practice, it is managed through physical or logical separation of audit access, protocol-driven controls on what auditors may examine or copy, and a right for the service provider to propose alternative assurance mechanisms where an audit would create unacceptable risks to third parties.
Regulated entities should recognise these protections (or at minimum, the right to agree alternative assurance levels where needed) as legitimate regulatory safeguards reflecting the Guidelines' framework, not as commercial resistance by the service provider.
Service providers' natural starting position is that the customer should bear routine audit costs, since the right is primarily for the customer's benefit and the provider is presumably not in default. They will generally accept a cost shift only where an audit reveals non-compliance but will resist an open-ended obligation to underwrite all audit costs regardless of outcome.
Paragraph 91(b) of the Guidelines permits regulated entities to rely on third-party certifications or the service provider’s internal audit reports as a substitute for, or to supplement, conducting their own audits. It is one of the more practical provisions in the Guidelines and one that does not get used enough in practice.
This means that service providers can offer ISO certifications, SOC 2 reports, penetration test results and equivalent independent assessments as a means of satisfying the regulated entity's oversight requirements without necessitating a full on-site audit. Alternatively, Paragraph 91(a) permits pooled audits, audits organised jointly with other clients of the same service provider. This can further reduce the organisational burden on both the service provider and individual regulated entities, allowing audit resources to be deployed more efficiently across a shared client base.
But there’s a catch.
The substitute mechanism must be genuine. For example, a certification that is out of date, insufficiently scoped or not independently verified will not cut it. Regulated entities should ensure that any certification-based assurance mechanism provided for in the agreement includes an obligation on the service provider to keep certifications current, notify the regulated entity promptly if a certification lapses or is qualified, and most importantly permit the regulated entity to revert to a direct audit if it has reasonable grounds to doubt the adequacy of the assurance provided.
This can work surprisingly well for both parties. The service provider gets fewer and less disruptive audits. The regulated entity gets a structured and cost-effective means of maintaining ongoing oversight. It also reflects the reality of how many large technology service providers already manage regulatory assurance obligations across a large customer base.
Audit provisions in outsourcing agreements are rarely standardised effectively. They are commonly missed in standard commercial templates, and poor drafting can create real compliance risk for regulated entities and operational friction for service providers.
The mandatory baseline is set out clearly in the Guidelines and requires careful checking during negotiations, especially where parties are adapting commercial templates not designed for regulated outsourcing. That baseline is non-negotiable. What remains genuinely negotiable is the practical implementation. This is where most outsourcing contract negotiation sits, and where precise drafting determines whether the clause works operationally or simply exists on paper.
The regulated entity's objective is an audit right that is both compliant and genuinely exercisable. The service provider's objective is proportionality and operational manageability. These are not opposing interests. Both require transparent, risk-calibrated frameworks with clear operational boundaries. Where negotiated properly, the audit clause functions for both sides, reducing compliance risk for the regulated entity and operational burden for the service provider.
For fintechs, payment institutions and other regulated firms, audit rights are rarely just another contractual clause. They sit at the intersection of outsourcing compliance, operational resilience and regulatory oversight. Getting the drafting right from the outset can save significant time, cost and regulatory headaches further down the line.
In the next part of the series, we'll explore the remaining oversight requirements under the Guidelines which introduce some additional layers of complexity beyond audits.
