Outsourcing oversight is the set of controls by which a regulated financial firm supervises work it has handed to an outside provider, such as cloud hosting, card processing, customer identity checks or customer support. The governing principle in banking and payments regulation is that a firm can outsource an activity but not its responsibility: the regulator holds the licensed firm accountable for whatever the provider does on its behalf.
In practice this means due diligence before signing, a written contract with a service level agreement, rights for the firm and its regulator to audit the provider, regular performance and security reviews, often supported by a SOC 2 report, and a tested plan for exiting the arrangement. Firms in the European Union and the United Kingdom must record their arrangements in a regulatory outsourcing register and notify the regulator of critical ones. The discipline is part of wider third-party risk and vendor risk management.