IT Outsourcing Disclosure for BSP-Supervised Institutions
By using Impact Banking as a cloud-based Banking-as-a-Service platform, your institution is entering into a material outsourcing arrangement as defined by BSP Circular 899 (Technology Risk Management Framework) and related BSP Memoranda.
Key obligations your institution must fulfil:
- BSP Notification: BSP-supervised institutions must notify the Bangko Sentral prior to outsourcing critical IT functions. This includes core banking systems, transaction processing, and data storage.
- Due Diligence: Your institution must conduct due diligence on Impact Banking as a service provider, including assessing our security controls, business continuity plans, and compliance with data privacy laws.
- Service Level Agreements: A formal SLA should be established between your institution and Impact Banking. Enterprise subscribers receive a dedicated SLA; other tiers operate under our standard service terms.
- Risk Management: Your institution retains full responsibility for managing risks associated with this outsourcing arrangement, including operational risk, data privacy risk (RA 10173), and regulatory compliance risk.
- BSP Examination Access: The BSP retains the right to examine and audit outsourced functions. Impact Banking will cooperate with BSP examinations as required.
Note: Impact Banking provides the technology platform only. All regulatory responsibilities — including BSP licensing, capital adequacy, consumer protection (BSP Circular 808), and AML compliance (RA 9160) — remain with your institution.
Questions? Contact compliance@pocketpass.app