Research Analysts registered with SEBI are increasingly considering outsourcing as a strategic tool to reduce costs, enhance efficiency, and focus on their core research competencies. However, outsourcing in the securities market carries significant regulatory implications. The Securities and Exchange Board of India, through its Circular No. CIR/MIRSD/24/2011 dated December 15, 2011, established comprehensive guidelines on outsourcing of activities by intermediaries, which apply to Research Analysts under the SEBI (Research Analysts) Regulations, 2014.
Understanding Outsourcing in the RA Context
Outsourcing is defined as the use of one or more third parties—either within or outside the group—by a registered Research Analyst to perform activities associated with services which the RA offers. This definition is deliberately broad, capturing any arrangement where an RA delegates any function to an external party.
The regulatory framework recognizes that while outsourcing can bring operational efficiencies, it also introduces various risks: operational risk, reputational risk, legal risk, country risk, strategic risk, exit-strategy risk, counterparty risk, concentration risk, and systemic risk. The RA remains fully accountable for all outsourced activities.
What Can Be Outsourced
Research Analysts may outsource a range of administrative, operational, and support functions, provided these do not constitute core business activities or compliance functions. Permissible outsourcing activities typically include:
Administrative and Support Services
Back-office functions such as data entry, document management, and record keeping can be outsourced. Many RAs outsource IT infrastructure management, including server maintenance, cybersecurity monitoring, and software support. Human resources functions like payroll processing, employee benefits administration, and recruitment support may also be delegated. Accounting and bookkeeping services, while not core to research, are frequently outsourced to specialized firms.
Technology and Infrastructure
Research analysts often outsource technology functions including web hosting, mobile application development and maintenance, and research platform management. Cloud-based software solutions for research management, client relationship management, and compliance tracking are commonly used through third-party providers. The Master Circular for Research Analysts, specifically clause 8 on "Advisory for Financial Sector Organizations regarding Software as a Service (SaaS) based solutions," provides critical guidance that RAs must consider when outsourcing technology functions.
The Outsourcing Policy Requirement
Every RA seeking to outsource activities must have in place a comprehensive outsourcing policy. This policy must be approved by the Board or partners of the RA and must guide the assessment of whether and how activities can be appropriately outsourced.
Essential Components of the Policy
The policy must cover the nature of activities that can be outsourced, the authorities authorized to approve outsourcing of such activities, and the criteria for selecting third parties. It must be based on an evaluation of risk concentrations and limits on the acceptable overall level of outsourced activities. The policy should also address risks arising from outsourcing multiple activities to the same entity.
The Board of the RA bears the primary responsibility for the outsourcing policy and the overall responsibility for activities undertaken under that policy. Regular reviews of the outsourcing policy must be mandated to address changing business environments.
The Risk Management Programme
An RA must establish a comprehensive outsourcing risk management programme to address outsourced activities and the relationship with third parties. This programme serves as the operational framework for managing all outsourcing arrangements.
Materiality Assessment
The assessment of outsourcing risk depends on several factors, including the scope and materiality of the outsourced activity. An RA must evaluate the impact of a third party's failure on the financial, reputational, and operational performance of the RA and on its clients. The regulatory status of the third party, including its fitness and probity status, must be carefully examined. The RA must also consider situations involving conflict of interest between the RA and the third party and implement measures to address such potential conflicts.
Group Entities and Associates
While there is no prohibition on a group entity or associate of the RA acting as the third party, systems must be put in place to ensure arm's length distance between the RA and the third party in terms of infrastructure, manpower, decision-making, and record keeping. Necessary disclosures must be made as part of the contractual agreement.
Record Preservation
Records relating to all activities outsourced must be preserved centrally and must be readily accessible for review by the Board of the RA and its senior management. These records must be regularly updated and may form part of the corporate governance review by the RA's management.
Due Diligence and Monitoring
The RA must conduct appropriate due diligence in selecting the third party and must continuously monitor the third party's performance.
Due Diligence Checklist
-
Resources and Capabilities: The third party must have the financial soundness and capacity to perform the outsourcing work within the stipulated timelines.
-
Compatibility: The third party's practices and systems must be compatible with the RA's requirements and objectives.
-
Market Feedback: The RA must assess the third party's business reputation and track record.
-
Concentration Risk: The RA must evaluate the level of concentration of outsourced arrangements with a single third party.
-
Country Environment: The RA must consider the environment of the foreign country where the third party is located, particularly regarding data protection and legal frameworks.
Core Principles of Outsourcing
Full Liability and Accountability
The RA remains fully liable and accountable for outsourced activities to the same extent as if the service were provided in-house. This is a fundamental regulatory principle that cannot be contracted away.
Investor Rights
Outsourcing arrangements must not affect the rights of investors against the RA. The RA remains liable to investors for losses incurred due to the failure of the third party and is responsible for redressing grievances arising from activities rendered by the third party.
Regulatory Access
The facilities, premises, and data involved in carrying out outsourced activities by the service provider shall be deemed to be those of the RA. SEBI and persons authorized by SEBI have the right to access these at any point of time.
Data Protection
The RA must take appropriate steps to protect confidential information of both the RA and its clients from intentional or inadvertent disclosure to unauthorized persons. The third party must ensure that its employees have limited access to the data handled, and only on a "need to know" basis.
Written Contract Requirements
All outsourcing relationships must be governed by written contracts that clearly describe all material aspects of the outsourcing arrangement. This is a non-negotiable regulatory requirement.
Essential Contract Clauses
-
Scope Definition: The contract must clearly define what activities are being outsourced, including appropriate service and performance levels.
-
Rights and Obligations: The contract must provide for mutual rights, obligations, and responsibilities of the RA and the third party, including indemnity by the parties.
-
Liability: The contract must provide for the liability of the third party to the RA for unsatisfactory performance or other breaches of contract.
-
Sub-contracting: Where necessary, the contract must include conditions on sub-contracting by the third party.
-
Confidentiality: The contract must have unambiguous confidentiality clauses to ensure protection of proprietary and customer data during the tenure of the contract and after expiry.
-
IT Security: The contract must specify the third party's responsibilities with respect to IT security, contingency plans, insurance cover, business continuity, and disaster recovery plans.
-
Termination: The contract must provide for termination procedures, including transfer of information and exit strategies.
-
Regulatory Compliance: The contract must not prevent or impede the RA from meeting its regulatory obligations, nor SEBI from exercising its regulatory powers.
-
Inspection: The contract must provide for the RA and SEBI to have the ability to inspect and access all books, records, and information relevant to the outsourced activity with the third party.
Contingency and Disaster Recovery Plans
The RA must establish and maintain contingency plans, including a plan for disaster recovery and periodic testing of backup facilities. Specific contingency plans must be separately developed for each outsourcing arrangement.
The RA must take appropriate steps to assess and address the potential consequences of a business disruption or other problems at the third party level. This includes considering contingency plans at the third party, co-ordination of contingency plans at both the RA and the third party, and contingency plans of the RA in the event of non-performance by the third party.
Country Risk Considerations
When an RA outsources activities to a foreign third party, additional issues arise from country risks and potential obstacles in exercising oversight and management of the arrangements. The contract must include choice-of-law provisions and agreement covenants that provide for adjudication of disputes between the parties under the laws of a specific jurisdiction.
The RA must take into account the environment of the foreign country where the third party is located, particularly regarding the legal framework for data protection, the enforceability of contracts, and the ability to exercise regulatory oversight.
Expert Legal Guidance
The outsourcing framework for Research Analysts is complex and carries significant regulatory risks. Anuj Desai & Associates provides comprehensive legal advisory services on outsourcing arrangements, helping RAs develop compliant outsourcing policies, conduct due diligence on third parties, draft legally robust contracts, and navigate the regulatory landscape. Our team of experienced securities lawyers ensures that your outsourcing arrangements meet all regulatory requirements while protecting your business interests and investor rights.