	(309929,29549,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>'),
	(309930,29549,'MetaLink','content'),
	(309931,29549,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(309932,29549,'ReportText','<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />\r\n<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright size-full wp-image-8275\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_710912206.jpg\" alt=\"\" width=\"454\" height=\"668\" />Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>'),
	(309933,29549,'ClientIP','83.111.236.141'),
	(309934,29549,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(309935,29549,'CurrentUserID','5'),
	(309936,29549,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(309937,29549,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(309938,29550,'PostID','8198'),
	(309939,29550,'PostType','law_update_articles'),
	(309940,29550,'PostTitle','Build to Suit Education Projects'),
	(309941,29550,'PostStatus','publish'),
	(309942,29550,'PostDate','2018-09-04 07:39:01'),
	(309943,29550,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(309944,29550,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(309945,29550,'ClientIP','83.111.236.141'),
	(309946,29550,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(309947,29550,'CurrentUserID','5'),
	(309948,29550,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(309949,29550,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(309950,29551,'PostID','8198'),
	(309951,29551,'PostType','law_update_articles'),
	(309952,29551,'PostTitle','Build to Suit Education Projects'),
	(309953,29551,'PostStatus','publish'),
	(309954,29551,'PostDate','2018-09-04 07:39:01'),
	(309955,29551,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(309956,29551,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(309957,29551,'ClientIP','83.111.236.141'),
	(309958,29551,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(309959,29551,'CurrentUserID','5'),
	(309960,29551,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(309961,29551,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(309962,29552,'PostID','8206'),
	(309963,29552,'PostType','law_update_articles'),
	(309964,29552,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(309965,29552,'PostStatus','publish'),
	(309966,29552,'PostDate','2018-09-04 07:32:55'),
	(309967,29552,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(309968,29552,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(309969,29552,'ClientIP','83.111.236.141'),
	(309970,29552,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(309971,29552,'CurrentUserID','5'),
	(309972,29552,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(309973,29552,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(309974,29553,'PostID','8206'),
	(309975,29553,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(309976,29553,'PostStatus','publish'),
	(309977,29553,'PostType','law_update_articles'),
	(309978,29553,'PostDate','2018-09-04 07:32:55'),
	(309979,29553,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(309980,29553,'MetaID','227216'),
	(309981,29553,'MetaKey','content'),
	(309982,29553,'MetaValueNew','<img src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" class=\"aligncenter size-full wp-image-8274\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(309983,29553,'MetaValueOld','<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>');

INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`)
VALUES
	(309984,29553,'MetaLink','content'),
	(309985,29553,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(309986,29553,'ReportText','<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" class=\"aligncenter size-full wp-image-8274\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(309987,29553,'ClientIP','83.111.236.141'),
	(309988,29553,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(309989,29553,'CurrentUserID','5'),
	(309990,29553,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(309991,29553,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(309992,29554,'PostID','8206'),
	(309993,29554,'PostType','law_update_articles'),
	(309994,29554,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(309995,29554,'PostStatus','publish'),
	(309996,29554,'PostDate','2018-09-04 07:32:55'),
	(309997,29554,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(309998,29554,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(309999,29554,'ClientIP','83.111.236.141'),
	(310000,29554,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310001,29554,'CurrentUserID','5'),
	(310002,29554,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310003,29554,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310004,29555,'PostID','8198'),
	(310005,29555,'PostType','law_update_articles'),
	(310006,29555,'PostTitle','Build to Suit Education Projects'),
	(310007,29555,'PostStatus','publish'),
	(310008,29555,'PostDate','2018-09-04 07:39:01'),
	(310009,29555,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(310010,29555,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(310011,29555,'ClientIP','83.111.236.141'),
	(310012,29555,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310013,29555,'CurrentUserID','5'),
	(310014,29555,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310015,29555,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310016,29556,'PostID','8198'),
	(310017,29556,'PostTitle','Build to Suit Education Projects'),
	(310018,29556,'PostStatus','publish'),
	(310019,29556,'PostType','law_update_articles'),
	(310020,29556,'PostDate','2018-09-04 07:39:01'),
	(310021,29556,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(310022,29556,'MetaID','226752'),
	(310023,29556,'MetaKey','content'),
	(310024,29556,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright size-full wp-image-8275\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_710912206.jpg\" alt=\"\" width=\"454\" height=\"668\" />Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>'),
	(310025,29556,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />\r\n<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright size-full wp-image-8275\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_710912206.jpg\" alt=\"\" width=\"454\" height=\"668\" />Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>'),
	(310026,29556,'MetaLink','content'),
	(310027,29556,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(310028,29556,'ReportText','<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />\r\n<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright size-full wp-image-8275\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_710912206.jpg\" alt=\"\" width=\"454\" height=\"668\" />Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8249\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/August-Edition-DPS_Page_21_Image_0002.jpg\" alt=\"\" width=\"1121\" height=\"337\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">Collaborating with a land owner, ground lease owner or developer (\"Landlords\") to lease a ‘build to suit’ school or other educational facility is becoming an increasingly popular means for educational facility operators (\"Tenants\") to meet their premises requirements in the UAE and broader region.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What is a build to suit arrangement?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In simple terms, a build to suit arrangement comprises the following elements:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">a Landlord who is prepared to undertake the construction of the educational facility provided they have a long term Tenant;</li>\r\n 	<li dir=\"LTR\">a Tenant being a school or other educational institution provider who wishes to enter into a long term lease of an educational facility; and</li>\r\n 	<li dir=\"LTR\">in many instances financial institutions who may be prepared to finance the Landlord in constructing the educational facility on the basis that, once built, the Landlord will have the revenue streams under the long term lease.</li>\r\n</ul>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Why build to suit?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Private school operators or other educational institutions would prefer not to undertake the significant capital outlay required to acquire an interest in land and construct their own premises.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In addition, developers and other investors have an appetite for singly owned and tenanted real estate assets with tenants who will take over the full operation and maintenance of the facility.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The pre-leasing aspect may also enable the Landlord to obtain finance for the project.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Accordingly, completing an education facility on a build to suit basis represents a win-win for operators, developers and investors. That said to avoid disputes arising at a later stage, build-to-suit projects can present a number of complexities that warrant careful consideration prior to entering into the relevant contractual documentation.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">What are the key legal elements of a build to suit transaction?</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">While a detailed discussion of the issues and risk points is beyond the scope of this article, the following discussion points provide a high-level overview of the key legal elements to consider in a build to suit transaction:</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Due diligence on the land plot</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">The parties should ensure that the land is appropriate for the proposed development. This may include considerations such as: ensuring the plot has appropriate planning and other regulatory approvals; ensuring the physical layout of the plot is suitable for the proposed designs; ensuring proximity to necessary infrastructure and utilities; confirming sufficient permitted GFA; licensing and free zone considerations; and other operational and design issues.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">From a commercial perspective, the location of the plot will also be important, as patrons of a school or other educational facility will generally want this to be proximate to or easily accessible from their residence. Competitor schools in or planned for the locality may also be a consideration.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Scope of works</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">A lack of clarity in the scope of the works is one of the key issues giving rise to disputes. As the rent and other obligations are often struck based on what the owner is expecting to deliver and what the tenant is expecting to receive (and the associated costs), aligning the parties expectations is key to minimising risk.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">To mitigate this risk, the parties should develop a clear scope of work at the outset. The parties should consider what plant and equipment is included in the scope of work, and whether the premises will be delivered in \"turn-key\" condition with all fit out installed as well as the extent to which equipment, furniture is included.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In the context of a school or other educational facility, the design may have to meet the requirements of the regulators such as the Dubai Knowledge and Human Development Authority. In addition, many operators will have their own design requirements. It is recommended that, unless the Tenant has such capabilities in-house, the Tenant engage suitable consultants to prepare a detailed technical brief addressing such matters as design requirements, structural loads, utility capacities and regulatory requirements. The detailed technical brief should be attached to the final agreement giving clarity to both the Landlord and Tenant as to key specifications required.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"Part of what makes build to suit arrangements so attractive, is that they are inherently flexible in their scope and structure. Parties can readily adapt the commercial arrangement to reach a mutually agreeable position on both the development and leasing aspects.\"</h2>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Milestones and longstop dates</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Will the owner be required to achieve completion of stages of the relevant works by milestone dates, or to procure completion of the project prior to a longstop date? If one or both of these requirements apply, what are the consequences of the Landlord failing to adhere to the relevant dates? Are delay damages payable, or does failure to meet milestone or long stop dates give rise to a right for the Tenant to terminate the agreements?</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In education projects, the date of completion can be critical as failure to achieve completion by a certain date could result in missing the window for enrolments for an entire year.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright size-full wp-image-8275\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_710912206.jpg\" alt=\"\" width=\"454\" height=\"668\" />Calculation of rent</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the rent payable under the lease be determined? Considerations may include whether there will there be a base/ground rent component payable for the land.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent (or a component of the rent) is to be calculated against the project costs incurred by the owner, what costs are included/excluded for the purpose of making that calculation? Examples of common exclusions are the owner’s cost of acquiring the land (if applicable), the owner’s cost of financing the construction and the cost of delivering infrastructure to the boundary of the plot.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where the rent is calculated with reference to the project costs or by some other methodology, the Tenant will be concerned to ensure that there is a cap on its liability. The Tenant may also require that the project costs be certified by an independent cost consultant.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Often the rent is discounted at the beginning of the term with such discounts amortised over the remainder of the term. This practice recognises that it takes some time for the school or other educational facility to attract students and therefore improves the Tenant’s cash flows until such time as the school or other educational facility is established in the market.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Appointment of contractors</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">How will the consultants and contractors undertaking the designs and works be appointed? Will mutual agreement be required? One option is for the parties to agree a short-list or pre-agree contractors and consultants whom the owner may engage. Alternatively, will there be a tender process and if yes, how will that be conducted and what role will the Tenant play in selecting the preferred tender? Will the Tenant have the right to approve the terms of the third party contracts?</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Development of detailed designs and construction drawings</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Ideally, detailed designs and specifications would be developed and attached to the contractual documents. However, often the project design is not finalised at the time when contractual documents are entered into. In those circumstances, the parties must agree on the mechanism for setting the final design requirements on which the project will be undertaken.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Variations</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Issues to consider include whether variations (by the Landlord, Tenant or both parties) will be permitted once the final designs and specifications are settled. If variations are permitted, what parameters or processes will apply to determine whether the variation will be implemented and on what grounds may a variation be refused (and the grounds of refusal may differ depending on which party is approving the variation). For example, where a variation would result in a material delay to the works program or result in a material increase in project costs, one party may be entitled to withhold its approval.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Retention of a specialist consultant by the tenant</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Unless the Tenant retains specialist architects and/or engineers in house, it is recommended that the Tenant obtain its own architectural and/or engineering consulting firm throughout the design, construction and handover phases of the project. The Tenant’s consultant may assist with the following tasks:</p>\r\n\r\n<ul>\r\n 	<li dir=\"LTR\">ensuring the design brief meets the Tenant’s and any regulator’s requirements;</li>\r\n 	<li dir=\"LTR\">where permitted under the contractual documentation, consulting with the Landlord on the appointment of any contractor or sub-contractor;</li>\r\n 	<li dir=\"LTR\">supervising the contractor and sub-contractors to ensure they are meeting the design brief;</li>\r\n 	<li dir=\"LTR\">assessing any requests from the Landlord or the Tenant to make variations and evaluating the cost of such variations;</li>\r\n 	<li dir=\"LTR\">cost consulting; and</li>\r\n 	<li dir=\"LTR\">assessing whether milestones are met and whether the school is ready for handover.</li>\r\n</ul>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Independent Experts</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">If disputes arise during the process, this could lead to delays in completing or the handover of the project, particularly where the disputes may be of a technical nature.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Whilst each party having its own consultant engaged may reduce the likelihood of disputes, it will not remove the risk completely as it remains possible that the respective parties’ consultants will disagree.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In these circumstances, it can be useful to have an independent consultant appointed to mediate and determine such disputes as an expert.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Documentation</em></p>\r\n<p dir=\"LTR\" align=\"LEFT\">Transaction documents from a Tenant’s perspective would typically include an agreement to lease and the occupational lease. Where acting for the Landlord, ground lease, financing, construction and development management documentation may be required.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The terms of the occupational lease are often critical, particularly given that the parties generally require a long-term arrangement. The parties should accordingly consider carefully the maintaining and repairing obligations and obligations for other outgoings, taxation issues, rent reviews, reinstatement obligations and insurance as well as the other usual Landlord and Tenant considerations.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Obligations in relation to registration of leases and any resulting registration fees should also be considered.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"></h3>\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Build to suit arrangements are not the only option for private school or educational institutions when setting up operations however they provide a useful option from, both the Landlord’s and the educational institutions perspective.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Readers will appreciate that there are a large number of issues to be considered prior to entering into build to suit projects and the above snapshot is by no means exhaustive. However, ensuring that the parties have a clear understanding and agreed position on these types of issues goes a long way to ensuring a successful project.</p>\r\n<em>Al Tamimi &amp; Company’s, <a href=\"http://localhost:8888/tamimi/lawyer/jeremy-scott/\">Jeremy Scott</a>, regularly advises on various <a href=\"http://localhost:8888/tamimi/practice/real-estate/\">real estate matters</a> in the UAE and other countries in the GCC. For further information please contact Jeremy Scott (<a href=\"mailto:j.scott@tamimi.com\">j.scott@tamimi.com</a>).</em>'),
	(310029,29556,'ClientIP','83.111.236.141'),
	(310030,29556,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310031,29556,'CurrentUserID','5'),
	(310032,29556,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310033,29556,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310034,29557,'PostID','8206'),
	(310035,29557,'PostType','law_update_articles'),
	(310036,29557,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310037,29557,'PostStatus','publish'),
	(310038,29557,'PostDate','2018-09-04 07:32:55'),
	(310039,29557,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310040,29557,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310041,29557,'ClientIP','83.111.236.141'),
	(310042,29557,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310043,29557,'CurrentUserID','5'),
	(310044,29557,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310045,29557,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310046,29558,'PostID','8198'),
	(310047,29558,'PostType','law_update_articles'),
	(310048,29558,'PostTitle','Build to Suit Education Projects'),
	(310049,29558,'PostStatus','publish'),
	(310050,29558,'PostDate','2018-09-04 07:39:01'),
	(310051,29558,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(310052,29558,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(310053,29558,'ClientIP','83.111.236.141'),
	(310054,29558,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310055,29558,'CurrentUserID','5'),
	(310056,29558,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310057,29558,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310058,29559,'PostID','8198'),
	(310059,29559,'PostType','law_update_articles'),
	(310060,29559,'PostTitle','Build to Suit Education Projects'),
	(310061,29559,'PostStatus','publish'),
	(310062,29559,'PostDate','2018-09-04 07:39:01'),
	(310063,29559,'PostUrl','http://localhost:8888/tamimi/law-update-articles/build-to-suit-education-projects/'),
	(310064,29559,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8198&amp;action=edit'),
	(310065,29559,'ClientIP','83.111.236.141'),
	(310066,29559,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310067,29559,'CurrentUserID','5'),
	(310068,29559,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310069,29559,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310070,29560,'Attempts','1'),
	(310071,29560,'Username','Website Visitor'),
	(310072,29560,'Msg','times'),
	(310073,29560,'URL','http://localhost:8888/tamimi/?post_type=lawyer&p=713'),
	(310074,29560,'ClientIP','37.59.253.159'),
	(310075,29560,'UserAgent','Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'),
	(310076,29561,'Attempts','3'),
	(310077,29561,'Username','Website Visitor'),
	(310078,29561,'Msg','times'),
	(310079,29561,'URL','http://localhost:8888/tamimi/?post_type=lawyer&p=889'),
	(310080,29561,'ClientIP','37.59.253.189'),
	(310081,29561,'UserAgent','Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'),
	(310082,29562,'Attempts','2'),
	(310083,29562,'Username','Website Visitor'),
	(310084,29562,'Msg','times'),
	(310085,29562,'URL','http://localhost:8888/tamimi/?post_type=lawyer&p=7056'),
	(310086,29562,'ClientIP','54.37.63.1'),
	(310087,29562,'UserAgent','Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'),
	(310088,29563,'Attempts','13'),
	(310089,29563,'Username','Website Visitor'),
	(310090,29563,'Msg','times'),
	(310091,29563,'URL','http://localhost:8888/tamimi/wp-content/themes/tamimi/css/fonts/open-sans-bold.woff2'),
	(310092,29563,'ClientIP','182.71.152.110'),
	(310093,29563,'UserAgent','Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310094,29564,'Attempts','1'),
	(310095,29564,'Username','Website Visitor'),
	(310096,29564,'Msg','times'),
	(310097,29564,'URL','http://localhost:8888/tamimi/?post_type=lawyer&p=705'),
	(310098,29564,'ClientIP','37.59.253.132'),
	(310099,29564,'UserAgent','Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'),
	(310100,29565,'Attempts','1'),
	(310101,29565,'Username','Website Visitor'),
	(310102,29565,'Msg','times'),
	(310103,29565,'URL','http://localhost:8888/tamimi/?post_type=lawyer&p=607'),
	(310104,29565,'ClientIP','54.37.63.23'),
	(310105,29565,'UserAgent','Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)'),
	(310106,29566,'AttachmentID','8276'),
	(310107,29566,'FileName','shutterstock_778654396.jpg'),
	(310108,29566,'FilePath','/home/tamimi/public_html/wp-content/uploads/2018/09'),
	(310109,29566,'ClientIP','83.111.236.141'),
	(310110,29566,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310111,29566,'CurrentUserID','5'),
	(310112,29566,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310113,29566,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310114,29567,'PostID','8206'),
	(310115,29567,'PostType','law_update_articles'),
	(310116,29567,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310117,29567,'PostStatus','publish'),
	(310118,29567,'PostDate','2018-09-04 07:32:55'),
	(310119,29567,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310120,29567,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310121,29567,'ClientIP','83.111.236.141'),
	(310122,29567,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310123,29567,'CurrentUserID','5'),
	(310124,29567,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310125,29567,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310126,29568,'PostID','8206'),
	(310127,29568,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310128,29568,'PostStatus','publish'),
	(310129,29568,'PostType','law_update_articles'),
	(310130,29568,'PostDate','2018-09-04 07:32:55'),
	(310131,29568,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310132,29568,'MetaID','227216'),
	(310133,29568,'MetaKey','content'),
	(310134,29568,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"size-large wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"640\" height=\"962\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310135,29568,'MetaValueOld','<img src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" class=\"aligncenter size-full wp-image-8274\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310136,29568,'MetaLink','content'),
	(310137,29568,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310138,29568,'ReportText','<img src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" class=\"aligncenter size-full wp-image-8274\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"size-large wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"640\" height=\"962\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310139,29568,'ClientIP','83.111.236.141'),
	(310140,29568,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310141,29568,'CurrentUserID','5'),
	(310142,29568,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310143,29568,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310144,29569,'PostID','8206'),
	(310145,29569,'PostType','law_update_articles'),
	(310146,29569,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310147,29569,'PostStatus','publish'),
	(310148,29569,'PostDate','2018-09-04 07:32:55'),
	(310149,29569,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310150,29569,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310151,29569,'ClientIP','83.111.236.141'),
	(310152,29569,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310153,29569,'CurrentUserID','5'),
	(310154,29569,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310155,29569,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310156,29570,'PostID','8206'),
	(310157,29570,'PostType','law_update_articles'),
	(310158,29570,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310159,29570,'PostStatus','publish'),
	(310160,29570,'PostDate','2018-09-04 07:32:55'),
	(310161,29570,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310162,29570,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310163,29570,'ClientIP','83.111.236.141'),
	(310164,29570,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310165,29570,'CurrentUserID','5'),
	(310166,29570,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310167,29570,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310168,29571,'PostID','8206'),
	(310169,29571,'PostType','law_update_articles'),
	(310170,29571,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310171,29571,'PostStatus','publish'),
	(310172,29571,'PostDate','2018-09-04 07:32:55'),
	(310173,29571,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310174,29571,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310175,29571,'ClientIP','83.111.236.141'),
	(310176,29571,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310177,29571,'CurrentUserID','5'),
	(310178,29571,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310179,29571,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310180,29572,'PostID','8206'),
	(310181,29572,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310182,29572,'PostStatus','publish'),
	(310183,29572,'PostType','law_update_articles'),
	(310184,29572,'PostDate','2018-09-04 07:32:55'),
	(310185,29572,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310186,29572,'MetaID','227216'),
	(310187,29572,'MetaKey','content'),
	(310188,29572,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\" wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"406\" height=\"611\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310189,29572,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"size-large wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"640\" height=\"962\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310190,29572,'MetaLink','content'),
	(310191,29572,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310192,29572,'ReportText','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"size-large wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"640\" height=\"962\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\" wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"406\" height=\"611\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310193,29572,'ClientIP','83.111.236.141'),
	(310194,29572,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310195,29572,'CurrentUserID','5'),
	(310196,29572,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310197,29572,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310198,29573,'PostID','8206'),
	(310199,29573,'PostType','law_update_articles'),
	(310200,29573,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310201,29573,'PostStatus','publish'),
	(310202,29573,'PostDate','2018-09-04 07:32:55'),
	(310203,29573,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310204,29573,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310205,29573,'ClientIP','83.111.236.141'),
	(310206,29573,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310207,29573,'CurrentUserID','5'),
	(310208,29573,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310209,29573,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310210,29574,'PostID','8206'),
	(310211,29574,'PostType','law_update_articles'),
	(310212,29574,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310213,29574,'PostStatus','publish'),
	(310214,29574,'PostDate','2018-09-04 07:32:55'),
	(310215,29574,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310216,29574,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310217,29574,'ClientIP','83.111.236.141'),
	(310218,29574,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310219,29574,'CurrentUserID','5'),
	(310220,29574,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310221,29574,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310222,29575,'PostID','8206'),
	(310223,29575,'PostType','law_update_articles'),
	(310224,29575,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310225,29575,'PostStatus','publish'),
	(310226,29575,'PostDate','2018-09-04 07:32:55'),
	(310227,29575,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310228,29575,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310229,29575,'ClientIP','83.111.236.141'),
	(310230,29575,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310231,29575,'CurrentUserID','5'),
	(310232,29575,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310233,29575,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310234,29576,'PostID','8206'),
	(310235,29576,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310236,29576,'PostStatus','publish'),
	(310237,29576,'PostType','law_update_articles'),
	(310238,29576,'PostDate','2018-09-04 07:32:55'),
	(310239,29576,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310240,29576,'MetaID','227216'),
	(310241,29576,'MetaKey','content'),
	(310242,29576,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"385\" height=\"579\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310243,29576,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\" wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"406\" height=\"611\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310244,29576,'MetaLink','content'),
	(310245,29576,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310246,29576,'ReportText','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"alignright wp-image-8222\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\" wp-image-8276 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"406\" height=\"611\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"385\" height=\"579\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310247,29576,'ClientIP','83.111.236.141'),
	(310248,29576,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310249,29576,'CurrentUserID','5'),
	(310250,29576,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310251,29576,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310252,29577,'PostID','8206'),
	(310253,29577,'PostType','law_update_articles'),
	(310254,29577,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310255,29577,'PostStatus','publish'),
	(310256,29577,'PostDate','2018-09-04 07:32:55'),
	(310257,29577,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310258,29577,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310259,29577,'ClientIP','83.111.236.141'),
	(310260,29577,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310261,29577,'CurrentUserID','5'),
	(310262,29577,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310263,29577,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310264,29578,'PostID','8206'),
	(310265,29578,'PostType','law_update_articles'),
	(310266,29578,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310267,29578,'PostStatus','publish'),
	(310268,29578,'PostDate','2018-09-04 07:32:55'),
	(310269,29578,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310270,29578,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310271,29578,'ClientIP','83.111.236.141'),
	(310272,29578,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310273,29578,'CurrentUserID','5'),
	(310274,29578,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310275,29578,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310276,29579,'Attempts','1'),
	(310277,29579,'Username','Website Visitor'),
	(310278,29579,'Msg','times'),
	(310279,29579,'URL','http://localhost:8888/tamimi/en/magazine/law-update/section-5/october-3/legal-risks-for-'),
	(310280,29579,'ClientIP','31.215.165.152'),
	(310281,29579,'UserAgent','Mozilla/5.0 (iPhone; CPU iPhone OS 11_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15F79 [FBAN/FBIOS;FBAV/153.0.0.53.87;FBBV/84268146;FBDV/iPhone9,2;FBMD/iPhone;FBSN/iOS;FBSV/11.4;FBSS/3;FBCR/du;FBID/phone;FBLC/en_GB;FBOP/5;FBRV/86759280]'),
	(310282,29580,'Attempts','2'),
	(310283,29580,'Username','Website Visitor'),
	(310284,29580,'Msg','times'),
	(310285,29580,'URL','http://localhost:8888/tamimi/en/media/get/20111024_logo-al-tamimi-co.gif'),
	(310286,29580,'ClientIP','173.252.127.37'),
	(310287,29580,'UserAgent','facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)'),
	(310288,29581,'Attempts','1'),
	(310289,29581,'Username','Website Visitor'),
	(310290,29581,'Msg','times'),
	(310291,29581,'URL','http://localhost:8888/tamimi/ads.txt'),
	(310292,29581,'ClientIP','45.55.62.201'),
	(310293,29581,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Safari/537.36 AdAuth/1.0; +https://www.adauth.com'),
	(310294,29582,'PostID','8206'),
	(310295,29582,'PostType','law_update_articles'),
	(310296,29582,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310297,29582,'PostStatus','publish'),
	(310298,29582,'PostDate','2018-09-04 07:32:55'),
	(310299,29582,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310300,29582,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310301,29582,'ClientIP','83.111.236.141'),
	(310302,29582,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310303,29582,'CurrentUserID','5'),
	(310304,29582,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310305,29582,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310306,29583,'PostID','8206'),
	(310307,29583,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310308,29583,'PostStatus','publish'),
	(310309,29583,'PostType','law_update_articles'),
	(310310,29583,'PostDate','2018-09-04 07:32:55'),
	(310311,29583,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310312,29583,'MetaID','227216'),
	(310313,29583,'MetaKey','content'),
	(310314,29583,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>');

INSERT INTO `tm_wsal_metadata` (`id`, `occurrence_id`, `name`, `value`)
VALUES
	(310315,29583,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"385\" height=\"579\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310316,29583,'MetaLink','content'),
	(310317,29583,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310318,29583,'ReportText','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"385\" height=\"579\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310319,29583,'ClientIP','83.111.236.141'),
	(310320,29583,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310321,29583,'CurrentUserID','5'),
	(310322,29583,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310323,29583,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310324,29584,'PostID','8206'),
	(310325,29584,'PostType','law_update_articles'),
	(310326,29584,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310327,29584,'PostStatus','publish'),
	(310328,29584,'PostDate','2018-09-04 07:32:55'),
	(310329,29584,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310330,29584,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310331,29584,'ClientIP','83.111.236.141'),
	(310332,29584,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310333,29584,'CurrentUserID','5'),
	(310334,29584,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310335,29584,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310336,29585,'PostID','8206'),
	(310337,29585,'PostType','law_update_articles'),
	(310338,29585,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310339,29585,'PostStatus','publish'),
	(310340,29585,'PostDate','2018-09-04 07:32:55'),
	(310341,29585,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310342,29585,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310343,29585,'ClientIP','83.111.236.141'),
	(310344,29585,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310345,29585,'CurrentUserID','5'),
	(310346,29585,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310347,29585,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310348,29586,'PostID','8206'),
	(310349,29586,'PostType','law_update_articles'),
	(310350,29586,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310351,29586,'PostStatus','publish'),
	(310352,29586,'PostDate','2018-09-04 07:32:55'),
	(310353,29586,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310354,29586,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310355,29586,'ClientIP','83.111.236.141'),
	(310356,29586,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310357,29586,'CurrentUserID','5'),
	(310358,29586,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310359,29586,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310360,29587,'PostID','8206'),
	(310361,29587,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310362,29587,'PostStatus','publish'),
	(310363,29587,'PostType','law_update_articles'),
	(310364,29587,'PostDate','2018-09-04 07:32:55'),
	(310365,29587,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310366,29587,'MetaID','227216'),
	(310367,29587,'MetaKey','content'),
	(310368,29587,'MetaValueNew','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310369,29587,'MetaValueOld','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310370,29587,'MetaLink','content'),
	(310371,29587,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310372,29587,'ReportText','<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />\r\n<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>|<img class=\"aligncenter size-full wp-image-8274\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_632368769.jpg\" alt=\"\" width=\"1000\" height=\"315\" />&nbsp;\r\n&nbsp;<p dir=\"LTR\" align=\"LEFT\">There have been significant changes in technology and regulation since 2008, when the Saudi Arabian Monetary Authority (SAMA) issued Circular No. 424 B.C.S / 34720 – the SAMA Rules of Outsourcing Processes. In this article, we summarise key aspects of the \"Outsourcing Rules\" with a focus on the outsourcing of information technology services.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing is a business practice in which a business engages external service providers to perform certain business functions, instead of having those functions performed by its own personnel. The increasing complexity of the outsourcing arrangements adopted by banks, and the potential harm to consumers from offshoring arrangements out of reach of regulators, led to a 2005 report by the Basel Committee on Banking Supervision. The report contained recommendations about tightening the way in which banks outsourced their activities. SAMA subsequently issued the Outsourcing Rules in 2008.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The stated objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences. The Outsourcing Rules apply to branches of foreign banks in the Kingdom, as well as to domestic banks licensed under the Banking Control Law issued under Royal Decree No. M/5 dated 22/2/1386H (12 June 1966).</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Engaging third party service providers can enable banks to reduce costs and obtain other efficiencies, but it may also expose banks to a variety of risks. These can include operational and reputational risks, such as when service providers fail in their performance, when security or confidentiality breaches result, or where the service providers’ actions otherwise result in banks failing to comply with statutory or regulatory obligations. Additionally, the whole banking sector could be at risk if a common service provider to a number of banks fails in its performance of the services entrusted to it.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing basic work and non-basic work</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules split those functions and tasks that can be outsourced into two main categories – ‘basic works’ and ‘non-basic works’. There are different considerations for outsourcing each of these categories of works, and there is a general prohibition (with some exceptions) on the outsourcing of works relating to customer data processing.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em>Basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Basic works refer broadly to the core tasks and responsibilities that banks have towards their customers. The operation of a bank’s information technology system is a prime example of basic works. Other examples include all customer-facing tasks (e.g. account opening, funds management, bank statements and transfers and payments), as well as human resources and marketing.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks are required to apply more rigour and diligence when outsourcing basic works, given the more serious consequences if the arrangement results in non-delivery of services. For that reason, the outsourcing of basic works is generally not permitted, unless the bank first obtains permission from SAMA. The Outsourcing Rules contain detailed requirements about what must be addressed in outsourcing contracts for basic works, and these are primarily aimed at reducing the potential harm that could result from outsourcing these core tasks and responsibilities.</p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\"><em><img class=\"wp-image-8222 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/11.jpg\" alt=\"\" width=\"443\" height=\"309\" />Non-basic Works</em></p>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">In contrast, non-basic works include services that are common to many businesses, and where outsourcing does not pose serious risk to customers. Examples include cleaning, printing and postal functions. Non-basic works may be assigned to third party service providers without first obtaining confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Traditionally, banks would assign many non-basic works to third party service providers as a matter of course, and this may not have been considered ‘outsourcing’. Despite this, there may be implications for the outsourcing of such works in the Outsourcing Rules, so agreements relating to such works still need to be reviewed for compliance.</p>\r\n&nbsp;\r\n<h2 dir=\"LTR\" align=\"LEFT\">\"The objective of the Outsourcing Rules is to provide guidance to banks on how to arrange outsourcing, while remaining compliant with the obligations under their banking licences.\"</h2>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Risk evaluation and management</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require senior management within banks to ensure that risks for existing and potential outsourcing agreements are considered and addressed. For the assignment of basic works, a thorough risk evaluation needs to be undertaken for all new contracts and contract renewals. For non-basic works, a thorough review is only required where there are substantive changes to the deliverables under an outsourcing arrangement.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Banks must properly investigate a service provider’s ability to undertake the contemplated services. Once a service provider is appointed, there is an obligation on the bank to monitor the service provider’s performance to ensure that the work is being done in accordance with the bank’s requirements.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Outsourcing contracts</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The Outsourcing Rules require banks to put in place comprehensive outsourcing contracts with service providers. These contracts need to address a variety of requirements, including scope of work, service levels and performance requirements, control and audit procedures, business continuity, pricing, confidentiality and privacy, information security, effects of breach and dispute resolution. The Outsourcing Rules indicate that it is preferable for governing law and jurisdiction of outsourcing contracts be that of Saudi Arabia.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">There is a requirement for outsourcing contracts to restrict service providers from sub-contracting any of the subject services without the prior consent of the banks, and subject to obtaining prior confirmation of no objection from SAMA.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Where customer data or financial statements are to be made available to a service provider in performance of outsourced services, it is necessary to ensure that the contractual arrangement reflects the confidentiality obligations set out in the Banking Control Law, and in other regulations and instructions that SAMA may have issued. It is also necessary to ensure that suitable measures are implemented to protect customer data and financial information in the course of performance of the outsourced services. These measures can include, for example, obligations requiring the adoption of isolation procedures restricting access to such information on a need-to-know basis, and obligations to have individuals involved in delivery of such services enter non-disclosure agreements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Contracts for basic works need to make clear that SAMA has the right to obtain accounting documents and records relating to the assignment. Additionally, service providers located outside the Kingdom need to confirm that there are no statutory and control restrictions in their own jurisdictions that might impact on the unrestricted right of access to information that SAMA has under the Outsourcing Rules and the Banking Control Law.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing contracts need to provide for the possibility of renewal, renegotiation, and termination of the contract, and early exit so that the bank can retain control over the subject services if it is necessary in the circumstances.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Business continuity</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Outsourcing has the potential to cause interruptions or outages to banking services. Business continuity is very important for banks, particularly in terms of continuity of information technology services. The Outsourcing Rules require banks to have a plan in place to ensure business continuity if the outsourced service is disrupted. This can either be a plan for the bank to perform the function itself, or to have an alternate service provider ready to undertake the services on short notice. The Outsourcing Rules place an obligation on banks to inform SAMA of problems or disruptions that arise due to outsourcing arrangements.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">In line with SAMA’s Business Continuity Management Framework (issued in 2017), banks need to have a business continuity strategy, and a business line responsible for implementing, monitoring and evaluating the strategy. An information technology disaster recovery plan is required as a key component of business continuity; it applies whether or not information technology services are outsourced. The Business Continuity Management Framework outlines how to develop and implement a business continuity strategy in more detail.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\"><img class=\"wp-image-8276 alignright\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/shutterstock_778654396-681x1024.jpg\" alt=\"\" width=\"398\" height=\"599\" />Cyber security considerations</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">The SAMA Cyber Security Framework (issued in 2017, and discussed in a <a href=\"http://localhost:8888/tamimi/law-update-articles/cyber-security-in-the-saudi-financial-services-sector-the-sama-cyber-security-framework/\">separate Law Update article</a>) acknowledges that banks will need to engage with third party service providers (including information technology services providers, cloud computing service providers, technology vendors and governmental agencies) in order to deliver their services. If such engagements do not respect the types of cyber security mechanisms that the banks have implemented, then they could result in cyber security risks. With this in mind, the Cyber Security Framework introduces expectations with regard to cyber security and the engagement of third parties. These can be broadly categorised as contract and vendor management considerations, outsourcing considerations and cloud computing considerations. It is essential that the cyber security obligations applying to banks pursuant to their implementation of SAMA’s Cyber Security Framework are addressed when considering outsourcing arrangements, and when preparing associated outsourcing contracts.</p>\r\n&nbsp;\r\n<h3 dir=\"LTR\" align=\"LEFT\">Conclusion</h3>\r\n&nbsp;\r\n<p dir=\"LTR\" align=\"LEFT\">Banks operating in Saudi Arabia need to be aware of the Outsourcing Rules. This is to ensure that they remain compliant from a regulatory perspective, but also to ensure that the outsourcing of certain business operations does not result in damage to their customers, or to their own operation, reputations and profitability.</p>\r\n<p dir=\"LTR\" align=\"LEFT\">The risks are greater when banks outsource their core functions, and SAMA’s Outsourcing Rules imposes greater obligations and restrictions on that type of outsourcing as a result.</p>\r\n<em>Al Tamimi &amp; Company’s <a href=\"http://localhost:8888/tamimi/practice/technology-media-telecommunications/\">Technology, Media &amp; Telecommunications</a> team regularly advises on issues relating to technology contracting in the financial services sector. For further information please contact <a href=\"http://localhost:8888/tamimi/lawyer/nick-oconnell/\">Nick O’Connell</a>, Partner (<a href=\"mailto:n.oconnell@tamimi.com\">n.oconnell@tamimi.com</a>) or <a href=\"http://localhost:8888/tamimi/lawyer/amy-land-pejoska/\">Amy Land-Pejoska</a>, Associate (<a href=\"mailto:a.pejoska@tamimi.com\">a.pejoska@tamimi.com</a>).</em>'),
	(310373,29587,'ClientIP','83.111.236.141'),
	(310374,29587,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310375,29587,'CurrentUserID','5'),
	(310376,29587,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310377,29587,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310378,29588,'PostID','8206'),
	(310379,29588,'PostType','law_update_articles'),
	(310380,29588,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310381,29588,'PostStatus','publish'),
	(310382,29588,'PostDate','2018-09-04 07:32:55'),
	(310383,29588,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310384,29588,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310385,29588,'ClientIP','83.111.236.141'),
	(310386,29588,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310387,29588,'CurrentUserID','5'),
	(310388,29588,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310389,29588,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310390,29589,'PostID','8206'),
	(310391,29589,'PostType','law_update_articles'),
	(310392,29589,'PostTitle','Technology outsourcing in the Saudi financial services sector: The SAMA Outsourcing Rules'),
	(310393,29589,'PostStatus','publish'),
	(310394,29589,'PostDate','2018-09-04 07:32:55'),
	(310395,29589,'PostUrl','http://localhost:8888/tamimi/law-update-articles/technology-outsourcing-in-the-saudi-financial-services-sector-the-sama-outsourcing-rules/'),
	(310396,29589,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8206&amp;action=edit'),
	(310397,29589,'ClientIP','83.111.236.141'),
	(310398,29589,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310399,29589,'CurrentUserID','5'),
	(310400,29589,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310401,29589,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310402,29590,'Attempts','1'),
	(310403,29591,'Attempts','1'),
	(310404,29590,'Username','Website Visitor'),
	(310405,29591,'Username','Website Visitor'),
	(310406,29590,'Msg','times'),
	(310407,29591,'Msg','times'),
	(310408,29590,'URL','http://localhost:8888/tamimi/wp-content/themes/tamimi/css/main.min.css'),
	(310409,29591,'URL','http://localhost:8888/tamimi/wp-content/themes/tamimi/style.css'),
	(310410,29590,'ClientIP','176.203.195.212'),
	(310411,29591,'ClientIP','176.203.195.212'),
	(310412,29590,'UserAgent','Mozilla/5.0 (iPad; CPU OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1'),
	(310413,29591,'UserAgent','Mozilla/5.0 (iPad; CPU OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1'),
	(310414,29592,'Attempts','1'),
	(310415,29592,'Username','Website Visitor'),
	(310416,29592,'Msg','times'),
	(310417,29592,'URL','http://localhost:8888/tamimi/wp-content/themes/tamimi/css/custom.css'),
	(310418,29592,'ClientIP','176.203.195.212'),
	(310419,29592,'UserAgent','Mozilla/5.0 (iPad; CPU OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1'),
	(310420,29593,'Attempts','1'),
	(310421,29593,'Username','Website Visitor'),
	(310422,29593,'Msg','times'),
	(310423,29593,'URL','http://localhost:8888/tamimi/wp-content/themes/tamimi/js/scripts.min.js'),
	(310424,29593,'ClientIP','176.203.195.212'),
	(310425,29593,'UserAgent','Mozilla/5.0 (iPad; CPU OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1'),
	(310426,29594,'PostID','965'),
	(310427,29594,'PostType','page'),
	(310428,29594,'PostTitle','Law Update'),
	(310429,29594,'PostStatus','publish'),
	(310430,29594,'PostDate','2017-09-28 12:15:43'),
	(310431,29594,'PostUrl','http://localhost:8888/tamimi/law-updates/'),
	(310432,29594,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=965&amp;action=edit'),
	(310433,29594,'ClientIP','83.111.236.141'),
	(310434,29594,'UserAgent','Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.81 Safari/537.36'),
	(310435,29594,'CurrentUserID','5'),
	(310436,29594,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310437,29594,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310438,29595,'PostID','1553'),
	(310439,29595,'PostType','jurisdictions'),
	(310440,29595,'PostTitle','Bahrain'),
	(310441,29595,'PostStatus','publish'),
	(310442,29595,'PostDate','2017-10-08 08:05:28'),
	(310443,29595,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310444,29595,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310445,29595,'ClientIP','83.111.236.141'),
	(310446,29595,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310447,29595,'CurrentUserID','5'),
	(310448,29595,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310449,29595,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310450,29596,'Attempts','3'),
	(310451,29596,'Username','Website Visitor'),
	(310452,29596,'Msg','times'),
	(310453,29596,'URL','http://localhost:8888/tamimi/en/magazine/law-update/section-5/october-3/legal-risks-for-'),
	(310454,29596,'ClientIP','67.80.158.214'),
	(310455,29596,'UserAgent','Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/15G77 [FBAN/FBIOS;FBAV/150.0.0.32.132;FBBV/80278251;FBDV/iPhone9,2;FBMD/iPhone;FBSN/iOS;FBSV/11.4.1;FBSS/3;FBCR/etisalat;FBID/phone;FBLC/en_US;FBOP/5;FBRV/82362498]'),
	(310456,29597,'PostID','1553'),
	(310457,29597,'PostType','jurisdictions'),
	(310458,29597,'PostTitle','Bahrain'),
	(310459,29597,'PostStatus','publish'),
	(310460,29597,'PostDate','2017-10-08 08:05:28'),
	(310461,29597,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310462,29597,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310463,29597,'ClientIP','83.111.236.141'),
	(310464,29597,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310465,29597,'CurrentUserID','5'),
	(310466,29597,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310467,29597,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310468,29598,'PostID','1553'),
	(310469,29598,'PostTitle','Bahrain'),
	(310470,29598,'PostStatus','publish'),
	(310471,29598,'PostType','jurisdictions'),
	(310472,29598,'PostDate','2017-10-08 08:05:28'),
	(310473,29598,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310474,29598,'MetaID','64594'),
	(310475,29598,'MetaKey','related_pages_2_page'),
	(310476,29598,'MetaValueNew','7594'),
	(310477,29598,'MetaValueOld','804'),
	(310478,29598,'MetaLink','related_pages_2_page'),
	(310479,29598,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310480,29598,'ReportText','804|7594'),
	(310481,29598,'ClientIP','83.111.236.141'),
	(310482,29598,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310483,29598,'CurrentUserID','5'),
	(310484,29598,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310485,29598,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310486,29599,'PostID','1553'),
	(310487,29599,'PostTitle','Bahrain'),
	(310488,29599,'PostStatus','publish'),
	(310489,29599,'PostType','jurisdictions'),
	(310490,29599,'PostDate','2017-10-08 08:05:28'),
	(310491,29599,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310492,29599,'MetaID','64596'),
	(310493,29599,'MetaKey','related_pages_3_page'),
	(310494,29599,'MetaValueNew','604'),
	(310495,29599,'MetaValueOld','7594'),
	(310496,29599,'MetaLink','related_pages_3_page'),
	(310497,29599,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310498,29599,'ReportText','7594|604'),
	(310499,29599,'ClientIP','83.111.236.141'),
	(310500,29599,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310501,29599,'CurrentUserID','5'),
	(310502,29599,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310503,29599,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310504,29600,'PostID','1553'),
	(310505,29600,'PostTitle','Bahrain'),
	(310506,29600,'PostStatus','publish'),
	(310507,29600,'PostType','jurisdictions'),
	(310508,29600,'PostDate','2017-10-08 08:05:28'),
	(310509,29600,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310510,29600,'MetaID','64598'),
	(310511,29600,'MetaKey','related_pages_4_page'),
	(310512,29600,'MetaValueNew','6433'),
	(310513,29600,'MetaValueOld','604'),
	(310514,29600,'MetaLink','related_pages_4_page'),
	(310515,29600,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310516,29600,'ReportText','604|6433'),
	(310517,29600,'ClientIP','83.111.236.141'),
	(310518,29600,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310519,29600,'CurrentUserID','5'),
	(310520,29600,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310521,29600,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310522,29601,'PostID','1553'),
	(310523,29601,'PostTitle','Bahrain'),
	(310524,29601,'PostStatus','publish'),
	(310525,29601,'PostType','jurisdictions'),
	(310526,29601,'PostDate','2017-10-08 08:05:28'),
	(310527,29601,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310528,29601,'MetaID','64600'),
	(310529,29601,'MetaKey','related_pages_5_page'),
	(310530,29601,'MetaValueNew','804'),
	(310531,29601,'MetaValueOld','6433'),
	(310532,29601,'MetaLink','related_pages_5_page'),
	(310533,29601,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310534,29601,'ReportText','6433|804'),
	(310535,29601,'ClientIP','83.111.236.141'),
	(310536,29601,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310537,29601,'CurrentUserID','5'),
	(310538,29601,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310539,29601,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310540,29602,'PostID','1553'),
	(310541,29602,'PostTitle','Bahrain'),
	(310542,29602,'PostStatus','publish'),
	(310543,29602,'PostType','jurisdictions'),
	(310544,29602,'PostDate','2017-10-08 08:05:28'),
	(310545,29602,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310546,29602,'MetaID','64602'),
	(310547,29602,'MetaKey','related_pages_6_page'),
	(310548,29602,'MetaValueNew','601'),
	(310549,29602,'MetaValueOld','603'),
	(310550,29602,'MetaLink','related_pages_6_page'),
	(310551,29602,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310552,29602,'ReportText','603|601'),
	(310553,29602,'ClientIP','83.111.236.141'),
	(310554,29602,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310555,29602,'CurrentUserID','5'),
	(310556,29602,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310557,29602,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310558,29603,'PostID','1553'),
	(310559,29603,'PostTitle','Bahrain'),
	(310560,29603,'PostStatus','publish'),
	(310561,29603,'PostType','jurisdictions'),
	(310562,29603,'PostDate','2017-10-08 08:05:28'),
	(310563,29603,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310564,29603,'MetaID','64604'),
	(310565,29603,'MetaKey','related_pages_7_page'),
	(310566,29603,'MetaValueNew','603'),
	(310567,29603,'MetaValueOld','601'),
	(310568,29603,'MetaLink','related_pages_7_page'),
	(310569,29603,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310570,29603,'ReportText','601|603'),
	(310571,29603,'ClientIP','83.111.236.141'),
	(310572,29603,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310573,29603,'CurrentUserID','5'),
	(310574,29603,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310575,29603,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310576,29604,'PostID','1553'),
	(310577,29604,'PostType','jurisdictions'),
	(310578,29604,'PostTitle','Bahrain'),
	(310579,29604,'PostStatus','publish'),
	(310580,29604,'PostDate','2017-10-08 08:05:28'),
	(310581,29604,'PostUrl','http://localhost:8888/tamimi/jurisdictions/bahrain/'),
	(310582,29604,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=1553&amp;action=edit'),
	(310583,29604,'ClientIP','83.111.236.141'),
	(310584,29604,'UserAgent','Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko'),
	(310585,29604,'CurrentUserID','5'),
	(310586,29604,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310587,29604,'SessionID','3eea04a09d4e3cdd1fe6c70377c574db138b0e23ebe7b0dd06abdc4b42051811'),
	(310588,29605,'Attempts','1'),
	(310589,29605,'Username','Website Visitor'),
	(310590,29605,'Msg','times'),
	(310591,29605,'URL','http://localhost:8888/tamimi/law-update-articles/mailto:?subject=catchingthewave:newdataprotectionlawinbahrain&body=catchingthewave:newdataprotectionlawinbahrainhttp://localhost:8888/tamimi/law-update-articles/catching-the-wave-new-data-protection-law-in-bahrain'),
	(310592,29605,'ClientIP','136.243.66.16'),
	(310593,29605,'UserAgent','Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36'),
	(310594,29606,'AttachmentID','8278'),
	(310595,29606,'FileName','Bandar-Pedro-and-Gomis.jpg'),
	(310596,29606,'FilePath','/home/tamimi/public_html/wp-content/uploads/2018/09'),
	(310597,29606,'ClientIP','83.111.236.141'),
	(310598,29606,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310599,29606,'CurrentUserID','8'),
	(310600,29606,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310601,29606,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310602,29607,'AttachmentID','8279'),
	(310603,29607,'FileName','Amouri-Pic.jpg'),
	(310604,29607,'FilePath','/home/tamimi/public_html/wp-content/uploads/2018/09'),
	(310605,29607,'ClientIP','83.111.236.141'),
	(310606,29607,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310607,29607,'CurrentUserID','8'),
	(310608,29607,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310609,29607,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310610,29608,'Attempts','1'),
	(310611,29608,'Username','Website Visitor'),
	(310612,29608,'Msg','times'),
	(310613,29608,'URL','http://localhost:8888/tamimi/en/media/get/20111024_logo-al-tamimi-co.gif'),
	(310614,29608,'ClientIP','173.252.127.21'),
	(310615,29608,'UserAgent','facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)'),
	(310616,29609,'Attempts','2'),
	(310617,29609,'Username','Website Visitor'),
	(310618,29609,'Msg','times'),
	(310619,29609,'URL','http://localhost:8888/tamimi/en/magazine/law-update/section-5/october-3/legal-risks-for-'),
	(310620,29609,'ClientIP','94.59.41.137'),
	(310621,29609,'UserAgent','Mozilla/5.0 (iPhone; CPU iPhone OS 11_0_2 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Mobile/15A421 [FBAN/FBIOS;FBDV/iPhone8,1;FBMD/iPhone;FBSN/iOS;FBSV/11.0.2;FBSS/2;FBCR/etisalat;FBID/phone;FBLC/en_US;FBOP/5;FBRV/0]'),
	(310622,29610,'PostID','8277'),
	(310623,29610,'PostType','news-room'),
	(310624,29610,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310625,29610,'PostStatus','draft'),
	(310626,29610,'PostDate','2018-09-05 16:05:23'),
	(310627,29610,'PostUrl','http://localhost:8888/tamimi/?post_type=news-room&p=8277'),
	(310628,29610,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310629,29610,'ClientIP','83.111.236.141'),
	(310630,29610,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310631,29610,'CurrentUserID','8'),
	(310632,29610,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310633,29610,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310634,29611,'PostID','8277'),
	(310635,29611,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310636,29611,'PostStatus','draft'),
	(310637,29611,'PostType','news-room'),
	(310638,29611,'PostDate','2018-09-05 16:05:23'),
	(310639,29611,'PostUrl','http://localhost:8888/tamimi/?post_type=news-room&p=8277'),
	(310640,29611,'MetaKey','newsPractices'),
	(310641,29611,'MetaLink','newsPractices'),
	(310642,29611,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310643,29611,'ClientIP','83.111.236.141'),
	(310644,29611,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310645,29611,'CurrentUserID','8'),
	(310646,29611,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310647,29611,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310648,29612,'PostID','8277'),
	(310649,29612,'PostType','news-room'),
	(310650,29612,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310651,29612,'PostStatus','draft'),
	(310652,29612,'PostDate','2018-09-05 16:05:25'),
	(310653,29612,'PostUrl','http://localhost:8888/tamimi/?post_type=news-room&p=8277'),
	(310654,29612,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310655,29612,'ClientIP','83.111.236.141'),
	(310656,29612,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310657,29612,'CurrentUserID','8'),
	(310658,29612,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310659,29612,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310660,29613,'PostID','8277'),
	(310661,29613,'PostType','news-room'),
	(310662,29613,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310663,29613,'PostStatus','publish'),
	(310664,29613,'PostDate','2018-09-05 16:05:45'),
	(310665,29613,'PostUrl','http://localhost:8888/tamimi/news-room/major-saudi-professional-football-league-deal-announcements/'),
	(310666,29613,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310667,29613,'ClientIP','83.111.236.141'),
	(310668,29613,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310669,29613,'CurrentUserID','8'),
	(310670,29613,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310671,29613,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310672,29614,'PostID','8277'),
	(310673,29614,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310674,29614,'PostStatus','publish'),
	(310675,29614,'PostType','news-room'),
	(310676,29614,'PostDate','2018-09-05 16:05:45'),
	(310677,29614,'PostUrl','http://localhost:8888/tamimi/news-room/major-saudi-professional-football-league-deal-announcements/'),
	(310678,29614,'MetaID','227639'),
	(310679,29614,'MetaKey','content'),
	(310680,29614,'MetaValueNew','<p class=\"p1\">We are pleased to announce that Partner Bandar Al Hamidani and Al Tamimi‘s KSA sports team, including Pedro Castro and Nasser Al Ohaly, represented Al Hilal Saudi FC, a major football club in Saudi Arabia, in its successful negotiations to bring on board the playmaker Omar Abdulrahman, also known as “Amouri”. Amouri is regarded by many as the best football player in Asia and he returns to Al Hilal Saudi FC after 12 years with Al Ain of UAE. Al Tamimi‘s KSA sports team also successfully represented the club in the negotiations with Turkish football club Galatasaray in relation to the transfer of the French international striker Bafetimbi Gomis.</p>\r\n<p class=\"p1\">These deals were a great success for both our client, and the firm.</p>\r\n<p class=\"p1\">Please see below for photos of Bandar with Amouri and Al Hilal Saudi FC President Sami Al Jaber, and Bafetimbi Gomis with Bandar and Pedro, after signing with the club.</p>\r\n&nbsp;\r\n\r\n<img class=\"wp-image-8279 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Amouri-Pic.jpg\" alt=\"\" width=\"294\" height=\"361\" /><img class=\"aligncenter  wp-image-8278\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Bandar-Pedro-and-Gomis.jpg\" alt=\"\" width=\"393\" height=\"311\" />'),
	(310681,29614,'MetaValueOld','<p class=\"p1\">We are pleased to announce that Partner Bandar Al Hamidani and Al Tamimi‘s KSA sports team, including Pedro Castro and Nasser Al Ohaly, represented Al Hilal Saudi FC, a major football club in Saudi Arabia, in its successful negotiations to bring on board the playmaker Omar Abdulrahman, also known as “Amouri”. Amouri is regarded by many as the best football player in Asia and he returns to Al Hilal Saudi FC after 12 years with Al Ain of UAE. Al Tamimi‘s KSA sports team also successfully represented the club in the negotiations with Turkish football club Galatasaray in relation to the transfer of the French international striker Bafetimbi Gomis.</p>\r\n<p class=\"p1\">These deals were a great success for both our client, and the firm.</p>\r\n<p class=\"p1\">Please see below for photos of Bandar with Amouri and Al Hilal Saudi FC President Sami Al Jaber, and Bafetimbi Gomis with Bandar and Pedro, after signing with the club.</p>\r\n\r\n<img class=\"wp-image-8279 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Amouri-Pic.jpg\" alt=\"\" width=\"294\" height=\"361\" /><img class=\"aligncenter  wp-image-8278\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Bandar-Pedro-and-Gomis.jpg\" alt=\"\" width=\"393\" height=\"311\" />'),
	(310682,29614,'MetaLink','content'),
	(310683,29614,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310684,29614,'ReportText','<p class=\"p1\">We are pleased to announce that Partner Bandar Al Hamidani and Al Tamimi‘s KSA sports team, including Pedro Castro and Nasser Al Ohaly, represented Al Hilal Saudi FC, a major football club in Saudi Arabia, in its successful negotiations to bring on board the playmaker Omar Abdulrahman, also known as “Amouri”. Amouri is regarded by many as the best football player in Asia and he returns to Al Hilal Saudi FC after 12 years with Al Ain of UAE. Al Tamimi‘s KSA sports team also successfully represented the club in the negotiations with Turkish football club Galatasaray in relation to the transfer of the French international striker Bafetimbi Gomis.</p>\r\n<p class=\"p1\">These deals were a great success for both our client, and the firm.</p>\r\n<p class=\"p1\">Please see below for photos of Bandar with Amouri and Al Hilal Saudi FC President Sami Al Jaber, and Bafetimbi Gomis with Bandar and Pedro, after signing with the club.</p>\r\n\r\n<img class=\"wp-image-8279 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Amouri-Pic.jpg\" alt=\"\" width=\"294\" height=\"361\" /><img class=\"aligncenter  wp-image-8278\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Bandar-Pedro-and-Gomis.jpg\" alt=\"\" width=\"393\" height=\"311\" />|<p class=\"p1\">We are pleased to announce that Partner Bandar Al Hamidani and Al Tamimi‘s KSA sports team, including Pedro Castro and Nasser Al Ohaly, represented Al Hilal Saudi FC, a major football club in Saudi Arabia, in its successful negotiations to bring on board the playmaker Omar Abdulrahman, also known as “Amouri”. Amouri is regarded by many as the best football player in Asia and he returns to Al Hilal Saudi FC after 12 years with Al Ain of UAE. Al Tamimi‘s KSA sports team also successfully represented the club in the negotiations with Turkish football club Galatasaray in relation to the transfer of the French international striker Bafetimbi Gomis.</p>\r\n<p class=\"p1\">These deals were a great success for both our client, and the firm.</p>\r\n<p class=\"p1\">Please see below for photos of Bandar with Amouri and Al Hilal Saudi FC President Sami Al Jaber, and Bafetimbi Gomis with Bandar and Pedro, after signing with the club.</p>\r\n&nbsp;\r\n\r\n<img class=\"wp-image-8279 alignleft\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Amouri-Pic.jpg\" alt=\"\" width=\"294\" height=\"361\" /><img class=\"aligncenter  wp-image-8278\" src=\"http://localhost:8888/tamimi/wp-content/uploads/2018/09/Bandar-Pedro-and-Gomis.jpg\" alt=\"\" width=\"393\" height=\"311\" />'),
	(310685,29614,'ClientIP','83.111.236.141'),
	(310686,29614,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310687,29614,'CurrentUserID','8'),
	(310688,29614,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310689,29614,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310690,29615,'PostID','8277'),
	(310691,29615,'PostType','news-room'),
	(310692,29615,'PostTitle','Major Saudi Professional Football League Deal Announcements'),
	(310693,29615,'PostStatus','publish'),
	(310694,29615,'PostDate','2018-09-05 16:05:45'),
	(310695,29615,'PostUrl','http://localhost:8888/tamimi/news-room/major-saudi-professional-football-league-deal-announcements/'),
	(310696,29615,'EditorLinkPost','http://localhost:8888/tamimi/wp-admin/post.php?post=8277&amp;action=edit'),
	(310697,29615,'ClientIP','83.111.236.141'),
	(310698,29615,'UserAgent','Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36'),
	(310699,29615,'CurrentUserID','8'),
	(310700,29615,'CurrentUserRoles','a:2:{i:0;s:13:\"administrator\";i:1;s:10:\"superadmin\";}'),
	(310701,29615,'SessionID','72775d6b0fb5fe66056a1af4a58815fea613da46a48f2a9cdb5b4b8424cb5c03'),
	(310702,29616,'Attempts','52'),
	(310703,29616,'Username','Website Visitor'),
	(310704,29616,'Msg','times'),
	(310705,29616,'URL','http://localhost:8888/tamimi/autodiscover/autodiscover.xml'),
	(310706,29616,'ClientIP','41.32.82.191'),
	(310707,29616,'UserAgent','Business/6.17.2.5 CFNetwork/901.1 Darwin/17.6.0'),
	(310708,29617,'PostID','980'),
	(310709,29617,'PostType','page'),
	(310710,29617,'PostTitle','News'),
	(310711,29617,'PostStatus','publish'),
	(310712,29617,'PostDate','2017-09-28 12:27:58'),
	(310713,29617,'PostUrl','http://localhost:8888/tamimi/news/'),
