Execute Written Outsourcing Agreements

Purpose

Translate the CBCS outsourcing guideline into a testable BCMS requirement for outsourcing governance and control.

Normative

Bitkaya shall ensure that every outsourcing arrangement is governed by a written agreement that clearly allocates rights, obligations, responsibilities, service expectations, access rights, audit rights, data requirements, termination rights and exit obligations.

Descriptive

Written agreements should include the minimum contract content specified by the guideline, including outsourced activities, term, fees, locations, service levels, reporting, liability, continuity, data access, regulatory access, audit, record retention, fraud or mismanagement reporting, governing law, termination and exit management.

Source reference: CBCS Guideline on Outsourcing, Article 6, Article 16, Article 17, Article 18, Article 19, Article 20 and Appendix 5.

Assurance Assertions

• Every outsourcing arrangement has a signed written agreement.
• The agreement includes access, information and audit rights for Bitkaya and competent authorities.
• The agreement includes service levels, reporting, termination and exit provisions.

Relationships

• Source: SRC-OUT-001 CBCS Guideline for the Sound Management of Outsourcing
• Policies: POL-OUT-001 Outsourcing Risk Management Manual
• Process: PRC-GRO-001 Governance Risk and Outsourcing
• Procedures: PROC-OUT-004 Review and Execute Outsourcing Agreement
• Controls: CTRL-OUT-004 Ensure Written Agreement Contains Outsourcing Safeguards
• Systems: SYS-OUT-001 Outsourcing Register
• Publications: PUB-OUT-001 Outsourcing Risk Management Manual
• Issues: ISS-OUT-001 Complete Outsourcing Operating Artifacts and Evidence

Assurance

• Source verified: yes
• Implementation linked: yes; remaining operational follow-up is tracked in ISS-OUT-001 where applicable
• Wording unambiguous: approved

History

• 2026-07-25: Created from SRC-OUT-001.
• 2026-07-25: Linked outsourcing operational implementation objects derived from the Bitkaya outsourcing manual.
• 2026-07-25: Approved outsourcing requirement for BCMS use.