Technology outsourcing-wasting a great opportunity
Poland, after EU Accession, has a chance to get a fair share in this market, viewed by many American and European firms as an attractive location for outsourcing and an interesting alternative to Asian countries. Also, the local need for outsourcing, especially in the financial sector, is rapidly growing. Instead of stimulating growth, or at least being neutral, the amendments to the Banking Law effective from
May 1, 2004 and the recently issued guidelines by the banking supervising authorities have, unfortunately, a contrary effect.
Background
Before the amendments, the Banking Law was silent on the issue of outsourcing. In the conservative opinion of the banking supervising authorities, however, outsourcing was not allowed, because of the banking secrecy provisions. Despite this negative position, many banks decided-even long before the new regulations came into force-to outsource some of their operations. In that case, possible economic benefits outweighed the risks of outsourcing being questioned by the supervision authorities.
Changes in the law-are we really moving forward?
Uncertainty is bad for business, and many expected that the new, long-awaited regulations will explicitly allow outsourcing transactions in the banking sector. It could open possibilities for a dynamic development, possibly placing Poland as a regional center for this type of services. Finally, after lengthy discussions, on May 1, 2004 a new comprehensive regulation came into force. It is disappointing, though, to say the least. Although outsourcing has been allowed, the new banking law contains restrictive provisions unheard of in other European laws. Moreover, the banking supervising authorities recently issued a set of interpretations which, instead of helping to solve some issues, made things even more complicated.
So what actually is 'outsourcing' ?
Outsourcing means the transfer of an in-house function to an external service provider for the on-going provision of those services typically involving the transfer of physical, real and intangible assets and people. However, the definition of "outsourcing services in the new Banking Law has a much broader scope than the generally accepted meaning of this term described above. They are vaguely defined as 'any services connected with banking activities'. It was expected that the banking supervising authority will explain more precisely what is exactly meant by that. In their recently issued guidelines, however, they merely stated that 'outsourcing services are any services functionally connected with banking activities' and gave three examples of services which would not fall within the scope of this definition: cleaning, catering and protection of buildings. This surprising statement shows the extent of confusion and uncertainty the new regulations have caused. The guidelines offer little help, if at all, in clearing up fundamental interpretation problems connected with the definition of 'outsourcing'. At the same time, the banking supervising authorities consequently, although on an informal basis, present the opinion that all IT contracts concluded with banks will be treated as outsourcing.
This interpretation causes a lot of confusion and concern throughout the IT industry, bearing in mind the consequences of falling into the definition of outsourcing which are described further in this article. What does it mean in practice? 'Body shopping' (which is the industry buzzword for hiring freelance IT consultants) should then be considered as outsourcing. A contract for maintenance of printers, an IT audit, a software development agreement, any form of consulting-all this would also fall in this category. This is contrary to common sense and it is hard to believe that this is actually what was the purpose of the new Banking Law. It should be the banking supervision authorities' role to prevent such significant interpretative doubts from arising. It does not happen and it is disappointing.
The UK regulatory model
A comparison with similar regulations in other EU countries will serve as an interesting point of reference for further discussion. First of all, in the United Kingdom the definition of 'outsourcing' is-unsurprisingly-in line with the generally accepted meaning of this word described above. As such, it covers a much smaller category of services, compared to the Polish legal definition. Yet not all of them are the subject of the Financial Services Authority's (FSA) special interest, but only 'material outsourcing'.
The supervision model in the UK is based on a different philosophy-it is up to the firms to implement effective risk management systems, and decide how to do it best in line with their business strategy. The FSA has issued, high-level and non-binding, guidelines for outsourcing contracts, but the firms are free to negotiate and set up in the contract appropriate performance monitoring and remedies with their counterparties. Last but not least, there is no requirement to obtain any permits to enter into outsourcing arrangements, and the obligation to notify outsourcing agreements (limited to 'material outsourcing') will come into force in the last quarter of 2004, one year after it has been made publicly available.
Banking law vs. the principle of freedom of contracts
On the other hand, in Poland, our proactive legislator decided to pass a law interfering directly with the content of the outsourcing contracts: the new Banking Law prohibits the limitation of outsourcing providers' liability vis-a-vis banks for "damage caused to customers through the improper performance of an outsourcing contract". Let us take a closer look at this provision. It is worded wrongly and is against the constitutional principle of freedom of contract. Moreover, it is ignoring business principles commonly accepted in the IT industry (it affects all IT contracts under the current broad definition of 'outsourcing'), and, finally, no similar provision, according to my best knowledge, can be found in any other EU country, or the United States.
The purpose of this unfortunate provision was most probably to protect bank customers (not the banks themselves, as the prohibition applies only to damage suffered by customers, and not banks). Let us assume that due to improper performance of an outsourcing provider, a customer suffers damage and files a claim against the bank. The probability of an individual client filing such a claim against a bank is quite remote, though. Thus, rather surprisingly, this provision protects mostly the institutional customers of banks. Let us assume that a customer wins a lengthy lawsuit. Only then, the bank could file a recourse claim against the outsourcing provider whose liability in that respect would be unlimited. One can easily get lost in these legal complexities and a real black scenario may fall off one's radar screens: in the case where the outsourcing provider significantly fails to perform its obligations, which may seriously disrupt the bank's activity, the bank has to take appropriate steps including termination of the contract and claim for damages. In such case, though, the prohibition of limitation of liability would not apply, and liability issues would be governed by the provisions of the contract, concluded between the parties. It is not clear then why the prohibition of limiting liability would be so badly needed, if it does not bring much value. Especially if it is contrary to the fundamental freedom of contracts rule and there is no obvious public interest, which would justify it. At least no such public interest has been found by the legislators in other EU jurisdictions, or the US, where there are no similar restrictions.
The Constitutional Tribunal confirmed many times in its verdicts that the freedom to agree on the content of contracts is the basis of the principle of economic freedom and it can be limited only by an act of law, if it is necessary to protect an important public interest. In such a case the balance between the degree of violation of individual rights and the importance of the public interest that such a limitation is intended to protect should be considered. There are serious doubts if the new Banking Law provisions are compliant with the Constitution in light of the above judgments.
And finally, the prohibition to limit liability is contrary to the business practice on the IT market. An unlimited liability clause is a deal breaker for all reputable global players, which, on the other hand, are open to discuss reasonable caps on liability giving comfort to their clients. This stems from the revenue recognition rules under the GAAP standards, the majority of major outsourcing providers are subject to. They impose the obligation to disclose potential liabilities arising from contracts. A company which would sign even one contract under the principle of unlimited liability as required by the new Banking Law, would be unable to quantify its liability. Is it just the outsourcing providers' problem...? I do not think so-it is probably not in the banks' best interest to conclude agreements with one-man-and-a-dog type of firms gladly accepting unlimited liability, rather than reputable outsourcing providers able to pay damages within an agreed cap.
Banking Law vs. the principle of acquired rights
So what do we have here? A prohibition of limiting liability in outsourcing contracts and an unreasonably broad definition of 'outsourcing contracts' covering all IT contracts. But there is even more... The new Banking Law contains transitional provisions requiring that all the existing 'outsourcing contracts' have to comply with the new regulations by the end of 2004. This means that the principle of unlimited liability will have to be included in all IT contracts concluded by banks. This requirement puts both IT companies and banks in a very difficult position.
Imagine a large Polish which had bank concluded a contract for the implementation of a central IT system with a long term maintenance containing a limitation of liability clause. This high-value project, crucial for the bank's operations is half finished. Then the new banking regulations impose the obligation to remove the limitation of liability clause. The parties enter into negotiations... It is hard to imagine a more conflicting situation. Surely, it will not help in the efficient completion of the project. How to value the increase in the provider's risk arising from the removal of the limitation of liability from the contract...? Will the provider accept it at all...? How to amicably terminate the contract if the parties fail to reach an agreement...? What consequences may it have to banks...? These are only some of the questions that come to mind. It is hard to understand how the benefits offered by the new regulations could outweigh potential losses they may cause.
More importantly, the transitional provisions are clearly violating the constitutional principle of security of the state and the law. New laws cannot have a retroactive, adverse effect on the rights acquired in good faith under earlier laws. It is a fundamental constitutional principle commonly accepted in all democracies and has been confirmed many times in the Constitutional Tribunal's verdicts.
Some eggs have been broken. We should now work together and try to cook possibly the biggest omelette out of them. Certain modifications to the new Banking Law will be necessary, which will be a lengthy process. However, a lot can be done in parallel with the help of the banking supervisory authorities. A clear definition of 'outsourcing' would reduce the scale of the problem. An open discussion with the banking and IT industries and drawing from the experience of other EU countries could lead to the creation of a set of guidelines for outsourcing transactions. The supervising authorities could reconsider certain of their controversial interpretations such as the prohibition for outsourcing providers to sub-contract works. Let us hope that it will all happen as soon as possible.
May 1, 2004 and the recently issued guidelines by the banking supervising authorities have, unfortunately, a contrary effect.
Background
Before the amendments, the Banking Law was silent on the issue of outsourcing. In the conservative opinion of the banking supervising authorities, however, outsourcing was not allowed, because of the banking secrecy provisions. Despite this negative position, many banks decided-even long before the new regulations came into force-to outsource some of their operations. In that case, possible economic benefits outweighed the risks of outsourcing being questioned by the supervision authorities.
Changes in the law-are we really moving forward?
Uncertainty is bad for business, and many expected that the new, long-awaited regulations will explicitly allow outsourcing transactions in the banking sector. It could open possibilities for a dynamic development, possibly placing Poland as a regional center for this type of services. Finally, after lengthy discussions, on May 1, 2004 a new comprehensive regulation came into force. It is disappointing, though, to say the least. Although outsourcing has been allowed, the new banking law contains restrictive provisions unheard of in other European laws. Moreover, the banking supervising authorities recently issued a set of interpretations which, instead of helping to solve some issues, made things even more complicated.
So what actually is 'outsourcing' ?
Outsourcing means the transfer of an in-house function to an external service provider for the on-going provision of those services typically involving the transfer of physical, real and intangible assets and people. However, the definition of "outsourcing services in the new Banking Law has a much broader scope than the generally accepted meaning of this term described above. They are vaguely defined as 'any services connected with banking activities'. It was expected that the banking supervising authority will explain more precisely what is exactly meant by that. In their recently issued guidelines, however, they merely stated that 'outsourcing services are any services functionally connected with banking activities' and gave three examples of services which would not fall within the scope of this definition: cleaning, catering and protection of buildings. This surprising statement shows the extent of confusion and uncertainty the new regulations have caused. The guidelines offer little help, if at all, in clearing up fundamental interpretation problems connected with the definition of 'outsourcing'. At the same time, the banking supervising authorities consequently, although on an informal basis, present the opinion that all IT contracts concluded with banks will be treated as outsourcing.
This interpretation causes a lot of confusion and concern throughout the IT industry, bearing in mind the consequences of falling into the definition of outsourcing which are described further in this article. What does it mean in practice? 'Body shopping' (which is the industry buzzword for hiring freelance IT consultants) should then be considered as outsourcing. A contract for maintenance of printers, an IT audit, a software development agreement, any form of consulting-all this would also fall in this category. This is contrary to common sense and it is hard to believe that this is actually what was the purpose of the new Banking Law. It should be the banking supervision authorities' role to prevent such significant interpretative doubts from arising. It does not happen and it is disappointing.
The UK regulatory model
A comparison with similar regulations in other EU countries will serve as an interesting point of reference for further discussion. First of all, in the United Kingdom the definition of 'outsourcing' is-unsurprisingly-in line with the generally accepted meaning of this word described above. As such, it covers a much smaller category of services, compared to the Polish legal definition. Yet not all of them are the subject of the Financial Services Authority's (FSA) special interest, but only 'material outsourcing'.
The supervision model in the UK is based on a different philosophy-it is up to the firms to implement effective risk management systems, and decide how to do it best in line with their business strategy. The FSA has issued, high-level and non-binding, guidelines for outsourcing contracts, but the firms are free to negotiate and set up in the contract appropriate performance monitoring and remedies with their counterparties. Last but not least, there is no requirement to obtain any permits to enter into outsourcing arrangements, and the obligation to notify outsourcing agreements (limited to 'material outsourcing') will come into force in the last quarter of 2004, one year after it has been made publicly available.
Banking law vs. the principle of freedom of contracts
On the other hand, in Poland, our proactive legislator decided to pass a law interfering directly with the content of the outsourcing contracts: the new Banking Law prohibits the limitation of outsourcing providers' liability vis-a-vis banks for "damage caused to customers through the improper performance of an outsourcing contract". Let us take a closer look at this provision. It is worded wrongly and is against the constitutional principle of freedom of contract. Moreover, it is ignoring business principles commonly accepted in the IT industry (it affects all IT contracts under the current broad definition of 'outsourcing'), and, finally, no similar provision, according to my best knowledge, can be found in any other EU country, or the United States.
The purpose of this unfortunate provision was most probably to protect bank customers (not the banks themselves, as the prohibition applies only to damage suffered by customers, and not banks). Let us assume that due to improper performance of an outsourcing provider, a customer suffers damage and files a claim against the bank. The probability of an individual client filing such a claim against a bank is quite remote, though. Thus, rather surprisingly, this provision protects mostly the institutional customers of banks. Let us assume that a customer wins a lengthy lawsuit. Only then, the bank could file a recourse claim against the outsourcing provider whose liability in that respect would be unlimited. One can easily get lost in these legal complexities and a real black scenario may fall off one's radar screens: in the case where the outsourcing provider significantly fails to perform its obligations, which may seriously disrupt the bank's activity, the bank has to take appropriate steps including termination of the contract and claim for damages. In such case, though, the prohibition of limitation of liability would not apply, and liability issues would be governed by the provisions of the contract, concluded between the parties. It is not clear then why the prohibition of limiting liability would be so badly needed, if it does not bring much value. Especially if it is contrary to the fundamental freedom of contracts rule and there is no obvious public interest, which would justify it. At least no such public interest has been found by the legislators in other EU jurisdictions, or the US, where there are no similar restrictions.
The Constitutional Tribunal confirmed many times in its verdicts that the freedom to agree on the content of contracts is the basis of the principle of economic freedom and it can be limited only by an act of law, if it is necessary to protect an important public interest. In such a case the balance between the degree of violation of individual rights and the importance of the public interest that such a limitation is intended to protect should be considered. There are serious doubts if the new Banking Law provisions are compliant with the Constitution in light of the above judgments.
And finally, the prohibition to limit liability is contrary to the business practice on the IT market. An unlimited liability clause is a deal breaker for all reputable global players, which, on the other hand, are open to discuss reasonable caps on liability giving comfort to their clients. This stems from the revenue recognition rules under the GAAP standards, the majority of major outsourcing providers are subject to. They impose the obligation to disclose potential liabilities arising from contracts. A company which would sign even one contract under the principle of unlimited liability as required by the new Banking Law, would be unable to quantify its liability. Is it just the outsourcing providers' problem...? I do not think so-it is probably not in the banks' best interest to conclude agreements with one-man-and-a-dog type of firms gladly accepting unlimited liability, rather than reputable outsourcing providers able to pay damages within an agreed cap.
Banking Law vs. the principle of acquired rights
So what do we have here? A prohibition of limiting liability in outsourcing contracts and an unreasonably broad definition of 'outsourcing contracts' covering all IT contracts. But there is even more... The new Banking Law contains transitional provisions requiring that all the existing 'outsourcing contracts' have to comply with the new regulations by the end of 2004. This means that the principle of unlimited liability will have to be included in all IT contracts concluded by banks. This requirement puts both IT companies and banks in a very difficult position.
Imagine a large Polish which had bank concluded a contract for the implementation of a central IT system with a long term maintenance containing a limitation of liability clause. This high-value project, crucial for the bank's operations is half finished. Then the new banking regulations impose the obligation to remove the limitation of liability clause. The parties enter into negotiations... It is hard to imagine a more conflicting situation. Surely, it will not help in the efficient completion of the project. How to value the increase in the provider's risk arising from the removal of the limitation of liability from the contract...? Will the provider accept it at all...? How to amicably terminate the contract if the parties fail to reach an agreement...? What consequences may it have to banks...? These are only some of the questions that come to mind. It is hard to understand how the benefits offered by the new regulations could outweigh potential losses they may cause.
More importantly, the transitional provisions are clearly violating the constitutional principle of security of the state and the law. New laws cannot have a retroactive, adverse effect on the rights acquired in good faith under earlier laws. It is a fundamental constitutional principle commonly accepted in all democracies and has been confirmed many times in the Constitutional Tribunal's verdicts.
Some eggs have been broken. We should now work together and try to cook possibly the biggest omelette out of them. Certain modifications to the new Banking Law will be necessary, which will be a lengthy process. However, a lot can be done in parallel with the help of the banking supervisory authorities. A clear definition of 'outsourcing' would reduce the scale of the problem. An open discussion with the banking and IT industries and drawing from the experience of other EU countries could lead to the creation of a set of guidelines for outsourcing transactions. The supervising authorities could reconsider certain of their controversial interpretations such as the prohibition for outsourcing providers to sub-contract works. Let us hope that it will all happen as soon as possible.
