The impact of regulatory requirements on German financial institutions’ outsourcing arrangements

Abstract

Purpose

The purpose of this paper is to analyse and investigate how intensified regulatory requirements related to outsourcing have influenced and changed the outsourcing activities of German financial institutions.

Design/methodology/approach

The study involved interviewing 11 outsourcing experts in the German financial sector, including four of the five largest banks in Germany. In coding and analysing the collected data, this study adopted the approach of a qualitative content analysis framework.

Findings

The study found that the revised legal requirements have had a significant and potentially negative impact on the efficiency of outsourcing, leading to a necessity for German financial institutions to internally realign their outsourcing managements. The study further revealed practical realigned methods German financial institutions executed to meet the legal requirements.

Originality/value

The impact, meaning and relevance of legal requirements in the outsourcing environment of German financial institutions has been relatively under-researched from a qualitative perspective and focused on other primary fields of investigation like outsourcing decisions and outcomes. This study has, by adopting a qualitative approach, addressed the identified gap by providing first-hand insights and new knowledge.

Citation

Hasan, R. and Kruse, O. (2024), "The impact of regulatory requirements on German financial institutions’ outsourcing arrangements", Journal of Financial Regulation and Compliance, Vol. 32 No. 1, pp. 1-17. https://doi.org/10.1108/JFRC-03-2023-0033

1. Introduction

Outsourcing has begun to be recognised as an established economic method in Europe’s banking industry as a means to improve the efficiency of financial institutions (European Banking Federation, 2018) and provides banks access to recent technological developments and digitalisation (Kelp, 2019). However, with the European financial crisis of 2008, the financial authorities modified and increased the legal requirements for financial institutions (Deutsche Bundesbank, 2013), which led to German banks increasingly needing to adhere and adapt to these new regulations. The German Federal Financial Supervisory Authority (BaFin), in response, revised the Minimum Requirements for Risk Management (MaRisk) (BaFin, 2017, 2021), including the outsourcing part under section AT 9, which also affected the outsourcing activities of German banks. However, from the German Federal Financial Authority’s perspective, the German banks lacked a robust outsourcing strategy and effective management and monitoring of their outsourcing arrangements and were unaware of the risks related to their outsourcing activities (BaFin, 2017, 2019). As an outcome of this lack, and with the purpose of harmonising and integrating the regulatory requirements in the European outsourcing environment, the European Banking Authority (EBA) published the new EBA Guidelines on outsourcing arrangements in 2019 (European Banking Authority, 2019a). The new and revised regulations will require an internal adjustment of operational and organisational structures and processes and therefore will have a significant impact on financial institutions’ outsourcing management.

2. Literature review

2.1 Actual debate concerning outsourcing in the German banking sector

The low interest rates environment within the whole European Union and the highly competitive situation in the German banking industry caused by the so-called FinTech and BigTech’s puts German banks under pressure and leads to decreasing profits, and therefore strongly calls for reconsideration of the banks business models (Deutsche Bundesbank, 2017, 2018, 2019). Supplementary to the competitive situation with FinTech’s and BigTech’s like Google, Amazon or Facebook also offering financial products, German banks are faced with challenges resulting from digitalisation and demographic change (Deutsche Bundesbank, 2019; Moormann, 2020). Apart from the above highlighted environmental influences, the financial authorities increased the legal requirements for financial institutions in response to the financial crisis of 2008, to ensure a more stable financial system for potential future crises (Deutsche Bundesbank, 2010, 2013). Related to outsourcing, the German Federal Financial Supervisory Authority (BaFin) modified the Minimum Requirements for Risk Management (MaRisk) in 2017 and 2021 (BaFin, 2017, 2021) and in particular the general outsourcing part under section AT 9, which also affect the outsourcing activities of banks. The European Banking Authority (EBA) in 2019 additionally published the EBA Guidelines on outsourcing arrangements with the aim of realigning regulations around the supervision of outsourcing activities of financial institutions (European Banking Authority, 2019b). Within the executive summary of the EBA Guidelines on outsourcing arrangements, the European Banking Authority stated that financial institutions had increased their outsourcing activities to a large extent and the authorities had to keep track of these outsourcing arrangements by enabling a closer supervision of the related risks, to ensure a stable financial system (European Banking Authority, 2018, 2019a). As the banks have been slow to implement the outsourcing regulations including the monitoring and reporting of the risks, the German and European financial authorities additionally have undertaken a series of audits in recent years to strengthen their control regarding banks’ outsourcing activities for the future (BaFin, 2017, 2019; Buchmüller et al., 2019; European Banking Authority, 2019a; Ketessidis, 2007). Furthermore, the European Central Bank stated that the supervision of banking’s outsourcing activities would be a focus of the European Central Bank in future (European Central Bank, 2018, 2019). The result has been that German and European banks consider these modifications and changes to be a disproportional increase in the number of regulations. In this respect, the German and European banks stated that these new requirements, especially concerning outsourcing, could lead to a decrease in profitability of their outsourcing activities or banks would no longer procure external knowledge even though it would reduce the risk potential (Bankenfachverband, 2016; Die Deutsche Kreditwirtschaft, 2016; European Banking Federation, 2018). These challenges as highlighted above indicate that German banks have to deal with strong environmental issues, such as high competition and low interest rates. In addition, the banking authorities increased the legal requirements on outsourcing as a result of the financial crisis and high risks related to outsourcing activities. These challenges, combined with the criticism of the financial authorities related to the low experiences and missing frameworks in the implementation and procedures of outsourcing in financial institutions, demonstrated a need for an improvement of banks’ understanding regarding their outsourcing activities. However, although existing literature provided useful insights and reasons why the financial authorities intensified the outsourcing regulations, existing literature did not provide critical and first-hand qualitative insights from practitioners or any supportive evidence and insights from the banking perspective. This study addresses this gap by investigating the complexities surrounding the theme of outsourcing regulations to provide rich and critical insights from the banking perspective, and to provide a critical debate into the meaning and significance of outsourcing regulations in the banking environment.

2.2 Debate around outsourcing research

Outsourcing of services and processes has become a significant concept which has led to an extensive academic debate and studies amongst economists and researchers alike (Gerbl et al., 2016). These studies have included academic research into how outsourcing can be best categorised in the general categories of outsourcing decisions and outcomes (Lacity et al., 2016; Lacity et al., 2010; Lacity et al., 2011; Liang et al., 2016). In investigating the outsourcing decisions and outcomes, a number of researchers, including Gewald (2011), Gewald and Dibbern (2005), Gewald and Hinz (2004) and Wüllenweber et al. (2006), have concentrated on analysing the general motivation for outsourcing by assessing the risks and benefits of outsourcing and the general attitude of financial institutions towards outsourcing. Related benefits have emerged from these studies, including the access to specialised know-how within the vendors, cost savings and the opportunity for banks to concentrate on their core competencies while outsourcing back-office processes to specialised vendors. In contrast, relevant research, including from BaFin (2019a), the European Banking Authority (2018), Gewald (2011), Gewald and Dibbern (2009) and Kelp (2019), revealed that the main risks related to the outsourcing activities of German financial institutions are operational, financial, privacy and dependency risks. However, even though outsourcing outcomes and decisions have been relatively extensively researched, there has been only small number of studies focused on the challenges of regulatory requirements for the banking industry. Although relevant publications including from Schad (2019), PricewaterhouseCoopers (2018), the German Banking Industry Committee (2018) and Riediger (2018) indicated that legal requirements have a significant influence on financial institutions’ outsourcing projects, due to the rising needs for further analysis and enormous administrative effort in implementing the legal requirements in the financial institutions, these studies focused on other primary fields of investigations and have been in the main quantitative-based and descriptive and therefore have only provided a summative and predictive account and did not provide a critical or qualitative insight from the banking perspective regarding the context behind the challenges of the legal requirements. Lacity et al. (2016), in critically reviewing outsourcing literature, found that academic research related to the environmental influences of outsourcing arrangements, for example with the impact of legal requirements, is limited. Gewald et al. (2017) concurred and highlighted that there is a need for further research in the field of environmental influences like the impact of regulations on outsourcing.

Reflecting the above identified research gap, this study intends to address this omission and investigate the growing importance and complexity of the legal requirements. The paper further aims to provide a critical insight into the theme of outsourcing regulations and to understand the relevance and impact of regulatory requirements in the German outsourcing environment and how the financial institutions changed their outsourcing management and activities to fulfil the regulatory requirements in the most efficient way. Based on the research gap and the aim of the study, the study’s research questions are:

RQ1.

What impact do the existing regulatory requirements have on German financial institutions’ outsourcing activities, and particularly the strategic alignment of their supplier management?

RQ2.

What meaning and relevance do statutory regulations have in German banking managers’ perceptions related to their supplier management and outsourcing activities?

RQ3.

How might financial institutions internally realign and change their supplier management and outsourcing activities to meet the statutory and regulatory requirements in the most efficient way?

3. Methodology

3.1 Research approach

Addressing the identified gap in the literature review, a qualitative research approach was chosen in this research project, to achieve a critical and more insightful understanding of the participants’ perceptions regarding the new and increased outsourcing regulations (Denzin and Lincoln, 1994). The qualitative approach was considered to be appropriate for this study, as a qualitative approach led the researchers to the application of a inductive method by developing new knowledge and understanding gained from the different and critical perspectives of the banking participants in this research project (Guba and Lincoln, 1994; Marshall and Rossman, 1995; Silverman, 2010).

3.2 Research method

The research design followed a cross-sectional research design, applying semi-structured interviews as the data collection method. Interviews represented a flexible method for the researchers to obtain data out of the experiences, viewpoints and personal knowledge of participants (Walliman, 2001). Through adopting semi-structured interviews, the researchers had the flexibility to pre-define themes or questions relevant to the study but also to investigate emerging viewpoints or themes concerning the field of investigation (Robson, 2011).

3.3 The study profile

The main study consisted of 11 interview participants from the German financial sector, who were used at eight different banks, two service providers and one leading management consultancy. The interview sample consisted of five of the ten largest banks in Germany to ensure high quality and validity of the collected data and provided the researchers with new and critical insights into the outsourcing managerial activities of the biggest German banks. This interview sample shows the origin and aim of this research in the best way, as the largest German banks are in the main focus of the financial authorities and have already had to undergo several supervisions executed by the German Federal Financial Authority or the European Central Bank (European Central Bank, 2019; Riediger, 2018). The interview participants also represent some smaller and middle-sized banks with experience in the outsourcing environment. Table 1 below provides an overview concerning the participants’ profiles.

3.4 Data collection

To gather the research data, the researchers conducted 11 interviews with experts in the outsourcing environment of German financial institutions. Seven participants were accessed from the researchers’ personal network. Four more participants were approached by adopting the so-called snowball sample technique, where the researchers gained potential participants from other financial institutions provided by another participant (Noy, 2008). The timeline of the main study was around five months, between November 2019, when the first pilot interview was executed, and March 2020, when the last data for the study was collected. Eight interviews were conducted face-to-face and three via telephone. All the interviews were recorded with a dictation device. According to Bryman and Bell (2011), this process is of high importance to save the original wording of the interviews, helping to ensure detailed and substantial data analysis. After conducting the interviews, they were all transcribed to prepare accurate analysis of the collected data. This was done by using the software tool Amber Script, which allows records to be transcribed automatically.

3.5 Analysis and coding of the collected data

In coding and analysing the collected data, this study adopted the approach of a qualitative content analysis framework as the analysis and coding method, as this method is appropriate for inductive studies aiming to develop theory (Glaser, 2002). Consideration was given to other approaches including grounded theory, but they were rejected, as using a qualitative content analysis framework offered a higher degree of flexibility in coding and structuring of the data gathered (King, 2004). With the intention of adequate coding and categorising, NVivo, a software tool for qualitative data analysis, was adopted to support the coding and analysis of the high amount of complex data.

4. Discussion and interpretation of the findings

4.1 Discussion and interpretation of the findings related to the study’s first research question

4.1.1 The negative influence on the effectiveness of bank’s outsourcing activities due to the revised legal requirements.

In addressing the RQ1, the interviews revealed that the majority of the interviewees recognised the enormous effect of the intensified legal requirements on their outsourcing activities, which negatively influenced their efficiency:

Big influence, cost-intensive regulatory requirements change the business case and thus also the decision of future outsourcing activities. (Bank Participant A, head of outsourcing management)

Of course, a very high influence, probably at the end of the day you can see that the MaRisk in particular with regard to the outsourcing part are continuously being further developed. There is definitively a negative effect on the efficiency due to the increasing outsourcing regulation for financial institutions. (Bank Participant H, member of the board)

The comments above indicate that the participants perceived that the new and revised regulatory requirements have an enormous influence on the efficiency of German banks’ outsourcing activities. Based on the perspectives of the participants, it is possible to deduce that the financial institutions recognised an increase concerning the level of detail and volume of the outsourcing regulations, which changed the business case of their outsourcing arrangements. On reflection, most participants perceived that the efficiency of their outsourcing activities was negatively influenced by the revised legal requirements which resulted in a higher level of administrative work needed to analyse these requirements, together with an increased need for daily management and monitoring of the outsourcing arrangements for both the banks and the vendors:

It can be said that the revised legal requirements lead to an increase in costs. First of all, to evaluate today's outsourcing requirements and, of course, also to bring them into practice. This is definitely an increase in costs for us. (Bank Participant B, central outsourcing manager)

Of course, the regulations, which are extended regarding the banks also affect us, either directly or indirectly. This, of course, also means that the requirements are increasing. There is an increasing volume and, above all, the intensity of work and the requests of customers are becoming more and more detailed and more frequent. (Service provider Participant A, supplier manager)

The comments above clearly point out that the new and revised legal requirements have to be accurately evaluated and brought into practice by the financial institutions, leading to an intensity of work and that the increasing administrative work could be led back to the increasing degree and volume of the legal requirements.

4.1.2 The need for internal alignment due to the revised legal requirements.

In still addressing RQ1, the study found that the majority of the interviewees, from both the bank and vendor perspective, perceived a significant impact on their supplier management as a result of these new regulations, which has led to organisations needing to internally align their supplier management and outsourcing processes:

The impact on the internal alignment is very high, because the expectations of the supervisors are very detailed concerning the controls in the outsourcing environment […]. (Bank Participant C, head of central outsourcing management)

Well, the MaRisk or EBA Guidelines on outsourcing arrangements de facto apply to us absolutely as a bank. The outsourcing management has to be aligned exactly following those requirements, so they have a very high influence. (Bank Participant H, member of the board)

The comments above demonstrate that the impact of the legal requirements on the internal alignment of the supplier management is perceived to be very high and detailed. On reflection, most participants stated that the banks need to accurately align their supplier management to fulfil the requirements.

4.2 Discussion and interpretation of the findings related to the study’s second research question

4.2.1 New and revised legal requirements are perceived as adequate.

Based on the analysis of the interviews related to RQ2, the study identified that the majority of the participants, irrespective of whether they worked in banking and or as a vendor, although recognising the negative influence of the emerging legal requirements on the efficiency of their outsourcing projects and the need to internally realign their outsourcing management, did not perceive the new and revised legal requirements as being inadequate or irrelevant:

I believe that the requirements are justified in the area of outsourcing. (Bank Participant G, member of the board)

Although I recognise some discussions in terms of different understandings and interpretation regarding some points, I think it is appropriate regarding the context of quality assurance and transparency creation. If I have a business model as a company where parts of my processes are delivered by external service providers, then I have to make sure that this happens accurately. (Service provider Participant B, business unit head)

I think the requirements are appropriate. In recent years, regulation has been very vague. Through the EBA Guidelines, in my opinion, it became much more concrete on one point or another, which I rated very positively […]. (Bank Participant C, head of central outsourcing management)

Evaluating the comments, the interviews indicate that the revised legal requirements in the outsourcing environment of German financial institutions are perceived to be adequate by the majority of the financial institutions. The comments above in addition, highlight that the participants positively evaluate the concretisation of the legal requirements which was perceived to lead to better quality and transparency regarding the management of outsourcing arrangements. In analysing the interviews, the findings revealed further critical banking insights regarding the perceived adequateness of the legal requirements:

The requirements are appropriate to the potential risks and can be adopted individually at the institutional level. (Bank Participant A, head of outsourcing management)

Many banks perceive the requirements to be very high, but, on the other hand, it also can be said that non-financial risk management moves more into focus here, which is the intention of the regulator. Therefore, I think that the degree of the regulations is appropriate. (Management consultancy participant, senior consultant financial services)

The comments indicate that the financial institutions rate the legal requirements as appropriate, as they were aware of the risks in their outsourcing activities and recognised that they have to be monitored accurately. Part of the reason for this acceptance was related to the participants acknowledging that the new legal requirements reflected and migrated associated risks of financial institutions’ outsourcing activities and related arrangements.

4.2.2 Emerging criticism concerning legal requirements.

Based on the analysis of the interviews, a further key theme identified in the study was that even though the majority of the interviewed financial institutions did not perceive the level of the regulations as inadequate as analysed in the previous section, the majority of the participants criticised the legal requirements for being too bureaucratic and expected the financial authorities to ensure that the administrative effort for the implementation of the legal requirements remains manageable:

I would say that all the requirements now coming up are far too theoretical and defined by theorists. Requirements often do not include any practical examples, making the implementation challenging. (Bank Participant E, head of central outsourcing management)

Of course, I can understand the risk-based approach and that you have to distinguish requirements for either a small or a large bank. But simply to say that this is the approach without giving any practical examples and clarification about what it should be like, is insufficient. This is actually the greatest criticism for me and I would like to see a great deal more clarification to minimise the administrative effort. (Bank Participant B, central outsourcing manager)

The scope for interpretation is what makes it a bit difficult and which certainly increases the administrative effort. It would undoubtedly be helpful to concretise some of the regulations more. (Service provider Participant A, supplier manager)

The interviewees indicated that the financial institutions perceived the legal requirements to be too theoretical and that practical examples are missing, which makes their implementation challenging. For the participants, this was due to being impractical and not reflective of the everyday operational activities, combined with unspecific requirements, making the implementation challenging. A further point of criticism highlighted during the study was addressed in the participants’ expectation that the financial authorities should support financial institutions in supervising and certifying multi-client service providers:

I could imagine, for example, that a central database for multi-client service providers, provided by the supervisors, would be more efficient, including an assessment of the risks and data protection. (Bank Participant D, central outsourcing manager)

A point that would certainly be especially helpful in the cloud environment is if the regulator could help to certify service providers. To be clearer, the requirements we face are actually implemented by service providers. (Bank Participant F, central outsourcing manager)

Analysing the comments above, the study found that especially the medium- and large-sized banks expected the authorities to support them by certifying and supervising multi-client service providers to ensure that the financial institutions can outsource to verified outsourcing partners. Based on the perspectives above, the study found that the approach of supervision and certification of multi-client and cloud-service providers by the authorities could help to decrease the administrative effort for the banks and the service providers, as not all financial institutions would have to supervise the same multi-client service providers themselves.

4.2.3 Change of management attention to and awareness of the theme of outsourcing in financial institutions.

In still addressing RQ2, the study’s findings indicated that the majority of the banking and vendors interviewees perceived a change of the management attention to and awareness of the theme of outsourcing in their related financial organisation and took the monitoring and controlling of their outsourcing activities more seriously:

Definitively more management attention and the topic is even more in the foreground through the increased personnel costs and additionally increasing administrative effort for the monitoring of the outsourcing activities. (Bank Participant D, central outsourcing manager)

Management attention has increased significantly. Previously, as a service provider, we had to alert the banks to be aware of the regulations before signing […]. But I believe in banks as well as at the vendors significantly more attention arose and more resources were required to acquire more know-how. (Service provider Participant B, business unit head)

On reflection, the raised awareness could be traced back to increasing costs and the increased effort in implementing and monitoring the revised legal requirements. Analysing the interview data, the study discovered an additional reason for the raised awareness of outsourcing, as the majority of the participants mentioned that the increasing internal and external supervision of their outsourcing arrangements led to a raised awareness of the topic:

The management attention increased mainly because it is actually a cost and effort driver, and it is and has been associated with resource building […] and because of external audits. I have the impression that the supervision has already increased the number of audits significantly and very intense auditing of outsourcing is scheduled. (Bank Participant F, central outsourcing manager)

Higher management attention, but also more sensitivity in the house and even more intensive control by internal and external auditors; there is hardly an audit in the house in which the topic of outsourcing is not also examined […]. (Bank Participant A, head of outsourcing management).

Analysing the perspectives above, it is possible to deduce that the management attention to and awareness of the theme of outsourcing could not only be traced back to the negative influence of the new and revised legal requirements on the efficiency on German banks’ outsourcing projects but also to the increased internal and external supervision of their outsourcing arrangements. The comments above further highlight that most of the large German banks already had an external audit by the authorities, which had an additional perceived negative influence on the financial institutions, especially concerning the monitoring and controlling effort of their outsourcing activities.

4.3 Discussion and interpretation of the findings related to the study’s third research question

4.3.1 Internally realign methods to meet the new legal requirements.

In addressing RQ3, the study revealed that the new and revised legal requirements have resulted in an internal realignment of financial institutions’ supplier management, which will be presented in the following sections.

4.3.1.1 Development of an outsourcing strategy.

Based on the analysis of the interviews related to the internal realignment methods deployed by the German financial institutions, a key theme identified was that the majority of the participants highlighted that they had developed a more formalised outsourcing strategy with written frameworks to monitor all outsourcing activities:

[…] in implementing and putting the new legal requirements into practice, at first glance, it is important to analyse the requirements and to develop a clear outsourcing strategy. (Bank Participant A, head of outsourcing management)

Of course, we have a firm outsourcing strategy which is also written down through our internal policies and working instructions. That is why I believe that the strategy is a consistent and continuous assessment of risks, responsibilities, but also a presentation of general costs and benefits of outsourcing arrangements. (Service provider Participant A, supplier manager)

In analysing the interviews above, the study found that the German financial institutions developed an outsourcing strategy or reworked their existing strategy, aiming to comply with the changes in the legal requirements. The comments above furthermore illustrate that it is important to analyse the legal requirements accurately to develop a related outsourcing strategy and that an accurate outsourcing strategy should cover the new requirements. Analysing the interviews further the interviewees mentioned that the German financial institutions recognised the importance of reflecting and adopting the developed strategy in internal policies and working instructions and that the strategy should be applied by all involved internal business units.

4.3.1.2 Application of three lines of defence approach.

Analysing the interviews, the study revealed that the majority of the participants rated it as important to apply the strategies by using the three lines of defence approach to fulfil the revised legal requirements in the most efficient way and to set up clear responsibilities of the involved business units in the management of the outsourcing activities:

We have a clear separation of the 1^st, 2^nd and 3^rd line, including a central outsourcing management unit […]. (Bank Participant A, head of outsourcing management)

We have a separation between the first line of defence, managing the risks, and the second line of defence, which oversees the risks, with separate units for compliance and audit issues and the central outsourcing management unit as part of the second line. (Bank Participant G, member of the board)

In analysing the perspectives above in relation to the application of the three lines of defence approach, there were several emerging themes. The interviews clearly point out the importance of a clear separation of the processes with a central outsourcing management unit within this approach, which is responsible for overseeing and managing the general outsourcing process and outsourcing portfolio of the financial organisation. Within the separation, the first line of defence directly manages the vendors and the related risks, the second line of defence has to oversee the risks, with business units such as the IT security or the compliance office as part of the second line. The third line of defence is represented by the internal audit, which supervises the outsourcing management process.

4.3.1.3 Implementation of an effective support system

In answering further RQ3, the study found that the majority of the participants and especially the participants working for major banks highlighted the changes brought about during the implementation of the support system to manage and monitor their outsourcing arrangements:

A support system in the field of outsourcing is applied. There are separate databases for outsourcing. We adapted the different outsourcing activities accordingly in recent years. (Bank Participant G, member of the board)

I think it is necessary to have a support system. Depending on the number of outsourced business processes, however, there are usually several, you need a transparent documentation system with which you can process these things […]. (Service provider Participant B, business unit head)

We use a support system. We have very good networking with other risk disciplines. We really have a very good interaction, which is what these platforms actually offer […]. (Bank Participant C, head of central outsourcing management)

The comments above demonstrate that an application of a supporting system provides several advantages for financial institutions in managing their outsourcing portfolio. The statements above point out that the financial institutions can ensure and evaluate an overall assessment of their outsourcing activities by bringing different tasks together in one supporting system and that an efficient system can ensure interaction of the involved business units and parallel working on outsourcing arrangements at the same time.

4.3.2 Decreasing outsourcing activities due to the increased legal requirements.

In analysing the interviews, a key theme to emerge from the study was that the majority of the participants, and in particular those in the larger institutions, highlighted that the new legal requirements have led to their outsourcing activities decreasing:

I think that not so many things are outsourced in the market or things have been brought back in the market, so for example, outsourcing contracts have been terminated in our institution because the service providers cannot or do not want to meet our requirements […]. (Bank Participant C, head of central outsourcing management)

Effort is being put into trying to do things internally again because you have better control of risks and prices and can control things yourself more easily. It is debateable whether outsourcing activities should still be continuing. (Bank Participant D, central outsourcing manager)

Well, then of course we will only do outsourcing if the effort is also worthwhile […]. Our outsourcing activities will certainly no longer be expanded. (Bank Participant G, member of the board)

The comments above point out that the German financial institutions were closely monitoring and reviewing their outsourcing portfolios and decreasing their outsourcing degree slightly by bringing back and terminating inefficient outsourcing activities, which was having an impact on the German outsourcing market. The comments above illustrate that the financial institutions were intending to reduce their outsourcing activities and to assess which of these activities are no longer effective due to the intensified legal requirements or which of their service providers are not able to handle the new and revised requirements.

4.3.3 Increasing legal requirements lead to an adjustment of financial institutions’ outsourcing portfolio.

Closely aligned to the changes experienced by the German financial institutions’ outsourcing activities and the impact on the sector, what also emerged from the interviews was the variety of readjustment activities needed to be undertaken by German financial institutions to the existing outsourcing portfolios.

4.3.3.1 The usage of multi-client service providers.

Based on the analysis of the interviews, a key theme identified in the study was that the majority of the banking participants, irrespective of the size or the banking group, stated that there was an intensified trend to concentrate on multi-client service providers and entering into strategic partnerships with their vendors:

One expected movement is that financial institutions will concentrate on big multi-client vendors as they expect them to achieve the best and most efficient service. (Bank Participant H, member of the board)

I think we will also have to focus on working with a few big service providers, from whom you will also receive several benefits, which means choosing service providers who ultimately also have outsourcing management and know what you need. (Bank Participant B, central outsourcing manager)

My expectation is that there will be a greater focus on a few service providers, such as multi-client service providers that are highly specialised in certain services for institutions, and thereby use standardised contracts and can serve a relatively wide range of institutions. (Bank Participant F, central outsourcing manager)

Analysing the comments above, the study found that the participants supposed that the German financial institutions in future will concentrate their outsourcing activities on multi-client service providers as they expect to obtain the most efficient services from large vendors. The banking participants in this study identified that the big multi-client vendors were able to provide standardised services and products to increase the efficiency of financial institutions’ outsourcing arrangements. Closely linked to this finding was the perception of the participants that multi-client service providers can more effectively understand the needs and challenges of the financial institutions related to the new legal requirements.

4.3.3.2 The usage of intragroup outsourcing providers.

Analysing the interviews further, the study found that the majority of the participants perceived intragroup outsourcing to be beneficial because institutions from the same financial group often follow the same strategy, and have the same restrictions and standards:

The topic of group outsourcing is also a big issue. We definitely want to bundle things in our financial group, aiming to follow the approach that the service providers are not confronted with different requirements, and we can actually better bundle services. (Bank Participant C, head of central outsourcing management)

We have also set out a strategy that we want to work more with service providers of our own financial group to standardise the services and compliance with the revised requirements. That means that always when a contract expires, we examine if this service provider could be replaced by a provider from our financial group […]. (Bank Participant E, head of central outsourcing management)

We are rather intending to execute intragroup outsourcing to standardise services and the application of the legal requirements. (Bank Participant H, member of the board)

The comments above demonstrate that the participants intend to increase their intragroup outsourcing as they expect standardised intragroup strategies and guidelines concerning compliance with the revised regulatory requirements. A concentration on vendors of the own financial group offer, in the perception of the participants, the benefit that services can be bundled in their own financial group, and legal requirements can be applied and implemented homogenously.

4.3.4 The future challenges of digitalisation and collaboration with FinTech and BigTech’s.

To further address RQ3, the study’s findings revealed that from the participants’ perspectives, the topic of digitalisation and cooperation with service providers like BigTech’s and FinTech’s will present future challenges for the German financial institutions. The study found that most participants are aware of innovative trends like digitalisation, blockchain, robotics or data analytics in the banking environment due to their unexplored risks, as these trends are often executed in collaboration with external service providers like FinTech’s and BigTech’s, who are not familiar with the high regulations in Germany:

What I see as critical, of course, is outsourcing to the start-ups that are developing more and more, such as FinTech companies. It will be interesting to see how they deal with the legal requirements and if they are willing to adopt the high regulations in Germany. (Bank Participant B, central outsourcing manager)

The topic of outsourcing in future will change to highly qualified and complex topics related to digitalisation […] and it will be difficult to monitor and control the service providers offering such services […]. (Bank Participant G, member of the board)

[…] a great lack of understanding of the high requirements could be recognised, especially with Big-, FinTech’s and cloud service providers. (Bank Participant F, central outsourcing manager)

Based on the perspectives above, it is possible to deduce that the financial institutions were concerned about outsourcing arrangements with service providers like FinTech’s and BigTech’s, as in their perception most of the vendors like FinTech’s and BigTech’s are not familiar with the high legal requirements in the German banking environment, and it is debateable if the FinTech’s and BigTech’s are willing to adopt the high requirements. What further emerged from the interviews was that some service providers and especially those related to BigTech’s and FinTech’s often passed on the increased implementation costs to the banks, which ultimately impacts on the German banks’ long-term profitability associated with their outsourcing activities:

Possibly, higher purchase prices of so-called non-banks could arise, because they now have to implement the banking requirements as well, and the consequently rising costs will usually be included in the prices for the offered services. (Bank Participant A, head of outsourcing management)

5. Conclusion

Based on the findings, RQ1 found that the revised regulatory requirements have had an enormous impact on German financial institutions’ outsourcing activities.

A key finding of the study is that the majority of the participants recognised the significant effect of the legal requirements on the management of their outsourcing projects, which negatively influenced their efficiency. The new and revised legal requirements over recent years have led to a higher level of administrative work needed to analyse these regulations, together with an increased need for daily management and monitoring of the outsourcing arrangements.

To address and answer RQ2, the findings of the study indicated that the legal requirements are of significant importance and relevance for the financial managers, and that awareness with regards to the theme related to outsourcing has come to predominance. The study revealed that, although the financial institution participants recognised and perceived a negative influence of the intensified legal requirements on the efficiency of their outsourcing arrangements, the majority of them did not criticise their adequateness. When investigating the meaning and relevance of the legal requirements addressed by RQ2, this study also found that the awareness of the majority of the participants to the theme of outsourcing increased. This was due to the emergence of new requirements brought about by the authorities and the need for financial institutions to intensify the monitoring of their existing outsourcing arrangements.

In answering RQ3, the study revealed that German banks have already realigned their supplier management to a large extent, which has included the readjustment of their outsourcing portfolios and outsourcing strategies, to fulfil the new and revised legal requirements in the most efficient way. This study, for example, revealed that German financial institutions are internally realigning their outsourcing strategies by applying the three lines of defence approach, including a central outsourcing management unit. In addressing RQ3, the study also focused on the bigger German financial institutions as to how they are implementing an efficient support system during the realignment of their supplier management. A further key finding highlighting the practical implications of the study is that the banking participants interviewed declared to concentrate more on outsourcing and bundling their outsourcing activities at multi-client service providers, intra-group vendors and to enter more into strategic partnerships with their vendors. However, in sum the study revealed that the financial institutions need to recognise the increasing legal requirements as a chance and a driver to realign and readjust their outsourcing portfolios and supplier management to minimise risks, while recognising the flexibility and efficiency which outsourcing projects can provide.

5.1 Contribution to practice

The results of this study provide new, first-hand and critical banking insights for managers and practitioners who are involved in the monitoring and controlling of outsourcing. The findings of the study revealed how the banking participants have implemented the changes of their supplier management outsourcing activities due to the new and revised legal requirements.

This study also provides findings and critical perceptions concerning future trend of digitalisation, blockchain and robotics in the financial sector, often provided by FinTech’s and BigTech’s. The new insight this study provides is that the trend is investigated from a regulatory point of view and that the participants are concerned about how the service providers, especially FinTech’s or BigTech’s, will deal with the issue of the implementation of complex legal requirements in the German financial industry.

5.2 Contribution to knowledge

This study has, by adopting a qualitative approach, addressed the identified gap in existing literature and provides a unique contribution in understanding the real impact of the new and revised legal requirements on outsourcing arrangements of financial institutions by holistic and critical insight. The study additionally contributes to understanding the meaning and relevance of legal requirements in financial managers’ perceptions concerning the outsourcing environment of financial companies, within the findings for RQ2.

5.3 Limitations of the study

While this study has contributed to both academic and practical knowledge with regard to the impact and relevance of outsourcing activities in the German financial environment, there are some limitations related to the overall study. The chosen sample size was focused on a relatively small sample size of German financial representatives. Although a small sample size cannot be seen as providing a definitive outcome, the main study profile did consist of recognised experts in a very narrowed field of practice in the area of outsourcing, so that, in conclusion, some generalisation can be made from the findings. The interview sample furthermore consisted of five of the ten largest banks in Germany what ensured a high validity of the collected data, as the major banks often have more experiences with regulatory requirements.

5.4 Areas for further research

On reflection, and drawing on the identified limitations, future studies could investigate some unanswered questions outside the original scope of this investigation. A subsequent research study could investigate the impact of regulatory requirements in other European countries to identify possible similarities and distinctions. Furthermore, this approach would lead to insights as to how different banks in EU countries have responded to the regulations in terms of outsourcing, then contrasted with Germany.

Table 1.

Interview participants’ profile

Interview participants by financial institutions	Type and size	Position/Rank in company	No. of employees
Bank Participant A	Major bank	Head of Outsourcing Management	>5k
Bank Participant B	Major bank	Central Outsourcing Manager	>5k
Bank Participant C	Major bank	Head of Central Outsourcing Management	>5k
Bank Participant D	Major bank	Central Outsourcing Manager	>5k
Bank Participant E	Middle-sized bank	Head of Central Outsourcing Management	>1k
Bank Participant F	Major bank	Central Outsourcing Manager	>5k
Bank Participant G	Small bank	Member of the board	>500
Bank Participant H	Small bank	Member of the board	>500
Management Consultancy Participant	Management consultancy	Senior Consultant financial services	>5k
Service Provider Participant A	Major vendor	Supplier manager	>5k
Service Provider Participant B	Middle-sized vendor	Business unit head	>100

Source: Authors’ own creation