The Bank of Ghana (BoG) has introduced a comprehensive outsourcing directive to strengthen governance and risk management frameworks for banks, Specialized Deposit-Taking Institutions (SDIs), financial holding companies, and development finance institutions.
Regulated financial institutions have until July 1, 2025, to comply with this directive or face an administrative penalty of 1,000 penalty units, which equates to GH₵12,000.
This directive underscores the Bank of Ghana’s commitment to bolstering the resilience and governance standards of Ghana’s financial sector, particularly as banks and SDIs increasingly rely on outsourcing to optimize costs and efficiency. The directive specifies functions that may be outsourced with prior approval and identifies essential functions that must remain in-house to preserve the integrity of key decision-making roles.
For example, regulated financial institutions are prohibited from outsourcing strategic functions to external service providers. These include Board and senior management responsibilities, such as strategic oversight, corporate planning, organizational management, and control, as well as decision-making functions like credit approval, compliance with Anti-Money Laundering (AML) and Combating the Financing of Terrorism (CFT) norms, and Know Your Customer (KYC) requirements for account opening. Additionally, the internal audit, risk management, and cyber and information security functions are also restricted from outsourcing.
Some arrangements, such as those with payment card schemes like Visa and MasterCard, or clearing and settlement arrangements between institutions and their members, do not qualify as outsourcing under this directive.
The directive is designed to mitigate risks associated with outsourcing—including strategic, reputational, and operational risks—by mandating that RFIs maintain control over core functions critical to their stability and resilience.
For smooth transition and effective implementation, the BoG advises financial institutions to begin preparing well ahead of the July 2025 deadline. Institutions must review and amend existing contracts to comply with these regulatory standards by June 30, 2025, or upon contract renewal, whichever comes sooner. Additionally, RFIs are required to submit their materiality assessment frameworks to the BoG by June 2, 2025.
RFIs do not need prior BoG approval for outsourcing non-core functions, provided these do not fall under provisions requiring approval under Act 930 or other legislation. However, the BoG must be notified in writing at least 10 working days before engaging any service provider.
Any new or amended outsourcing arrangement for a core function requires the Bank of Ghana’s prior approval as stipulated under Section 60(12) of Act 930. Moreover, RFIs must ensure that outsourcing does not lead to the unauthorized disclosure of customer information, requiring customer consent before sharing any details with third parties.
Non-compliance with the directive will subject an RFI to an administrative penalty of GH₵12,000 as specified in Section 60(13) of Act 930 or Section 57(13) of Act 1032, along with additional remedial measures and sanctions outlined in these Acts.
