Operational resilience regulation and Transitional Services Agreements in M&A transactions

What is the purpose of a TSA?

The TSA governs the arrangements between the buyer (or target) on the one hand, and the seller on the other, as they disentangle the IT systems, licences and services of the newly acquired company or business from the seller’s systems, such that the acquired company or business can operate independently or as an integrated part of the buyer’s group.

During this transitional period,  the selling entity or an affiliate of the seller will typically be a “Service Provider”, providing necessary services or IT systems licences to the buyer or target company as “Recipient”. If the retained businesses of the seller are reliant on any of the IT systems, licences or services that are transferring with the target company, then there may be services flowing the other way – from target company to seller – during the transitional period. These are usually referred to as “reverse” services.

Relevance of financial sector regulations

With the introduction and implementation of a range of outsourcing regulations applicable to different parts of the financial services sector, including outsourcing guidelines developed by the European Banking Authority (“EBA Guidelines”), and similar guidelines developed by the European Insurance and Occupational Pensions Authority and European Securities and Markets Authority (“EIOPA”), the landscape for TSAs in the sector has rapidly shifted. Regulated entities receiving services under a TSA must now assess whether the transitional services constitutes an “outsourcing arrangement”, and if so must identify the regulatory requirements that must be complied with when negotiating the TSA terms.

Below we examine some of the key considerations and issues when drafting TSAs that involve one or more regulated entities receiving outsourced services, and identify the ways in which the transitional nature of the TSA and the latest regulatory requirements may cause some friction between the parties’ interests in negotiations.

Establishing the regulatory framework

In the case of both the Service Provider and the Recipient, it will be necessary to establish early on whether the provision of services under the TSA will constitute an outsourcing, and if so whether such outsourcing is of a critical or important function. For the Recipient, having a thorough and well-documented assessment of the arrangement is necessary to ensure that the TSA meets any applicable regulatory requirements (irrespective of whether they conclude that the arrangement is an outsourcing)..

For the Service Provider, it is almost as important to understand precisely which regulatory requirements (if any) the Recipient is subject to. It is all too common that proposed provisions are justified by Recipients as being necessary to comply with “regulatory obligations” without further detail – Service Providers that are able to validate this claim will set themselves up to secure a more favourable position in the course of negotiations. The Service Provider should be in a position to make this assessment as it should already be familiar with the divested entity’s regulatory status prior to the transaction. That is not to say, of course, that the seller and buyer will always come to the same conclusion about how the regulations are to be interpreted, and what services they apply to.

Assessing proportionality

Just as important as understanding the regulatory framework relevant to the TSA is understanding the risk profile facing the Recipient during the term of the TSA. A number of factors will be relevant in this analysis, including:

• Duration of the TSA – If the transition period is short, then Recipients may be more comfortable accepting narrower rights (such as audit, access and termination rights) under the TSA. For TSAs designed to continue for a longer period, the remit of such rights will be more important to the Recipient.
• Nature of the transitional services – Transitional services come in a wide range of shapes and sizes. Some are critical and important, and may involve the performance of regulated activities – for example, policy administration in the context of an insurance business. In other cases, the services may involve the provision of certain software applications or the use of hardware that is also used by the Service Provider’s business which may not always be considered critical or important.
• Nature of the Service Provider – Typically the Service Provider under a TSA will not be internally set up to act in the same manner as a commercial service provider. Recipients should therefore be prepared for resistance to onerous contractual terms which do not align with the Service Provider’s internal processes.

It will be important to consider these factors in determining the proportionality of contractual terms expected of a Service Provider under a TSA. Regulators emphasise that the Recipient must take a risk-based approach when drafting outsourcing agreements and the boundaries of the Recipient’s risk appetite are therefore likely to be tested during TSA negotiations.

Key negotiation points arising from the EBA Outsourcing Guidelines

In the context of the EBA Guidelines, we often see similar points being at-issue between the parties to an outsourcing arrangement. These issues can become even more challenging to navigate in a TSA context. Below we examine these issues at a high level and identify possible avenues for compromise between TSA parties.

Sub-outsourcing requirements and reliance on third party services

• The EBA Guidelines set out a number of contractual requirements in respect of sub-outsourcing, particularly where the sub-outsourcer is itself performing a critical or important function (or a material part thereof). 
• For Recipients, there is a need to ensure sufficient oversight over any proposed sub-outsourcing of critical or important functions. This is usually adverse to the Service Provider’s desire to continue using third party contractors with relative freedom. How significant this issue is will depend on the nature and duration of the TSA: in short-term TSAs, the Service Provider is less likely to engage new subcontractors so this may be less of a concern, but in longer term arrangements the Service Provider is more likely to want freedom to engage contractors . If the parties cannot agree on rights of approval and/or veto in relation to subcontractors, they may be able to agree on different levels of approval for different categories of subcontractors, based on materiality.

Recipients should also be mindful of dependencies that they have no control over – e.g. if the TSA ‘passes through’ critical or important services delivered by third parties, are third party consents or licences required? If so, can the Service Provider demonstrate that these consents or licences have been obtained or will be obtained before the completion date? If not, the Recipient could be faced with service interruptions that have a potentially significant impact on the business.

Audit and access

• The Service Provider under a TSA may be reluctant to grant the Recipient a right to conduct an external audit with access to premises. Where the transitional services relate to the outsourcing of a critical or important function, however, the EBA Guidelines are clear that the Recipient (along with competent authorities) must have full access to premises and unrestricted rights of inspection and auditing in order to monitor the arrangement. Allowing this sort of access can prove problematic for some Service Providers, particularly where the parties are, or become through the transaction, competitors.
• TSA parties may be able to agree a way forward through the use of third party certifications and third party or internal audit reports provided by the Service Provider. There are requirements that must be met in order for this approach to be workable from an EBA Guidelines-perspective, such as ensuring the scope of the audit is sufficient to capture the correct systems and controls, and it is ultimately for the Recipient to assess the adequacy and sufficiency of these reports in order to fulfil its regulatory obligations. Recipients must carefully consider any such proposal in this light before agreeing to it.
• The Parties should also be aware of paragraph 96 of the EBA Guidelines which specifies that care must be taken in multi-tenanted environments to avoid risk to other clients, such as any impact on confidentiality aspects.  Where there are genuine concerns about the confidentiality of sensitive data being at risk due to the Recipient’s audit, the parties should work together to agree a method of exercising an audit right which mitigates any confidentiality risks.
• Where the outsourced functions are not critical or important, Recipients are encouraged to ensure the same rights, taking a risk-based approach in view of the duration and nature of the services. For a short-term TSA with a focus on separation activities, and where the risk profile of the services are lower, there may be some latitude for the parties to consider narrower audit and access rights.

Exit and termination

• Where the EBA Guidelines apply, the Recipient is required to ensure it has a number of prescribed termination rights including in the case of impediments capable of altering the performance of the outsourced function being identified. It may be relatively straightforward for the Recipient to secure such termination rights as an early end to the TSA is likely to be a common goal for both parties.
• What is sometimes more difficult, however, is for the Recipient to ensure that there is sufficient protection regarding TSA exit. This includes ensuring that there are no hair-trigger termination rights available to the Service Provider. The Recipient will also seek to include suitable mechanisms to ensure an orderly transition. The term of the TSA is effectively an exit period in its own right, so the parties will need to have a clear understanding of when and how the services can be brought to an end during that period.  
• Technology separation projects are very capable of running over schedule no matter how well-planned, and in a regulated context this is particularly troubling as a “cliff-edge” termination is unlikely to be an acceptable outcome particularly for critical or important functions.
• Parties should prioritise a clear plan for separation and discuss any foreseeable issues when negotiating the TSA. If separation is expected to be complex, it may be prudent for the parties to agree an extension right in case there are obstacles in achieving a swift separation.

Authored by John Salmon, Louise Crawford, and James Sharp.