www.pwc.lu/banking
PwC Luxembourg
Sourcing Strategies
Survey
Presenting the main
results
June 2017
Table of contents
Introduction1
2 | PwC Sourcing Strategies Survey
Key findings
2
Respondent’s company profile
3
Sourcing benefits
4
Sourcing strategies
6
Current sourcing landscape of Luxembourg
7
Sourcing maturity
8
Sourcing governance
9
Sourcing regulation
10
Your additional comments
12
Our team
13
Introduction
Companies are constantly reviewing their operating model to increase efficiency and
maintain flexibility. They increasingly use emerging technologies to meet growing
client expectations. The complex and ever changing regulatory environment is, most
of the time, an extra-challenge for financial players.
The recently published draft law 7024 could be a reason to revisit your organisation’s
internal processes and IT landscape, as it brings forward additional flexibility for
outsourcing models and related treatment of client confidential data.
We’ve surveyed several business leaders to see what kind of outsourcing strategies they
have or are planning to put in place.
Why?
• To have an overview of the current outsourcing landscape in Luxembourg;
• To better understand drivers, best practices and pain points related to outsourcing;
• To assess the potential impact of the draft law on the current outsourcing activities.
How?
We’ve put together a concise survey of 25 questions structured in five different
sections. We’ve sent the survey to CEOs and COOs of leading financial institutions and
service providers in Luxembourg and received over 30 responses. After a thorough
evaluation of the responses, we’re sharing with you the most significant findings on
sourcing strategies in Luxembourg.
For whom?
Regulated entities in Luxembourg that are already outsourcing or consider doing it for
some of their activities.
Overview of the current outsourcing
landscape in Luxembourg
Landscape
Understanding drivers, best practices
and pain points related to outsourcing
Drivers
Assessing the potential impact of
the draft law on current outsourcing
activities
Law
1
Key findings
Outsourcing activities are already considerable and as of today we believe
they will further increase if the Bill passes, as it would facilitate the
treatment of client identifying data (CID).
This element is often seen as a blocking point for transferring certain
activities or IT systems to another service provider.
Overall, the Bill is rather seen as an opportunity rather than a threat.
87%
… of the respondents
outsource parts of their
activities.
2 | PwC Sourcing Strategies Survey
81%
… of the respondents
would benefit from the
draft law.
77%
… of the respondents
plan to outsource more
activities as a result of the
draft law.
Respondents’ company profile
The distribution of the respondents business sectors emphasise the
relevance for banks and PSFs
Respondents’ Business Sectors
6%
10%
6%
16%
45%
Over 30 respondents
(mainly CEOs and
COOs) answered the
survey
16%
Financial Sector - Bank
Employee distribution
Financial Sector - Support PSF
Financial Sector - Specialised PSF
Luxembourg
185
Financial Sector - Management Company
Financial Sector - Investment Firm
20%
employees
on average
Insurance - Life and Non-Life
Over three-quarters of the respondents are banks or
Professionals of the Financial Sector (PSFs). This
suggests that these sectors will see the highest impact
from the enacting of the Bill.
In Luxembourg, 20% of all employees are IT
employees, compared to only 8% at a global level.
This comparatively high number of IT staff could
potentially be explained by the existing legal and
regulatory requirements applicable to sourcing.
80%
Non IT employees
IT employees
Global
26,000
8%
employees
on average
92%
3
Sourcing benefits
Cost reduction remains the key driver for outsourcing strategies
Most companies put in place outsourcing strategies with cost reduction in mind. There
are, however, more benefits than what meets the eye: more flexibility and scalability,
better controls as well as more scope for innovation.
1
2
3
4
Costs
Scale
Strategy
Capacity
Reducing and controlling the
cost factor.
Gaining flexibility to scale and
adjust the operation.
Taking strategic decision at
group level.
Making the most of external
capacities.
5
6
7
8
Globalise
Service
Innovate
Controls
Expanding your operations to
new markets.
Improving and extending the
service levels.
Increasing the level of
automation and innovation.
Strengthening the internal
controls framework.
One other benefit for us
is to compensate the lack
of qualified (human)
resources available in
Luxembourg.
A specialised PSF
4 | PwC Sourcing Strategies Survey
The size of organisations influences their objectives in terms of outsourcing strategies.
For instance, when they outsource, smaller aim at reducing costs, but also at
enhancing their own capabilities and international reach.
Comparison by business size
16%
Reducing costs
32%
14%
Scale operations
25%
13%
Strategic decision
18%
11%
External capabilities
10%
10%
Globalise operation
6%
6%
Enhance service levels
Automation and innovation
9%
8%
0%
5%
Strengthen internal controls
0%
Small entity:
Up to 100 employees
in total in Luxembourg
Large entity:
Over 100 employees in
total in Luxembourg
5
Sourcing strategies
Strategies are influenced by the entity’s size
Entities clearly prefer long-term sourcing relationships
with only a few vendors. This might be linked to the
increased governance requirements for outsourcing
relationships.
Smaller entities seem to outsource higher skilled tasks
and core systems compared to larger organisations,
which indicates that sourcing strategies are influenced
by their limited capabilities and resources. They tend to
outsource more at a local level.
Larger companies prefer to set up international sourcing
relationships. They are generally able to cover a wide
spectrum of activities, albeit at the price of efficiency.
The presence of both intra-group and external
outsourcing relationships is justified by the fact that
many participated to the survey are subsidiaries of
international groups with headquarters outside of
Luxembourg.
Strategy comparison between large and small entities
Short-term
Multiple
International
Extra-group
Low
Satellite
100%
90%
80%
70%
60%
50%
40%
30%
20%
10%
Long-term
All
Large Small
Few
All
Duration
6 | PwC Sourcing Strategies Survey
Large Small
Number of
vendors
Luxembourg
All
Large Small
Service provider
location
Intra-group
All
Large Small
Service provider
type
High
All
Large Small
Skill level of
activity
Core
All
Large Small
Outsourced IT
systems
0%
Current sourcing landscape of Luxembourg
IT currently the most outsourced activity... a reflection of the service
provider industry?
Outsourcing IT-related activities is more common
than delegating support or business functions.
This result also seems to reflect the current service
provider landscape in Luxembourg, since the
majority of regulated providers offer IT services.
Average extent of outsourcing
40
35
30
37%
28%
25
20
Obtaining support for IT Security is rather
common, which could be explained by existing
regulatory requirements to appoint an Information
Security Officer. The latter can also rely on
external support.
19%
15
10
5
Looking at delegated business activities, we could
argue that the closer an activity is to an
organisation’s customer base, the less likely it is for
this activity to be outsourced.
IT
Support
Business
Outsourcing of sub-activities
70%
60%
50%
40%
30%
20%
10%
IT
Support
Front Office
Cus. Support
Risk Mgt.
Accounting
Back Office
Archiving
Facility Mgt.
Internal Audit
HR
Development
IT Support
Security
IAAS/PAAS
SAAS
0%
Business
7
Sourcing maturity
The phenomenon of self-assessments
Regardless of size or industry sector, there are no
significant differences between the phases of the
outsourcing lifecycle. The average maturity for
outsourcing processes is considered as medium.
Interestingly enough, we’ve noticed small peaks
towards a higher maturity for the negotiation and
operation phases.
Respondents have, however, shown a lower maturity
level when it comes to identifying opportunities to
transform the value chain of an organisation and
transitioning towards a target operating model.
Nearly identical scores,
regardless of size or industry
Rating
5
4
Average
maturity of
outsourcing
phases based
on respondents
self-assessment
3
2
1
No significant differences
between the phases of the
outsourcing lifecycle.
8 | PwC Sourcing Strategies Survey
Sourcing governance
Both qualitative and quantitative information is key
Regular meetings between the outsourcing organisation
and the service provider are the most common means to
manage the relationship. In addition, they use
quantitative information in the form of Key Performance
Indicators such as system availability for IT applications.
Organisations with well established processes for the
governance of outsourced activities usually include
reporting obligations on meaningful KPIs, as well as
regular service reports, in the contractual agreements
with the service providers.
The investment management industry also relies on
controls reports prepared by an independent third party,
depending on the scope of covered activities and related
controls. The possibility of performing on-site audits
should ideally be confirmed in the contractual
agreement with the service provider.
Difference of governance tools for entities with
high or low maturity
Outsourcing governance tools
Regular meetings
87%
Regular KPI
reports
77%
52%
Onsite audits
48%
Controls reports
Internal audit
reports
42%
Certifications
32%
29%
Penetration tests
Utilisation of controls reports (e.g. ISAE 3402 reports)
60%
93%
88%
82%
50%
64%
43%
33%
Regular meetings
with the provider
Higher maturity
Regular quality
reports with KPIs
Bank
PSF
ManCo/
Inv.Firm
Insurance
Lower maturity
9
Sourcing regulation
Nearly all respondents are impacted by the draft law
A large majority of our respondents handle client
identifying data (CID). Since the treatment of such data
is underlying strict regulatory requirements, most
organisations store it internally or outsource it to PFS
service providers.
The number of organisations that have obtained a
consent from their clients to process their data outside of
Luxembourg, is comparatively low. This indicates the
large potential impact of the Bill, as it would facilitate
getting client consent, as well as confirming the validity
of such content.
The level of awareness of the Bill appears to be directly
related to the size of the organisation: larger companies
claim to be better informed than smaller ones.
Current strategy on handling of CID
6%
13%
16%
81%
39%
26%
… of the respondents are
directly impacted by the
Bill.
CID at PSF
CID not outsourced
CID encrypted
Client consent
No handling of CID
Level of awareness by entity size
52%
Large
Small
0%
… of the respondents have
no extensive knowledge of
the Bill.
10 | PwC Sourcing Strategies Survey
10%
Assessed
20%
30%
40%
50%
Knowledgeable
60%
70%
Aware
80%
90%
Unaware
100%
Strategies will shift to an increased number of outsourced activities
Despite some concerns about the
potentially negative impact on the
local service provider industry, the
general perception of the Bill is
rather positive. This could be
partially explained by opportunities
for local service providers belonging
to international groups, which could
also benefit from less stringent
requirements related to the
delegation of activities and handling
of client identifying data. Insurance
companies will not be directly
impacted by the Bill, which explains
their rather neutral opinion.
Regardless of the current
outsourcing strategy pursued by
organisations, respondents believe
that the Bill would boost the
delegation of additional activities.
Perception of the Bill
Bank
PSF
ManCo /
Inv. Firm
Insurance
0%
20%
Opportunity
40%
60%
Neutral
80%
100%
Threat
Impact of the Bill on the sourcing strategy
88%
64%
36%
12%
Many outsourced
activities
No or only few
outsourced activities
Outsource more
No impact
11
Your additional comments
…on how to change the current regulatory environment
The main aspects raised by the survey participants concern:
• Further reducing regulation on the delegation of activities;
• Harmonisation with other European jurisdictions;
• Better communication between the regulator and regulated entities.
Bank
Support PSF
We would like to see
less restriction in
using group IT centres
outside Luxembourg.
The control or
the monitoring of
the systems is the
important element,
not the location.
Easier access to
regulated group
entities within the EU.
Specialised PSF
I’d like it to be easier
to discuss options and
proposals with the
regulator.
Specialised PSF
Remove restrictions
at Luxembourg level
and enforce a similar
policy at EU level.
12 | PwC Sourcing Strategies Survey
Support PSF
We expect more
flexibility for
outsourcing.
Our team
Olivier Carré
PwC| Partner
Office: +352 49 48 48 4174
Email: [email protected]
Patrice Witz
PwC| Partner
Office: +352 49 48 48 3533
Email: [email protected]
Florian Bewig
PwC| Director
Office: +352 49 48 48 4169
Email: [email protected]
Marc Kaplan
PwC| Senior Advisor
Office: +352 49 48 48 2807
Email: [email protected]
13
www.pwc.lu/banking
Follow us
PwC Luxembourg (www.pwc.lu) is the largest professional services firm in Luxembourg with 2,700 people employed from 58 different
countries. PwC Luxembourg provides audit, tax and advisory services including management consulting, transaction, financing and
regulatory advice. The firm provides advice to a wide variety of clients from local and middle market entrepreneurs to large multinational
companies operating from Luxembourg and the Greater Region. The firm helps its clients create the value they are looking for by
contributing to the smooth operation of the capital markets and providing advice through an industry-focused approach.
The PwC global network is the largest provider of professional services in the audit, tax and management consultancy sectors. We’re a
network of independent firms based in 157 countries and employing over 223,000 people. Talk to us about your concerns and find out more
by visiting us at www.pwc.com and www.pwc.lu.
© 2017 PricewaterhouseCoopers, Société coopérative. All rights reserved.
In this document, “PwC” or “PwC Luxembourg” refers to PricewaterhouseCoopers, Société coopérative which is a member firm of
PricewaterhouseCoopers International Limited, each member firm of which is a separate legal entity. PwC IL cannot be held liable in any
way for the acts or omissions of its member firms.