RBNZ BS11 Outsourcing: Separation and Compact Requirements for Registered Banks

BS11 reads like an outsourcing policy. It is really an instruction to prove your bank can be pulled apart from its parent and its providers and keep running. That is an architecture problem, and most of the cost lands on the technology function.

The Reserve Bank of New Zealand’s outsourcing policy, BS11, is easy to misread as a procurement rulebook: register your suppliers, sign robust contracts, review them annually. All of that is in there. But the substance of BS11 is a resolution objective dressed as an outsourcing rule. It exists so that if a large bank fails, or has to be separated from an overseas parent, a statutory manager can keep the lights on. That single sentence carries years of engineering work, and New Zealand’s largest banks reportedly spent hundreds of millions of dollars discovering exactly how much.

What BS11 actually asks of the architecture

BS11 applies in full to large banks, defined as those whose net liabilities exceed NZ$10 billion. For those banks, the policy fixes on four outcomes that must hold from the first business day after a “day of failure” and thereafter. The bank must be able to continue meeting daily clearing, settlement and other time-critical obligations; monitor and manage its financial positions, including credit, liquidity and market risk; make the systems and financial data the statutory manager and the Reserve Bank need available to them; and continue providing basic banking services to existing customers.

Read those as engineering requirements rather than policy statements and the shape of the problem appears. Each outcome depends on systems, data and people that may sit inside a parent, a shared group platform, or a third-party provider. BS11 says that on the worst day, none of those dependencies can be the thing that stops the bank operating. The provider can fail; the parent can walk away. The bank still has to clear payments, value its book and answer to a statutory manager the next morning.

Separation is a data-severability problem

The sharpest version of BS11 falls on the four large Australian-owned subsidiaries — ANZ, ASB, BNZ and Westpac — through the separation policy. A foreign-owned subsidiary must be able, in the event of separation from its parent, to achieve those outcomes as a stand-alone entity. “Stand-alone” is where the abstraction ends and the architecture begins. It means the bank has to survive an abrupt loss of access to whatever the parent provides: shared core banking instances, group data centres, centralised treasury systems, group identity and access management, staff in an offshore operations hub, even the licences under which group software runs.

The word people reach for is severability, and it is the right one. Can the New Zealand entity’s data be cleanly separated from the group’s, or is it commingled in shared tables keyed by a group-wide customer identifier? Can it authenticate its own staff and systems if the parent’s identity provider vanishes, or does every login ultimately resolve to a directory in Sydney? This is where the unglamorous engineering lives — validating tokens against your own issuer and keys rather than a parent’s, so that identity is a thing the local bank owns rather than borrows. A separation plan that assumes the parent’s authentication survives the parent leaving is not a separation plan.

The same test applies to processing. When you sever a provider and switch to a fallback, in-flight transactions have to be caught up without being lost or double-applied. Designing the pipes so that reprocessing is safe — the discipline of idempotent, retry-safe operations — is exactly what lets a bank replay a backlog after a switchover without corrupting its own ledger. BS11’s robustness expectations, requiring the bank to keep operating from the first business day after failure, are only met by systems built to be interrupted and resumed.

The compendium is not a spreadsheet you fill in once

BS11’s record-keeping requirement is the compendium: a formal, centralised, electronic record of every outsourcing arrangement the bank has. It has to carry the provider’s legal identity and addresses, the value of the arrangement, expiry and renewal dates, termination terms, and an overview of the service. It must be kept current, updated within 20 business days of a new arrangement taking effect, and reviewed annually by internal audit, external audit or an independent reviewer.

Treated as a compliance artefact, the compendium is a chore. Treated properly, it is the dependency map that makes separation planning possible. You cannot demonstrate you could stand alone if you cannot say, on demand, which functions ride on which providers, what the exit terms are, and how quickly you could move. The compendium is where the compact between the bank and each provider is recorded — not just the price, but whether the arrangement lets the bank walk away and keep operating. Firms that keep it as a procurement list, rather than a live architectural inventory, find the two drift apart, and the gap surfaces at the worst possible moment.

What “could actually stand alone” looks like as evidence

The Reserve Bank does not accept a slide that asserts independence. The revised BS11 came into force in 2017 with a five-year transition, and the Reserve Bank confirmed only in December 2023 that the major banks were compliant — six years of engagement to get there. What closed the gap was evidence that the outcomes hold under test, not documents that claim they would.

Evidence, concretely, means a demonstrated ability to run the four outcomes on New Zealand-controlled infrastructure, with the data, the access rights and the operational staffing to match. It means switchover and separation exercises that were actually run, with results, not tabletop walkthroughs. It means the operational telemetry to show recovery is real — the kind of delivery and recovery metrics that turn “we could stand alone” into a measured claim rather than a hope. And it means the compendium and the separation plan agreeing with each other, so a supervisor tracing one function from record to architecture to fallback finds a coherent story at every step.

BS11 is New Zealand-specific, but the pattern is not. Wherever a regulator asks a subsidiary to prove it can survive its parent, the answer is decided in the data model and the identity layer years before anyone asks the question. The banks that struggled with BS11 were not short of policies. They were short of severability — and you cannot write that in after the parent has gone.