The Basel Committee on Banking Supervision proposed on Tuesday that bank boards of directors must take ultimate responsibility for outsourced services and record how they manage the risks of customer service interruptions and disruptions.
Banks are increasingly using third-party technology firms like Microsoft, Amazon, and Google's cloud computing to run critical services, raising regulatory concerns over what happens if multiple banks' suppliers fail and impact the financial sector.
"Continuous digitalization has led to the banking industry rapidly adopting innovative methods," said the Basel Committee in a statement.
"Therefore, banks are increasingly relying on third parties to provide services they have not previously provided."
The committee, made up of regulators from the G20 and other countries, proposed 12 principles for banks and their regulators to apply, and noted that bank boards of directors have ultimate responsibility for overseeing third-party arrangements.
Basel said in its consultative document: "As with all business processes, evidence of key decision-making (e.g. board meeting minutes reflecting third-party strategies, crucial...agreement decisions reached) should be kept in bank records."
Third-party services are under increasing scrutiny as hackers try to breach bank networks and disrupt operations, causing customer service outages for hours or even days.
The EU has approved the Digital Operational Resilience Act (DORA) to increase resilience in the financial sector and the UK will follow suit from January next year.
Basel said banks should conduct "appropriate due diligence" before signing contracts with third parties and monitor their performance of third-party services.
Basel said banks should also maintain "robust business continuity" management to operate during interruptions.