Template Z08.02: Reporting of applications owned and operated by affiliated service providers

Where a reporting entity receives services from an affiliated entity and relies on applications that are owned, managed and operated by that affiliated service provider, should those applications be reported in template Z08.02 by the receiving entity? Alternatively, should template Z08.02 be limited to operational assets that are owned, managed or directly controlled by the reporting entity, with dependencies on affiliate-owned applications being reflected through the relevant service provider and outsourcing/inter-affiliate reporting templates?

Template Z08.02 requires the reporting of operational assets supporting critical functions and core business lines, including applications and information systems. In some banking groups, critical functions and core business lines are supported through intra-group service arrangements, whereby services are provided by another group entity. The applications supporting these services may be owned, managed, and operated by the service-providing group entity rather than by the reporting institution itself. It is unclear whether the intention of template Z08.02 is to capture: - operational assets owned, managed or controlled by the reporting entity (BofAE); or - all applications that support the reporting entity's critical functions and core business lines, including those owned and operated by affiliated service providers. Where applications are owned and operated by another group entity, the reporting institution's dependency is on the service received rather than on the underlying application itself. Reporting such applications in Z08.02 may therefore extend beyond operational assets that are directly managed or controlled by the reporting institution. Clarification is requested as to whether applications owned and operated by another group entity, but supporting services provided to the reporting institution, should be reported in template Z08.02.