Firms liable for incorrect outsourcing under MiFID

Article 13(5) of MiFID
states: "An investment firm shall ensure, when relying on a third party
for the performance of operational functions which are critical for the
provision of continuous and satisfactory service to clients and the
performance of investment activities on a continuous basis, that it
takes reasonable steps to avoid undue operational risk."

As usual, we quote some regulatory guph and then wonder what the hell it means. 

This
particular ditty is being viewed by most as getting to the heart of a
firm's outsourcing operations and ensuring that those contracts take reasonable assurances to manage any possible operational risks. 

The thing is, how do you eradicate operational risk? 

Impossible
we say, as everything is a possible risk.  The risk that your
outsourcer might miss a transaction, might have some downtime, might
not route through the best execution process you use ...

OK, so
all you need to do is to recontract with your outsourcer to make sure
that these risks are minimised, addressed, discussed and contractually
managed.

That's the bit that apparently most firms are messing up
at the moment because it means new contracts - you cannot grandfather
existing deals - and many organisations are only just realising this. 

A bit late, as we're now under two months away from November 1 and the timer is ticking ...