Outsourcing Policy (OSP)
The information provided here is for general informational purposes only and is not intended to constitute legal or professional advice. It is provided 'as is' and should not be considered a substitute for a comprehensive review against the relevant laws and regulations as they apply to your company.
Outsourcing Policy (OSP) - Guidance
The JFSC Outsourcing Policy (OSP) outlines seven core principles that regulated companies must adhere to when outsourcing material activities.
To assist you with your outsourcing assessment, Tiller has provided a concise response to the relevant sections under each of these principles:
Core Principle 1: A Business is responsible for and accountable to the JFSC for any Outsourced Activity
(3.1.3) Does our business retain responsible for the outsourced activity?
Yes, Tiller Technologies is defined as a within the Data Processing Agreement (DPA), which is part of our service agreement with you. This means we only process data based on your instructions as the . The DPA confirms that Tiller cannot be delegated the responsibility for compliance decisions under regulatory law. For example, the decision to onboard a customer can only rest with you, while Verify by Tiller will provide the necessary information and check results to support that decision.
Core Principle 2: A Business must ensure that any Service Provider performing Outsourced Activity is Fit and Proper
(3.2.1) How can our business conduct suitable and proportionate due diligence on Tiller?
Our Trust Centre is designed to provide all the information your business needs to complete a thorough due diligence assessment on Tiller Technologies. Should you require any additional information not available there, please feel free to contact us.
(3.2.3) How does choosing Tiller Technologies help reduce "material risk"?
As a Jersey-registered company with all operational and managerial functions based on the island, Tiller Technologies is well-positioned to minimize any jurisdictional and regulatory risks. Our heritage in financial services gives us deep insight into the needs of regulated companies, but our primary focus is as a firm. We prioritize robust cybersecurity and sound data protection policies, and you can find a detailed overview of these measures in the security section of our Trust Centre.
(3.2.4.2) Does Tiller have adequate capacity and resources to perform the Outsourced Activity?
Tiller has implemented with the use of the framework a complete suite of policies and procedures backed up by a robust governance and oversight structure. This is applied across the company and full details a provided, including supporting document in our Trust Centre.
(3.2.4.3) Does Tiller have adequate capacity and resources to perform the Outsourced Activity?
Tiller Technologies Limited operates as a wholly owned subsidiary of Tiller Group Limited. The group is in a sound financial position, with its most recent annual accounts publicly available via the company registry. We also maintain all necessary and appropriate insurance policies.
(3.2.5.2) As a cloud services provider, does Tiller adhere to all industry good practices for data security and cyber risks?
Tiller has implemented with the use of the framework a complete suite of policies and procedures backed up by a robust governance and oversight structure. Security to Tiller is paramount. As a leading provider, we are committed to upholding the highest standards of information security, ensuring the confidentiality, integrity, and protection of you and client's valuable data within our platforms. Full details are provided in the security section of the Trust Portal, including supporting documentation.
(3.2.5.3) Does Tiller adhere to international standards?
Tiller Technologies has implemented the widely accepted Information Security Management System (ISMS), aligning with the internationally recognized ISO/IEC 27001:2022 standard. This framework is foundational to Tiller's operations, providing clear guidelines for the systematic management of information security, data governance and business compliance.
The ISMS framework helps Tiller ensure it can manage the confidentiality, integrity, and availability of all its information assets, including it platforms, networks, applications, and services. ISMS serves as a dynamic and systematic approach to identify and manage information security risks, fostering continuous improvement of Tiller's security controls to protect against evolving threats and uphold the trust placed in its operations.
The Verify by Tiller platform is hosted in Azure data centres in Dublin, Ireland and Amsterdam, Netherlands. Both operate within the laws and regulations of the European Economic Area (EEA).
Core Principle 3: A Business must put in place an Outsourcing Agreement with the Service Provider before the start of the Outsourced Activity
(3.3.1) Does Tillers service agreement include enforcement of the provisions set out in section 3.3.1 of the JFSC Outsourcing Policy (OSP)
All ten terms (3.3.1.1 to 3.3.1.10) under core principle 3 are fully addressed in the Tiller Technologies Service Agreement, Terms and Conditions, and the incorporated Data Processing Agreement. A copy of these documents is provided for your review as part of the quotation process.
(3.3.2) How does Tillers service agreement meet the provisions set out in section 3.3.2 of the JFSC Outsourcing Policy (OSP)
All ten terms (3.3.2.1 to 3.3.2.10) under core principle 3 are fully addressed in the Tiller Technologies Service Agreement, Terms and Conditions, and the incorporated Data Processing Agreement. A copy of these documents is provided for your review as part of the quotation process.
Core Principle 4: A Business must maintain adequate capacity and resources to implement all necessary policies and procedures to ensure that a Service Provider continues to be Fit and Proper
(3.4.5.3) How does Tiller oversee and test the Outsourced Activity and to identify, monitor and mitigate against all associated risks?
Tiller has implemented with the use of the framework a comprehension suite of Vulnerability, Incident and Risk Management policies and procedures. These are designed to identify, Prioritise, Mitigate, Verify and Report and Monitor any occurrence of a vulnerability or incident or identified risk. Information on these processes and the supporting documentation is available in our Trust Centre.
Core Principle 5: A Business must maintain suitable contingency plans in case a Service Provider’s performance suffers a material disruption, or ends unexpectedly, for any reason.
(3.5.5) What provisions exist in Tillers agreement terms and conditions to minimise the impact of voluntary or involuntarily termination of its services?
Tiller Technolgies as part of the termination clauses in the Data Processing Agreement which forms part of the overall Service Agreement, makes provision that if the service expires or terminates, the businesses data is made available for download and safe keeping by the business, after which the data will be deleted, except to the extent Tiller is required by applicable law to retain some of the data.
Core Principle 6: Except for where the OSP specifically provides otherwise, a Business must complete and upload an Outsourcing Notification before they appoint a Service Provider; the Service Provider must not start performing the Outsourced Activity until the Business receives a No Objection, and we must be notified of any subsequent material change to the Outsourced Activity as soon as the Business becomes aware
(3.6.1 ) Do I need to notify the JFSC of our businesses use of Verify by Tiller?
Your business must make that determination based on the nature of your business, operational reliance on our services and specific circumstances. We cannot make that determination for you.
Saying that, for Jersey regulated companies the answer is probably yes because of paragraph (3.6.5). You may still be required to notify the JFSC, but you may not have to wait for a 'No Objection'. Tiller has provided via the request form below an almost completed JFSC Outsourcing Notification form. Tiller has provided answers to the form's questions; however, it is the sole responsibility of your business to review those answers, ensure you agree with them based on your own due diligence assessments and that they are correct for your company's business operation.
Core Principle 7: A Business must ensure that there is nothing in the Service Provider’s performance of the Outsourced Activity that would prevent or restrict our regulatory powers in respect of the Business, or the Outsourced Activity
(3.7.2) Does Tiller have provision in its agreements to ensure, where the JFSC require access to information to effectively supervise the outsourcing it can?
Tiller Technologies is a Jersey Registered company and although not licenced by the regulators, is still subject to all Jerseys laws. Tiller operates its Verify by Tiller platform from data centres in Ireland and the Netherlands and uses the services of other companies outside of Jersey. Tillers agreements with those companies all include provisions to ensure access to data required by law, by any court of competent jurisdiction or by any regulatory or administrative body is assured.
(3.7.3) Does Tiller have provision in its agreements to ensure other jurisdictions secrecy laws does not impede the JFSC require access to information to effectively supervise the outsourcing?
Tiller does operate its Verify by Tiller platform from data centres in Ireland and the Netherlands. Tillers agreements with their hosting provider includes provisions to ensure access to data required by law, by any court of competent jurisdiction or by any regulatory or administrative body is assured.
Outsourcing Policy (OSP) - JFSC Outsourcing Notification
The JFSC Outsourcing Policy may require your business to submit a completed Outsourcing Notification for digital services.
To assist you with this process, we have provided a partially completed Outsourcing Notification form containing the information you need from us for your review, completion and submission.
We are happy to make this partially completed outsourcing notification form available to you via the request form below.
It should be noted that some of the questions can only be completed by your business and all answers, included those either fully or partially completed by Tiller Technologies must be reviewed thoroughly and accepted or if necessary, updated based on your outsourcing due diligence assessment and business regulatory obligations.
JFSC Outsourcing Notification download Request Form
Last updated