Luxembourg - Financial Supervision - CSSF issues Circular 22/806 on outsourcing arrangements

In Brief

On 22 April 2022, the CSSF issued the long-awaited Circular 22/806 on outsourcing arrangements, which implements the revised European Banking Authority Guidelines on Outsourcing arrangements EBA/GL/2019/02 (EBA Guidelines). The regulator also published Circular 22/805 on the repeal or amendments of certain circulars following the publication of Circular 22/806 as well as a FAQ on the provisions.

In details

The Circular 22/806 creates a single consolidated set of outsourcing provisions addressing all regulated entities supervised by the CSSF on an individual basis, including Investment Fund Managers[1] who do not originally fall in the scope of the EBA Guidelines. It covers all types of outsourcing arrangements included in the definition of outsourcing - including Business process, ICT & Cloud outsourcing. 

Besides integrating the EBA Guidelines into the Luxembourg regulatory framework, the CSSF expects all entities to review their existing outsourcing arrangements to comply with the new provisions in terms of central administration, internal governance, and risk management, proportionally to the nature, scale and complexity of their activities or services.

In addition, the Circular 22/806 amends the prior authorization by the CSSF for the outsourcing of critical or important functions, replacing it by a three-month prior notification before the planned outsourcing. The notice period is reduced to one month when resorting to a support professional of the financial sector (PFS). The notification mechanism had been already introduced by Circular 21/785 for material ICT outsourcing.

For further information, the Circular 22/806 is available, together with the related FAQ and Circular 22/805, here.

Regulatory background

The EBA released in February 2019 its final report revising its "Guidelines on outsourcing arrangements" (available here).

The scope of application of the EBA Guidelines covers credit institutions and investment firms (altogether referred as "Institutions") as well as payment institutions and electronic money institutions.

The main objective of the Guidelines is to lay the ground for appropriate internal good governance and risk management policies for the entities outsourcing functions, in particular where these outsourced functions are considered critical.

[1] For ICT/Cloud outsourcings only. All other types of outsourcing arrangements entered into by Investment Fund Managers shall continue to be aligned with the delegation framework set out in Chapter 6 of Circular CSSF 18/698.

What’s next?

The Circular 22/806 will be applicable on 30 June 2022 to all outsourcing arrangements entered into, reviewed or amended on or after this date. For all existing outsourcing arrangements concerned entities are expected to review and amend their existing arrangements by 31 December 2022.

It will amend the following Circulars, as of 30 June 2022: 12/552, as amended, 20/758, as amended, 95/120, as amended, and repeal and replace the Circulars 13/554, 15/611, 17/654, 17/656, 21/777 and 21/785. It will also amend the following Circulars at a later stage: 18/644 as amended, 18/697, 18/698.