On 17 May, 2017 the Luxembourg Financial Regulator (CSSF) published four new circulars concerning cloud computing and IT outsourcing. The new regulations will immediately affect credit institutions, professionals of the financial sector, payment service providers, and electronic money issuers (Entities). The four CSSF circulars, which came into effect on the date of their publication, introduce new rules and replace existing requirements set out in existing circulars.

Main novelties and amendments

Circular 17/654

This circular addresses the obligations that Entities must meet when their IT infrastructure uses or will rely on a cloud computing infrastructure.

The circular applies to the partial or full transfer of the activities and does not make many differences between an external provider and an internal provider within a group of companies.

The CSSF defines the term of material activity as any activity that, when not properly performed, reduces the ability of an Entity to meet regulatory requirements or continue its operations, and any activities that are necessary for the sound and prudent risk management.

Three different IT service models are described:

For each of the above service models, the CSSF provides an interpretation of the levels of control on the systems and the software that an Entity must respect when applying such model.

Within these service models the CSSF differentiates four different cloud types:

An Entitys outsourcing of IT matters will qualify for particular regulatory treatment, if it meets specific criteria set out by the CSSF and will be excluded from the scope of other existing regulations relating the Entitys central administration, accounting organization, internal governance and risk management (e.g. Circulars 12/552 or 17/656).

The criteria that the CSSF uses to define the specific regulatory treatment are:

If the above criteria are fulfilled an Entity must obtain the CSSFs prior approval (if a material activity is concerned). In case a Luxembourg based professional of the financial sector is used, an Entity must only file a prior notification to the CSSF.

Once the outsourcing is implemented, all the changes to the set-up and the service providers as well as the in-sourcing must be notified to the regulator before an Entity enacts them.

Entities under the supervision of the CSSF that would like to offer cloud computing services or related operating services to their clients must submit a program description to the CSSF to obtain its prior approval.

This circular amends the requirements applicable to credit institutions, investment firms and professional lenders. The amendments introduce Circular 17/654 and clarify that Circular 05/178 is repealed.

In addition, the amendments clarify that every time specific infrastructures are used or changed, authorized entities must observe data protection and professional secrecy rules.

The circular clarifies the conditions for the use of other group entities that are not authorized by the CSSF. The systems of such group entities may be used under the condition that no confidential information is stored in a readable manner on those systems. If this is the case, the supervised entity must inform its clients and, if required, collect their consent.

This circular aligns the IT outsourcing requirements for professionals of the financial sector other than investment firms, payment service providers and electronic money issuers to those applicable to credit institutions and investment firms. It copies the wording of the relevant sections of Circular 12/552 to ensure consistency and ease further alignments.

Finally, the circular introduces Circular 17/564 and clarifies that professionals of the financial sector that offer IT services to their clients, may use the infrastructure of a third party or sub-delegate a part of their services only with the prior consent of the concerned clients.

This circular amends Circular 06/240 and is applicable to all credit institutions and professionals of the financial sector. One important clarification of this circular consists of providing that only the production environment should contain confidential data, whereas the test and development environment(s) (that as per applicable regulation may be accessed by third parties) should not contain confidential data.

Future developments

As the four circulars came into effect on the date of their publication, the Entities auditors are expected to pay particular attention to the new requirements when carrying out their audits.

Entities supervised by the CSSF will have to carefully study the new circulars and analyze the impact on their existing administrative organization and IT infrastructure, because if affected, they must be aligned to the new requirements. Therefore, changes may need to be implemented at multiple levels:

As service providers located outside of Luxembourg will be required to accept contractual provisions that they have never been requested to comply with before, (for instance, amendments to certifications and controls), the time to implement the changes should not be underestimated.

More here:

New Cloud Computing and IT Outsourcing Requirements in the Financial Sector - Lexology (registration)