Strengthening outsourcing rules
CSSF Circular 22/806
- All professionals subject to prudential supervision by the CSSF
- 22/04/2022: Publication of CSSF Circular 22/806
- 30/06/2022: CSSF Circular 22/806 comes into effect
- 01/07/2022: Publication of the notification form for outsourcing a critical/important function
- 31/12/2022: Deadline to bring outsourcing agreements entered into before 30/06/2022 into compliance
Circular CSSF 22/806 concerns the implementation of the European Banking Authority (hereinafter «EBA» - EBA/GL/2019/02) guidelines on outsourcing arrangements.
The aim is to ensure robust internal governance and contribute to a convergence of supervision at the European level.
Part I - Outsourcing Agreement Requirements
I.1. General Terms and Conditions
The outsourcing agreement must:
- To be subject to appropriate oversight by the company engaging under this agreement;
- To comply with applicable regulatory requirements and prudential measures for the company entering into this agreement; ;
- Ensure that outsourced operational activities are carried out correctly.;
- Exclude the transfer of responsibility from the management body of the company entering into this agreement;
- Avoid creating excessive operational risks. ;
- To allow the company entering into this agreement to maintain the quality and independence of the internal control of outsourced operational activities;
- To allow the company invoking this agreement to supervise and control compliance with regulatory requirements;
- To enable the Company party to this Agreement to ensure and maintain the continuity of its outsourced operational activities;
- Ensure that the company entering into this agreement maintains the necessary substance to retain its CSSF authorisations, particularly with regard to central administration. ;
- Implement privacy requirements and comply with personal data protection rules;
- To not impede the supervisory powers of the competent authorities.
I.2. Intra-group outsourcing
An outsourcing agreement with a group entity does not result in not necessarily a lower risk level. The general conditions described above must be respected. Furthermore, the intention to enter into an intra-group outsourcing agreement must be justified.
I.3. Good governance
The company that is calling on the subcontracting agreement must:
- Set up a Risk management relating to its various outsourcing agreements; ;
- To appoint a responsible for managing each agreement outsourcing;
- Set up a policy authorised management-approved outsourcing, regularly reviewed and updated. The content of this policy is defined in section 4.2.3 of CSSF Circular 22/806;
- Hold a register of all outsourcing agreements. The composition of this register is defined in points 54 & 55 of CSSF Circular 22/806. This register must be available upon request of the competent authorities; ;
- Keep all of its documentation for a period defined by Luxembourg law.
I.4. Prior notification to the CSSF
One prior notification must be sent to the CSSF when the outsourcing of an important or critical function is being considered.
This notification must be submitted to the CSSF at least 3 months before the outsourcing agreement comes into effect. For a support PSF, this timeframe is reduced to one month.
Part II - Specific requirements for ICT outsourcing agreements
The general principles mentioned in the first part shall also apply to outsourcing agreements concerning Information and Communication Technologies (hereinafter referred to as «ICT»).
Part II of CSSF Circular 22/806 is structured into two chapters:
- Outsourcing agreements not based on «Cloud Computing» infrastructure; ;
- Outsourcing agreements based on «cloud computing» structures.
Part III - Transitional provisions and deadlines
The entities concerned must To review and, if necessary, amend existing outsourcing agreements to ensure their compliance with CSSF Circular 22/806 by 31 December 2022 at the latest..
If the entity estimates that the review of existing outsourcing agreements will not be finalised by 31 December 2022, it must inform the CSSF, detailing the proposed action plan.
This article is based on a French translation of CSSF Circular 22/806. The original text in English is available on the CSSF website.
Discover our other publications:
Roadmap: building your GRC framework step by step
An effective GRC framework is built progressively, from the diagnosis of the existing state to consolidation, by adapting each step to the maturity, size and priorities of the organisation.
GRC reporting: giving the board an overview
A useful GRC reporting consolidates the work of control functions into a readable view allowing the board to identify developments, areas of concern and decisions to be made.
Data, evidence and traceability: the foundation of a credible system
A credible monitoring system relies on reliable data, structured evidence and an audit trail making it possible to reconstruct decisions and actions throughout the activity.