Outsourcing arrangements

On 30 June 2022, Circular 22/806 on outsourcing arrangements ("OS Circular") became applicable to all outsourcing arrangements entered into, reviewed or amended by the in-scope entities on or after 30 June 2022.

A transition period is provided for outsourcing arrangements in force before 30 June 2022:

• in line with the OS Circular, their documentation must be completed following the first renewal date of each existing arrangement, and by no later than 31 December 2022.
• In-scope entities which have not reviewed by 31 December 2022 outsourcing arrangements of critical or important functions existing prior to 30 June 2022 must inform the CSSF.

Together with the OS Circular, the CSSF has published an FAQ and the following circulars in relation with outsourcing arrangements:

• Circular 22/805 on the revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) – Publication of CSSF Circular 22/806 on outsourcing arrangements –Repeal or amendments of certain CSSF circulars ("Circular 22/805");
• Circular 22/807 updating CSSF Circular 12/552 on central administration, internal governance and risk management, as amended.

More recently, on 1 July 2022, the CSSF also published a notification template to be used as of that date by in-scope entities (see below) when outsourcing a critical or important business process (Business Process Outsourcing or BPO) in accordance with points 59 and 60 of the OS Circular (see CSSF Communiqué here).

The OS Circular applies notably to credit institutions, investment firms, payment institutions, electronic money institutions and professionals of the financial sector and their branches and partially to IFMs, their branches and UCITS (in the case of a UCITS, only if it has an information and communication technology ("ICT") outsourcing arrangement independent of that of its IFM).

All requirements detailed in the OS Circular relating to ICT outsourcing define the new ICT outsourcing framework for IFMs and their branches.

The FAQ specifies that part of the OS Circular applies to IFMs only in relation to one or several specific ICT outsourcing and where the requirement is relevant for IFMs.

The key practical impacts of the OS Circular are described in the Newsflash "CSSF Circular on outsourcing arrangements" published on our website.

Among the actions to be initiated by IFMs (and UCITS, as the case may be), there would be:

• the implementation of an outsourcing register and the review of the outsourcing policy/procedure to ensure it complies with the OS Circular with respect to ICT outsourcing;
• the setting-up of a plan to review and update existing ICT outsourcing arrangements;
• the verification of compliance of all new ICT outsourcing arrangements with the requirements of the OS Circular.