CySEC Circular C604 on EBA Guidelines on outsourcing

TO : Cyprus Investment Firms (CIFs) FROM : Cyprus Securities and Exchange Commission DATE : 13 October 2023 CIRCULAR NO. : C604 SUBJECT : ΕΒΑ Guidelines on outsourcing (EBA/GL/2019/02)

1. The Cyprus Securities and Exchange Commission (the “CySEC”) wishes to bring the attention of the Cyprus Investment Firms (the “CIFs”) the Guidelines on outsourcing (the ‘Guidelines’). It is noted that the Guidelines were published on February 2, 2019, by the European Banking Authority (EBA).

2. CySEC has adopted the Guidelines under section 29 of the Prudential Supervision of Investment Firms Law of 2021, which transposes Article 36 of the Directive (EU) 2019/20341 (the “IFD”) and under Article 97 of Directive (EU) 2013/36/EU (CRD), by incorporating them into its supervisory practices and regulatory approach.

3. The Guidelines apply to CIFs that fall under sections 9(1), (3) and (4) of the Prudential Supervision of Investment Firms Law of 2021, i.e. with initial capital requirement of €150.000 and €750.000.

4. The Guidelines specify the internal governance arrangements, including sound risk management, that CIFs should implement when they outsource functions, in particular regarding the outsourcing of critical or important functions. Furthermore, the Guidelines specify how the arrangements referred to above should be reviewed and monitored by competent authorities, in the context of Supervisory Review and Evaluation Process, under Article 36 of the IFD, by fulfilling their duty to monitor the continuous compliance of entities to which these guidelines are addressed with the conditions of their authorisation.

5. Therefore, CySEC urges the CIFs to: i. Review and amend accordingly any existing outsourcing arrangements, ensuring that these are in line with the Guidelines. Where the review and amendment of outsourcing arrangements of critical or important functions is not finalised by June 30, 2024, CIFs should inform CySEC accordingly via 1 Directive (EU) 2019/2034 of the European Parliament and of the Council of 27 November 2019 on the prudential supervision of investment firms and amending Directives 2002/87/EC, 2009/65/EC, 2011/61/EU, 2013/36/EU, 2014/59/EU and 2014/65/EU {OJ L 314 5.12.2019, p. 64}.

CySEC’s portal, including the measures planned to complete the review/amendment or the possible exit strategy. ii. Complete the documentation (Section 11 of the Guidelines) of all existing outsourcing arrangements, other than for outsourcing arrangements to cloud service providers, in line with the Guidelines following the first renewal date of each existing outsourcing arrangement by no later than by June 30, 2024. Sincerely, Dr. George Theocharides Chairman Cyprus Securities and Exchange Commission