Amendment of Circular CSSF 20/750 on ICT and Security Risk Management

CIRCULAR CSSF 22/828 1/5 Circular CSSF 22/828 Amendment of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management

CIRCULAR CSSF 22/828 2/5 Circular CSSF 22/828 Re: Amendment of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management Ladies and Gentlemen, The objective of this circular is to amend paragraph 4. “Additional requirement for payment service providers (PSPs)” of Circular CSSF 20/750 to introduce a form regarding the updated and comprehensive risk assessment of the ICT and security risks related to payment services provided by PSPs (named “PSP ICT Assessment”), and to provide further information on the objective, the scope and the submission process and deadline related to this form. The PSP ICT Assessment form shall be used for the first time concerning the calendar year 2022 and submitted to the CSSF no later than 31 March 2023. The amended version of paragraph 4 is presented in “track changes” in the Annex of the present circular. The revised version of paragraph 4 will enter into force on the date of publication of the present circular. This circular is applicable as of its publication date. Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General Annex: Amended version of paragraph 4 of the Circular CSSF 20/750 Luxembourg, 29 December 2022 To all credit institutions and to all PFS To all payment institutions and to all electronic money institutions

CIRCULAR CSSF 22/828 3/5 Annex: Amended version of paragraph 4 of Circular CSSF 20/750 4. Additional requirement for payment service providers (PSPs)1 8. As provided for in paragraph 24 of Guideline “3.3.5. Reporting” and in accordance with Article 105-1(2) of the LPS, PSPs are required to provide the CSSF with an updated and comprehensive risk assessment related to payment services (hereafter “PSP ICT Assessment”). The form and deadlines are as follows: a. for credit institutions, this assessment, signed by the management body, must be submitted as soon as possible after the closing of the financial year and no later than 30 April of each year; b. for payment institutions and electronic money institutions, this assessment must be included in a dedicated section of the management report on internal control, which must be published in accordance with the requirements set out in Circular CSSF 15/614, no later than the last day of the third month following the closing date of the financial year; and c. for POST Luxembourg, this assessment must be included in a dedicated section of the management report on internal control, to be published in accordance with the requirements set out in Circular CSSF 98/143, at the latest one month after the annual general meeting approving the annual accounts of the PSP. The CSSF has developed a standardised form for the PSP ICT Assessment to be used by all PSPs. The objective of this standardised PSP ICT Assessment form is to give guidance to the PSPs on the CSSF's expectations on the information to be provided via the PSP ICT Assessment, and hence achieve a certain level of harmonisation and comparability among the PSPs' ICT Assessments. Concerning the scope of the PSP ICT Assessment, the following is to be highlighted: • Institutions whose business model does not include the provision of payment services (as defined in article 1(38) of the LPS), do not have to provide the PSP ICT Assessment. As soon as the business model of an institution includes the provision of payment services, it shall submit to the CSSF for that calendar year a PSP ICT Assessment.

CIRCULAR CSSF 22/828 4/5 • EEA Branches established in Luxembourg, which offer payment services, do not have to provide the CSSF with a PSP ICT Assessment. On the other hand, Luxembourg based PSPs which have established branches in other EEA countries, which provide payment services, have to include those branches in their PSP ICT Assessment. In the event the ICT and security risk assessment for these branches deviates from that of the PSP, it should be made clear in the PSP ICT Assessment2. All PSPs must submit the duly completed PSP ICT Assessment form on an annual basis to the CSSF no later than 31 March each year and covering the previous calendar year. The PSP ICT Assessment form is published in the CSSF’s eDesk portal which is available at: https://edesk.apps.cssf.lu/ The PSP ICT Assessment shall be validated by the Management body of the PSP, i.e. at least by the member of the Management body responsible for the ICT function. This validation shall be specified in the respective section of the PSP ICT Assessment. The duly completed and validated PSP ICT Assessment shall be submitted annually by a member of the Management body to the CSSF exclusively via the CSSF’s eDesk portal. 1 As defined in Article 1(37) of the LPS 2 see EBA Q&A ID number 2018_4176

CIRCULAR CSSF 22/828 5 / 5 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1

1 direction@cssf.lu www.cssf.lu