Circular CSSF 22/805 on Revised EBA Guidelines on Outsourcing Arrangements and Publication of Circular CSSF 22/806

CIRCULAR CSSF 22/805 1/10 Circular CSSF 22/805 Revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) - Publication of Circular CSSF 22/806 on outsourcing arrangements – Repeal or amendments of certain circulars CSSF

CIRCULAR CSSF 22/805 2/10 Circular CSSF 22/805 Re:Revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02) - Publication of Circular CSSF 22/806 on outsourcing arrangements – Repeal or amendments of certain circulars CSSF Ladies and Gentlemen,

1. The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the revised EBA Guidelines on outsourcing arrangements (EBA/GL/2019/02 or the Guidelines)1. Consequently, the CSSF has integrated them into its administrative practice and regulatory approach via the Circular CSSF 22/806 (or the Circular) with a view to contribute to supervisory convergence at European level.
2. While the aforementioned Guidelines apply to credit institutions, investment firms and payment and electronic money institutions only, having due regard to the principle of proportionality, the Circular covers a wider scope of supervised entities. The Circular represents the CSSF’s integrated framework on outsourcing arrangements and introduces a harmonised framework governing outsourcing arrangements in order to promote convergence at a national level.
3. The Circular gathers all supervisory requirements on outsourcing arrangements, including those on information and communication technology (ICT) outsourcing arrangements that were previously disseminated in individual circulars, in one single document. While setting out the supervisory requirements on outsourcing arrangements (including in case of sub-outsourcing), the Circular amends the framework on internal governance arrangements of supervised entities by: a. aligning the definition of outsourcing to the MiFID framework; b. defining criteria for the assessment of outsourcing arrangements and in particular for the identification of critical or important functions that shall be subject to more stringent requirements, thus recognising that outsourcing arrangements may be managed according to a risk-based approach; c. providing guidance on the requirements that are applicable when outsourcing arrangements relate to internal control functions and to the financial and accounting function respectively; 1 The Guidelines are available on the EBA’s website at www.eba.europa.eu. The Guidelines repeal the CEBS guidelines on outsourcing of 14 December 2006 and the EBA recommendations on outsourcing to cloud service providers of 20 December 2017 (EBA/REC/2017/03) as of 30 September 2019. Said recommendations have been integrated into the Guidelines. Luxembourg, 22 April 2022 To all credit institutions and professionals of the financial sector within the meaning of the Law of 5 April 1993 on the financial sector (LFS) To all payment institutions and electronic money institutions within the meaning of the Law of 10 November 2009 on payment services (LPS) To all investment fund managers subject to Circular CSSF 18/698 To all undertakings for collective investment in transferable securities subject to Part I (UCITS) of the UCITS Law which designate a management company within the meaning of the UCITS Law To all central counterparties (CCPs), including Tier 2 third￾country CCPs, complying with the relevant requirements of EMIR To all approved publication arrangements (APAs) with a derogation and authorised reporting mechanisms (ARMs) with a derogation within the meaning of the LFS To all market operators operating a trading venue within the meaning of the LFS To all central securities depositories (CSDs) To all administrators of critical benchmarks

CIRCULAR CSSF 22/805 3/10 d. clarifying the requirements with respect to the outsourcing process, and notably specifying that outsourcing arrangements that relate to critical or important functions shall be subject to a prior notification requirement2. In addition, outsourcing agreements shall include minimum contractual clauses, in particular with respect to audit and access rights; e. introducing specific requirements for the management and oversight of the risks associated with, and the performance and soundness of, the outsourcing arrangements including by establishing an outsourcing function, where relevant, having due regard to the principle of proportionality; f. requiring the concerned entities to maintain a register for all outsourcing arrangements that can be used by competent authorities in the context of their prudential supervision. 4. The Circular CSSF 22/806 applies as from 30 June 2022. 5. The update of the existing circulars CSSF will be done as follows: (1) Circulars CSSF to be amended as of 30 June 2022:  Circular CSSF 12/552 as amended, concerning the central administration, internal governance and risk management;  Circular CSSF 20/758 as amended, concerning the central administration, internal governance and risk management;  Circular IML 95/120 concerning the central administration;  Circular IML 96/126 concerning the administrative and accounting organisation;  Circular IML 98/143 as amended, concerning the internal control;  Circular CSSF 04/155 concerning the compliance function. The updated versions of these circulars CSSF on central administration, internal governance and risk management concerning credit institutions, investment firms, other professionals of the financial sector as well as payment and e-money institutions, as applicable, are available under the hyperlinks provided in Appendix 1 to the present circular. 2 Except for support PFS and their branches authorised under Article 29-3, 29-5 and 29-6 LFS, for which the outsourcing arrangements of core business activities shall be subject to a prior approval.

CIRCULAR CSSF 22/805 4/10 (2) Circulars CSSF to be amended at a later date:  Circular CSSF 16/644 as amended, concerning the provisions applicable to credit institutions acting as UCITS depositary subject to Part I “and UCIs subject to Part II” of the Law of 17 December 2010 relating to undertakings for collective investment and all UCITS, where appropriate, represented by their management company;  Circular CSSF 18/697 concerning the organisational arrangements applicable to fund depositaries which are not subject to Part I of the Law of 17 December 2010 relating to undertakings for collective investment, and, where appropriate, to their branches; Amendment to Circular CSSF 16/644 regarding the provisions applicable to credit institutions acting as UCITS depositary subject to Part I of the 2010 Law, where appropriate, represented by their management company; and Amendment to Circular IML 91/75 (as amended by Circular CSSF 05/177) regarding the revision and recast of the rules to which Luxembourg undertakings governed by the Law of 30 March 1988 on undertakings for collective investment (“UCIs”) are subject;  Circular CSSF 18/698 concerning the authorisation and organisation of investment fund managers incorporated under Luxembourg law; Specific provisions on the fight against money laundering and terrorist financing applicable to investment fund managers and entities carrying out the activity of registrar agent. For the sake of clarity, the amendments that are needed to align the aforementioned circulars CSSF with the Circular CSSF 22/806 are summarised in Appendix 2 to the present circular. 6. The following circulars CSSF are repealed as of 30 June 2022:  Circular CSSF 13/554 concerning the evolution of the usage and control of the tools for managing information technology resources and the management of access to these resources;  Circular CSSF 15/611 concerning the management of the risks related to the outsourcing of systems that allow the compilation, distribution and consultation of management board/strategic documents;  Circular CSSF 17/654 as amended, concerning IT outsourcing relying on a cloud computing infrastructure3; 3 The CSSF has integrated the Guidelines of the European Securities and Markets Authority (ESMA) on outsourcing to cloud service providers (ESMA50-164-4285, the ESMA Cloud Guidelines) into its

CIRCULAR CSSF 22/805 5/10  Circular CSSF 17/656 as amended, concerning administrative and accounting organisation; IT outsourcing;  Circular CSSF 19/714 concerning the update of Circular CSSF 17/654 on IT outsourcing relying on a cloud computing infrastructure;  Circular CSSF 21/777 concerning the implementation of the Guidelines of the European Securities and Markets Authority (ESMA) on outsourcing to cloud service providers by amending the scope of Circular CSSF 17/654, as amended;  Circular CSSF 21/785 concerning the replacement of the prior authorisation obligation by a prior notification obligation in the case of material IT outsourcing. 7. By derogation to point 4, points 59 and 60 of the Circular CSSF 22/806 on prior notification apply with immediate effect for ICT outsourcing4 only. The corresponding provisions governing the approval and notifications comprised in the currently applicable version of the concerned circulars CSSF listed under points 5 and 6 shall be read as referring to points 59 and 60 of the Circular CSSF 22/806 (see Appendix 3 to the present circular). Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General administrative practice and regulatory approach via the circular CSSF 21/777 amending the circular CSSF 17/654. This implementation of the ESMA Cloud Guidelines into the CSSF administrative practice and regulatory approach is maintained in the Circular CSSF 22/806. 4 The term ICT outsourcing covers both cloud computing outsourcings and other (non-cloud) ICT outsourcings. It is defined as per point 1 of Chapter I of the Circular CSSF 22/806 as “an arrangement of any form between the In-Scope Entity and a service provider by which that service provider performs an ICT process, an ICT service or an ICT activity that would otherwise be undertaken by the In-Scope Entity itself. The services are pure ICT services in nature.” In other words, business process outsourcing and outsourcing of tasks related to internal control functions, even if the services are provided on ICT systems that form part of this global outsourcing are not pure ICT outsourcing and are not concerned.

CIRCULAR CSSF 22/805 6/10 Appendix 1: Amended version of the circulars CSSF listed under item (1) of point 5. (clean): a. Circular CSSF 12/552 as amended, concerning the central administration, internal governance and risk management (clean version) b. Circular CSSF 20/758 as amended, concerning the central administration, internal governance and risk management (clean version) c. Circular IML 95/120 as amended concerning the central administration (clean version) d. Circular IML 96/126 as amended concerning the administrative and accounting organization (clean version) e. Circular IML 98/143 as amended, concerning the internal control (clean version) f. Circular CSSF 04/155 as amended concerning the compliance function (clean version)

CIRCULAR CSSF 22/805 7/10 Appendix 2: Overview of the amendments concerning the circulars CSSF 16/644, 18/697 and 18/698 listed under item (2) of point 5.: a. Amendments of the circular CSSF 16/644:

• the definition of “outsourcing” and “outsourcing of a material activity” are replaced by the definition of “outsourcing” and outsourcing of “a critical or important function” provided for under point 1. of the Circular CSSF 22/806; hence, the wording “outsourcing of a material activity” will have to be read “outsourcing of a critical or important function”;
• the wording “external providers” under point 15 will have to be read “service provider(s)” as defined under point 1. of the Circular CSSF 22/806;
• the prior approval and notification processes required for an outsourcing of a material activity according to point 16 is replaced by the prior notification process applicable to any outsourcing of a critical or important function in accordance with points 59 and 60 of the Circular CSSF 22/806. b. Amendments of the circular CSSF 18/697:
• the definition of “outsourcing” and “outsourcing of a material activity” are replaced by the definition of “outsourcing” and outsourcing of “a critical or important function” provided for under point 1. of the Circular CSSF 22/806; hence, the wording “outsourcing of a material activity” is to be read “outsourcing of a critical or important function”;
• the references to the circular CSSF 17/654 and the circular CSSF 17/656 in points 21 and 42 are replaced by a reference to the Circular CSSF 22/806;
• the prior approval and notification processes required for an outsourcing of a material activity according to point 43 are replaced by the prior notification process applicable to any outsourcing of a critical or important function in accordance with points 59 and 60 of the Circular CSSF 22/806. c. Amendments of the circular CSSF 18/698:
• point 138 no longer applies. This means that only critical or important contemplated ICT outsourcing shall be notified, applying the notification process and the related notice period in accordance with points 59 and 60 of the Circular 22/806. The monitoring requirements under Sub-chapter 6.2. (Delegation framework) referred to in point 138 are replaced by the ones of the Circular 22/806 (see in particular sub-chapter 4.3).

CIRCULAR CSSF 22/805 8/10

• points 139 and 140 no longer apply.
• the use of a back-up solution of the parent company, as stated in point 141 is replaced by the provisions of section 4.2.5. Business continuity plans and of sub-section 4.3.2.2. Security of data and systems of the Circular 22/806.
• point 143 does no longer apply as circular CSSF 17/654 has been integrated into the Circular CSSF 22/806.

CIRCULAR CSSF 22/805 9/10 Appendix 3: List of provisions modified or replaced, for ICT outsourcing only, by points 59 and 60 of the Circular CSSF 22/806 as from the date of publication of the present circular: a. The 9th bullet point (including its 4 sub-bullet points) of point 182 of Chapter 7 of Part II of Circular CSSF 12/552 as amended, is replaced by points 59 and 60 of the Circular 22/806; b. The 9th bullet point (including its 4 sub-bullet points) of point 184 of Chapter 7 of Part II of Circular CSSF 20/758 as amended, is replaced by points 59 and 60 of the Circular 22/806; c. In point 138 of Circular CSSF 18/698, the requirement that “Any use of a third party must be notified beforehand to the CSSF” no longer applies to ICT outsourcing. This means that only critical or important contemplated ICT outsourcing shall be notified, applying the notification process and the related notice period in accordance with points 59 and 60 of the Circular 22/806. d. In the Annex of Circular CSSF 13/554, the requirement that any financial institution “wishing to use such a configuration is required to introduce a formal and detailed authorization request to the CSSF”, is replaced by points 59 and 60 of the Circular 22/806; e. Items f. and g. of point 26 of Circular CSSF 17/654 as amended, are repealed; f. The 9th bullet point (including its 4 sub-bullet points) of point 182 of Chapter 1 of Circular CSSF 17/656 as amended, is replaced by points 59 and 60 of the Circular 22/806.

CIRCULAR CSSF 22/805 10/10 Commission de Surveillance du Secteur Financier 283, route d’Arlon L-2991 Luxembourg (+352) 26 25 1

1 direction@cssf.lu www.cssf.lu