CSSF Regulation No 20-04 on the Definition of Essential Services

CSSF REGULATION NO 20-04 1/3 CSSF Regulation No 20-04 on the definition of essential services according to the Law of 28 May 2019 transposing Directive (EU) 2016/1148 of the European Parliament and of the Council concerning measures for a high common level of security of network and information systems across the Union

CSSF REGULATION NO 20-04 2/3 CSSF Regulation No 20-04 of 15 July 2020 on the definition of essential services according to the Law of 28 May 2019 transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union Having regard to the Law of 28 May 2019 transposing Directive (EU) 2016/1148 of the European Parliament and of the Council of 6 July 2016 concerning measures for a high common level of security of network and information systems across the Union (“NIS Law”) and amending the Law of 20 April 2009 establishing the Government IT Centre (Centre des technologies de l’information de l’État, CTIE), as amended, and the Law of 23 July 2016 establishing a High Commission for National Protection (Haut-Commissariat à la Protection nationale); Having regard to Article 3 of the NIS Law designating the Commission de Surveillance du Secteur Financier (hereinafter “CSSF”) as the competent authority for the security of network and information systems covering the sectors of credit institutions and financial market infrastructures; Having regard to Article 7(4) of the NIS Law, pursuant to which the competent authority lays down the list of essential services by way of a regulation; The Executive Board of the Commission de Surveillance du Secteur Financier Decides: Article 1 – Definitions For the purposes of this regulation, the following definitions shall apply: “Credit institutions” shall mean credit institutions within the meaning of point (12) of Article 1 of the Law of 5 April 1993 on the financial sector, as amended. “Financial market infrastructures” shall mean operators of a trading venue within the meaning of point (43) of Article 1 of the Law of 30 May 2018 on markets in financial instruments and/or central counterparties (CCPs) within the meaning of point (1) of Article 2 of Regulation (EU) No 648/2012 of the European Parliament and of the Council of 4 July 2012 on OTC derivatives, central counterparties and trade repositories. “MTF” shall mean a multilateral trading facility within the meaning of point (32) of Article 1 of the Law of 30 May 2018 on markets in financial instruments. “Operator of essential services” shall mean a public or private entity of a type referred to in the Annex of the NIS Law and which meets the criteria laid down in Article 7(2) of the NIS Law. In case of discrepancies between the French and the English text, the French text shall prevail.

CSSF REGULATION NO 20-04 3/3 Article 2 – Essential services In accordance with Article 7(4) of the NIS Law, the following services shall be essential for the maintenance of critical societal and/or economic activities: (a) For credit institutions: i. Depositary bank function; ii. Deposit management; iii. Credit granting; iv. Investment services; v. Payment services. (b) For financial market infrastructures: i. Admission to trading of financial instruments on a regulated market￾type trading venue or an MTF. Article 3 – Entry into force This regulation shall enter into force on 1 August 2020. Article 4 – Publication This regulation will be published in the Journal officiel du Grand-Duché de Luxembourg and on the website of the CSSF. Luxembourg, 15 July 2020 Commission de Surveillance du Secteur Financier Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Françoise KAUTHEN Director Claude MARX Director General