The ABBL welcomes the publication of the CSSF circular on outsourcing arrangements (Circular 22/806) – a regulation long-awaited by the Luxembourg financial community. The key goal of the circular is to implement the requirements of the European Banking Authority (EBA) Guidelines on outsourcing arrangements (EBA/GL/2019/02).
Why does outsourcing regulation matter for banks?
- Outsourcing helps banks focus on their core business and gives them access to skills and services that are not available in house
- Outsourcing contributes to the efficiency and to the competitiveness of banks' business models
- Outsourcing regulation must therefore strike the right balance between:
o Necessary safeguards preserving the integrity of outsourcing institutions, and
o Flexibility to adapt to a fast-moving economic and technological environment
The publication of the circular is the culmination of the work conducted consequently by the EBA at the European level and the CSSF at the national level since 2018.
More specifically, The CSSF Circular 22/806 implements two guidelines of the European Supervisory Authorities (ESAs):
- EBA Guidelines 2019/02 on outsourcing arrangements
- ESMA Guidelines on outsourcing to cloud service providers, previously implemented by CSSF Circular 21/777 amending Circular 17/654
The publication of the circular is followed by the release of two additional regulatory updates, namely:
- Circular CSSF 22/805 on the application of EBA Guidelines on outsourcing arrangements and the repeal or amendments of certain circulars CSSF
- CSSF FAQ on outsourcing arrangements
Key elements brought by the circular are:
- Prior notification procedure for critical/important functions replacing the former burdensome ex-anteauthorisation
- Some flexibilities preserved for intragroup outsourcing arrangements
- Limited scope of banking activities alleviating the supervisory burden, in particular, for outsourcing arrangements with providers located in third countries
- Proportionality in the definition of critical / important functions in relation to core business activities
- Flexibility regarding the positioning of the outsourcing function regarding the three lines of defence model
In terms of the scope, the circular is applicable to banks, investment firms, payment and electronic money institutions, PSFs, investment funds managers and central securities depositories (CSDs) (for ICT Outsourcing).
The circular applies to all outsourcings as of 30 June 2022. Existing outsourcing arrangements must be reviewed / amended by 31 December 2022 to be compliant with the circular.
The ABBL has been putting a strong emphasis on the subject related to the implementation of EBA guidelines in Luxembourg. ABBL’s working groups Outsourcing Regulation and Cloud Computing were specifically charged with the advocacy activity related to this important theme. The ABBL is thankful to the CSSF for the constructive dialogue on the work in relation to the implementation of EBA guidelines in Luxembourg.
ABBL members interested to know more about the CSSF circular 22/806 and take part in a live Q&A session organised jointly by the ABBL and CSSF, are invited to register for the dedicated webinar taking place on 8 June 2022, 14:00 – 15:30.
By Gilles Pierre - Head of Banking Regulation & Financial Markets and Andrey Martovoy - Adviser - Innovation & Digital