LU - Review of IT outsourcing conditions
On 14 October 2021, the Commission de Surveillance du secteur financier (CSSF) published circular CSSF 21/785, replacing the prior authorisation requirement with a prior notification obligation in the event of material IT outsourcing.
In this context, and with regard to IT outsourcing based on cloud computing infrastructure, the clause requirements have been clarified. Thus, the supervised entities must give prior notification of their project at least three months before the planned subcontracting takes effect, or at least one month in the case of a supporting financial service provider (FSP). In the absence of a response from the competent authority (request for additional information, partial or complete objection to the project), the institution may implement the material IT outsourcing at the end of the aforementioned period of three months or one month. This circular entered into force on 15 October 2021.