New Cloud Computing And IT Outsourcing Requirements In The Financial Sector

On 17 May, 2017 the Luxembourg Financial Regulator (CSSF) published four new circulars concerning cloud computing and IT outsourcing. The new regulations will immediately affect credit institutions, professionals of the financial sector, payment service providers, and electronic money issuers (Entities). The four CSSF circulars, which came into effect on the date of their publication, introduce new rules and replace existing requirements set out in existing circulars.

MAIN NOVELTIES AND AMENDMENTS

Circular 17/654

This circular addresses the obligations that Entities must meet when their IT infrastructure uses or will rely on a cloud computing infrastructure.

The circular applies to the partial or full transfer of the activities and does not make many differences between an external provider and an internal provider within a group of companies.

The CSSF defines the term of "material activity" as any activity that, when not properly performed, reduces the ability of an Entity to meet regulatory requirements or continue its operations, and any activities that are necessary for the sound and prudent risk management.

Three different IT service models are described:

Infrastructure as a service Platform as a service Software as a service For each of the above service models, the CSSF provides an interpretation of the levels of control on the systems and the software that an Entity must respect when applying such model.

Within these service models the CSSF differentiates four different cloud types:

Private cloud Common cloud Public cloud Hybrid cloud An Entity's outsourcing of IT matters will qualify for particular regulatory treatment, if it meets specific criteria set out by the CSSF and will be excluded from the scope of other existing regulations relating the Entity's central administration, accounting organization, internal governance and risk management (e.g. Circulars 12/552 or 17/656).

The criteria that the CSSF uses to define the specific regulatory treatment are:

Five general rules on cloud computing: Free service on demand Enlarged network access Shared resources Variable elasticity Measured services Access of the service providers: Staff access Intervention requirement If the above criteria are fulfilled an Entity must obtain the CSSF's prior approval (if a material activity is concerned). In case a Luxembourg based professional of the financial sector is used, an Entity must only file a prior notification to the CSSF.

Once the...