On 27 March 2019, the CSSF issued a new Circular 19/714 (the “Circular”) in order to update its guidelines on the use of cloud computing infrastructure, as presented in its initial circular (the “Cloud Circular”) 17/654.
Inclusion of investment fund managers
The Circular now explicitly provides that all investment fund managers subject to Circular CSSF 18/698 on the authorization and organization of investment fund managers incorporated under Luxembourg law must comply with the requirements of the Cloud Circular.
Related obligations
The obligations that investment fund managers must now comply with are not new, insofar as they are a mere extension of the obligations already applicable to credit institutions, professionals of the financial sector as well as payment institutions and electronic money institutions.
The main changes to the current obligations are:
- notifying the CSSF only for outsourcing activities which are considered material;
- analysing the risk related to the outsourcing activity;
- maintaining a register which shall include all cloud computing outsourcing performed (whether material or not),
- which must be delivered upon request to the CSSF or to the European Banking Authority, as the case may be;
- reviewing and updating the outsourcing policy of the cloud computing provider on a regular basis, and ensuring
- that any changes are implemented rapidly; and,
- in case the supervised entity and the signatory of the agreements formalizing the outsourcing of the cloud computing infrastructure are not the same person, implementing appropriate measures to ensure appropriate reporting to the supervised entity through the signatory.
Entry into force
The various new obligations are “applicable with immediate effect” to investment fund managers, safe for the obligation to establish the cloud computing outsourcing register which is delayed to 12 months from the entry into force of the Circular.
Any necessary action under the Circular should be swiftly implemented by investment fund managers falling under the scope of circular CSSF 18/698.
