Until now, all credit institutions, professionals of the financial sector (“PFS”), payment institutions and electronic money institutions subject to CSSF Circulars 12/552, 17/656 and 20/758 respectively, had to apply for the CSSF’s prior authorisation in the case of material IT outsourcing.
The Circular eases this regime by introducing a notification procedure, by which the CSSF needs to be notified (i) by means of the template forms available on the CSSF’s website and (ii) in advance of the contemplated implementation of the project. In particular, the Circular indicates the following:
- notification to the CSSF 1 (one) month in advance in the case of outsourcing to a Luxembourg support PFS under Articles 29-3 to 29-6 of the 1993 Law on the financial sector; and
- notification to the CSSF 3 (three) months in advance in all other cases.
The CSSF can, however, suspend these deadlines by asking for further information or by partly or fully opposing the project.
Finally, the CSSF reminded, in its press release 21/25 , that even if a material IT outsourcing project was notified to them, the CSSF may still intervene afterwards, through on-site inspections for example, if they identify serious shortcomings regarding compliance with the professional obligations.
