Luxembourg cloud computing rules for investment fund managers: a reminder of the obligations six months before their Cloud Register must be drawn up
Catherine Di Lorenzo
PSL - Senior Associate
27 September 2019
This article aims at providing a reminder to IFMs of the rules applicable to them in relation to their cloud computing solutions exactly 6 months before the end of the grace period to establish their cloud outsourcing register (due by 27 March 2019).
On 27 March 2017, the CSSF issued a Circular 19/714 amending the Cloud Circular. The aim of this amendment was to reflect the CSSF’s experience with the practical application of the Cloud Circular and the inclusion of the European Banking Authority guidelines on outsourcing arrangements.
The Cloud Circular already provided for certain requirements that entities in scope must comply with for cloud outsourcings (i.e. outsourcing agreements, resource operation, governance, notification and consent of clients, management of outsourcing risks, business continuity, systems security and right of audit). Circular 19/714 now lightens certain requirements of the Cloud Circular and clarifies its scope.