Skip to content

Luxembourg cloud computing rules for investment fund managers: a reminder of the obligations six months before their Cloud Register must be drawn up

Related people
Six Jean-Christian
Jean-Christian Six

Partner

Luxembourg

View profile →

Yannick Arbaut

Partner

Luxembourg

View profile →

Di Lorenzo Catherine
Catherine Di Lorenzo

Counsel

Luxembourg

View profile →

Ingallo Dara
Dara Ingallo

PSL - Senior Associate

Luxembourg

View profile →

Dutkiewicz Izabela
Izabela Dutkiewicz

Associate

Luxembourg

View profile →

Azoulay Barbara
Barbara Azoulay

Associate

Luxembourg

View profile →

Paul Wagner

Junior Associate

Luxembourg

View profile →

27 September 2019

Last year, investment fund managers (IFMs) were caught by surprise with the immediate application of Circular 17/654 on IT outsourcing relying on a cloud computing infrastructure (the Cloud Circular), but every cloud has a silver lining. Circular 19/714, which amends the Cloud Circular, significantly reduces and clarifies the obligations of IFMs.

This article aims at providing a reminder to IFMs of the rules applicable to them in relation to their cloud computing solutions exactly 6 months before the end of the grace period to establish their cloud outsourcing register (due by 27 March 2019).

On 27 March 2017, the CSSF issued a Circular 19/714 amending the Cloud Circular. The aim of this amendment was to reflect the CSSF’s experience with the practical application of the Cloud Circular and the inclusion of the European Banking Authority guidelines on outsourcing arrangements.

The Cloud Circular already provided for certain requirements that entities in scope must comply with for cloud outsourcings (i.e. outsourcing agreements, resource operation, governance, notification and consent of clients, management of outsourcing risks, business continuity, systems security and right of audit). Circular 19/714 now lightens certain requirements of the Cloud Circular and clarifies its scope.