Laws › CSSF 22/806
CSSF 22/806

CSSF Circular 22/806 on outsourcing (as amended by CSSF 25/883)

The CSSF framework for outsourcing and cloud arrangements of Luxembourg financial entities.

Official source : EUR-Lex CELEX: ↗

28articles
0with Luxgap guidance
24havg response time

Part I - Outsourcing arrangements

Art. I.1
Chapter 1. Definitions, abbreviations and acronyms

Part I - Outsourcing arrangements

Art. I.2
Chapter 2. Scope of application and proportionality

Part I - Chapter 3. General principles

Art. I.3.1
Sub-chapter 3.1 General principles governing outsourcing arrangements

Part I - Chapter 3. General principles

Art. I.3.2
Sub-chapter 3.2 Intragroup outsourcing

Part I - Chapter 4. Governance - Sub-chapter 4.1 Assessment

Art. I.4.1.1
Section 4.1.1 Outsourcing

Part I - Chapter 4. Governance - Sub-chapter 4.1 Assessment

Art. I.4.1.2
Section 4.1.2 Critical or important functions

Part I - Chapter 4. Governance - Sub-chapter 4.1 Assessment

Art. I.4.1.3
Section 4.1.3 Outsourcing arrangements relating to internal control functions

Part I - Chapter 4. Governance - Sub-chapter 4.1 Assessment

Art. I.4.1.4
Section 4.1.4 Outsourcing arrangements relating to the financial and accounting function

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.1
Section 4.2.1 Sound governance arrangements and third-party risk

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.2
Section 4.2.2 Sound governance arrangements for outsourcing

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.3
Section 4.2.3 Outsourcing policy

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.4
Section 4.2.4 Conflicts of interest

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.5
Section 4.2.5 Business continuity plans

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.6
Section 4.2.6 Internal audit function

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.7
Section 4.2.7 Documentation requirements

Part I - Chapter 4. Governance - Sub-chapter 4.2 Governance framework

Art. I.4.2.8
Section 4.2.8 Outsourcing supervisory conditions

Part I - Chapter 4. Governance - Sub-chapter 4.3 Outsourcing process

Art. I.4.3.1
Section 4.3.1 Pre-outsourcing analysis

Part I - Chapter 4. Governance - Sub-chapter 4.3 Outsourcing process

Art. I.4.3.2
Section 4.3.2 Contractual phase

Part I - Chapter 4. Governance - Sub-chapter 4.3 Outsourcing process

Art. I.4.3.3
Section 4.3.3 Monitoring of outsourced functions

Part I - Chapter 4. Governance - Sub-chapter 4.3 Outsourcing process

Art. I.4.3.4
Section 4.3.4 Exit plans

Part II - Chapter 1. Non-cloud ICT outsourcing

Art. II.1.1
Sub-chapter 1.1 Requirements for Relevant Entities other than support PFS

Part II - Chapter 1. Non-cloud ICT outsourcing

Art. II.1.2
Sub-chapter 1.2 Requirements for support PFS

Part II - Chapter 2. Cloud computing ICT outsourcing - Sub-chapter 2.1

Art. II.2.1.1
Section 2.1.1 Specific terminology

Part II - Chapter 2. Cloud computing ICT outsourcing - Sub-chapter 2.1

Art. II.2.1.2
Section 2.1.2 Definition of cloud computing

Part II - Chapter 2. Cloud computing ICT outsourcing - Sub-chapter 2.1

Art. II.2.1.3
Section 2.1.3 Conditions of application of chapter 2

Part II - Chapter 2. Cloud computing ICT outsourcing

Art. II.2.2
Sub-chapter 2.2 Requirements for outsourcing on a cloud computing infrastructure

Part III - Date of application

Art. III
Part III - Date of application

Annex

Art. Annexe
Annex - List of implemented ESA Guidelines

Need to comply with CSSF 22/806?

Our DPO and CISO team supports over 80 Luxembourg organisations. Free diagnosis, quote within 48h.

Request a diagnosis →