Amendment 3, scope restructured into four cases (DORA / non-DORA)

The scope of CSSF Circular 22/806 (Part I, Chapter 2) has been restructured into four cases to clarify the articulation with DORA:

• Case a, DORA financial entities: for financial entities defined in Article 2 of the DORA Regulation and supervised by CSSF, to which 22/806 fully applied for outsourcing:
  1. Part I of 22/806 remains applicable for non-ICT outsourcing;
  2. Part II of 22/806 on ICT outsourcing arrangements no longer applies to them (replaced by DORA).
• Case b, 22/806 entities outside DORA: for entities subject to 22/806 but NOT to the DORA Regulation, Circular 22/806 remains fully applicable (Part I and Part II) for all outsourcing arrangements.
• Case c, entities removed from scope: financial entities defined in Article 2 of DORA and supervised by CSSF, to which 22/806 applied only for ICT outsourcing, are no longer in scope of 22/806. DORA applies exclusively.
• Case d, Article 125-1 management companies: for management companies authorised solely under Article 125-1 of Chapter 16 of the UCI Law (thus excluded from DORA), Circular 22/806 continues to apply fully to ICT outsourcing.

This restructuring avoids dual compliance while preserving coverage of entities not included in the DORA scope.