Circular CSSF 21/777 is a CSSF circular, published 12 July 2021 and updated 30 June 2022. Subject: Implementation of the Guidelines of the European Securities and Markets Authority (ESMA) on outsourcing to cloud service providers by amending the scope of Circular CSSF 17/654, as amended. It was repealed by Circular CSSF 22/805.
\nRelevant for: AIFMs, Central Securities Depositories (CSDs), Credit institutions, Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Investment fund managers, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Specialised PFS, Support PFS, UCITS.
\nMain topic: Benchmarks, EMIR, MiFID II. Keywords: Cloud, Cybersecurity, FinTech, Information and communications technology (ICT), Information security, Outsourcing.
\nCircular CSSF 21/777 Implementation of the Guidelines of the European Securities and Markets Authority (ESMA) on outsourcing to cloud service providers by amending the scope of Circular CSSF 17/654, as amended
\nIn case of discrepancies between the French and the English text, the French text shall prevail.
\nCircular CSSF 21/777 RE : Implementation of the Guidelines of the European Securities and Markets Authority (ESMA) on outsourcing to cloud service providers by amending the scope of Circular CSSF 17/654, as amended
\nLuxembourg, 12 July 2021
\nLadies and Gentlemen,
\nTo all credit institutions and PFS within
\nThis circular implements the Guidelines of the European Securities
\nthe meaning of the Law of 5 April 1993 on
\nand Markets Authority (hereinafter “ESMA”) on outsourcing to
\nthe financial sector (LFS)
\ncloud
\nTo all payment institutions and electronic
\nservice
\nproviders
\n(reference:
\nESMA50-164-4285,
\nhereinafter the “Cloud Guidelines”).
\nmoney institutions within the meaning of
\nTo this end, it amends the scope of Circular CSSF 17/654, as
\nthe
\namended, on IT outsourcing relying on a cloud computing
\nLaw
\nNovember
\n2009
\ninfrastructure in order to include all the entities covered by the
\npayment services (LPS) To all investment fund managers subject
\nCloud Guidelines.
\nto Circular CSSF 18/698 To alternative investment fund managers (AIFMs) and depositaries of alternative investment funds (AIFs) To undertaking for collective investment in transferable securities (UCITS), to management companies and depositaries of UCITS, as well as to investment companies that have not designated a management
\ncompany
\nauthorised
\naccordance with the UCITS Directive To central counterparties, including Tier 2 third-country
\ncentral
\ncomplying
\nwith
\ncounterparties, the
\nrelevant
\nrequirements of EMIR To data reporting services providers and to market operators operating a trading venue To central securities depositories To administrators of critical benchmarks
\nImplementation of the Guidelines of the European Securities and Markets Authority ESMA50-164-4285
\nII. Amendment of Circular CSSF 17/654, as amended 4. The scope of Circular CSSF 17/654, as amended, is extended and the Cloud Circular thus applies: a.
\nto all credit institutions and PFS within the meaning of the Law of 5 April 1993 on the financial sector (LFS);
\nto all payment institutions and electronic money institutions within the meaning of the Law of 10 November 2009 on payment services (LPS);
\nto all investment fund managers subject to Circular CSSF 18/698;
\nto alternative investment fund managers (AIFMs) within the meaning of point (b) of Article 4(1) of the AIFMD 1 and to depositaries of alternative investment funds (AIFs) referred to in Article 21(3) of the AIFMD;
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}