Circular CSSF 21/785 is a CSSF circular, published 30 June 2022. Subject: Replacement of the prior authorisation obligation by a prior notification obligation in the case of material IT outsourcing. It was repealed by Circular CSSF 22/805.
\nRelevant for: AIFMs, AISPs, Central Securities Depositories (CSDs), Credit institutions, E-money institutions, Investment firms, Investment fund managers, Management companies - Chapter 15, Management companies - Chapter 16, Payment institutions, Payment institutions/electronic money institutions/AISPs, Specialised PFS, Support PFS.
\nKeywords: Cloud, Information and communications technology (ICT), Information security, Operational risk, Outsourcing.
\nAmends Circular CSSF 17/656, Circular CSSF 20/758.
\nIn case of discrepancies between the French and the English texts, the French text shall prevail.
\n13/563,
\n14/597,
\n16/642, 16/647, 17/655, 20/750, 20/759, 21/785, 22/807 and 24/860 Central administration, internal governance and risk management
\nCircular CSSF 12/552 AS AMENDED BY CIRCULARS CSSF 13/563, 14/597, 16/642, 16/647, 17/655, 20/750, 20/759, 21/785, 22/807 AND 24/860
\nIn case of discrepancies between the French and the English texts, the French text shall prevail.
\nCircular CSSF 12/552 as amended by Circulars CSSF 13/563, 14/597, 16/642, 16/647, 17/655, 20/750, 20/759, 21/785, 22/807 and 24/860 Re: Central administration, internal governance and risk management 1
\nLuxembourg, 11 December 2012 To all credit institutions and professionals performing lending operations1
\nLadies and Gentlemen, Articles 5(1a) and 38-1 of the Law of 5 April 1993 on the financial sector (“LFS”) require credit institutions to have robust internal governance arrangements, which
\nshall
\ninclude
\na clear organisational
\nstructure
\nwith
\nwell-defined,
\ntransparent and consistent lines of responsibility, effective processes to identify, manage, monitor and report the risks to which they are or might be exposed, adequate internal control mechanisms, including sound administrative and accounting procedures and remuneration policies and practices allowing and promoting sound and effective risk management, as well as control and security mechanisms for their IT systems. This Circular specifies the measures credit institutions must take pursuant to the provisions of the LFS as regards central administration, internal governance and risk management and Regulation CSSF No 15-02 relating to the supervisory review and evaluation process (“RCSSF 15-02”). It reflects the European and international principles, guidelines and recommendations which apply in this respect, translating them, in a proportionate way, in the context of the Luxembourg banking sector. Where, due to the size, the nature and the complexity of the activities and the organisation, the application of the principle of proportionality requires enhanced central administration, internal governance or risk management, the credit institutions shall refer to the principles set out in Chapter 2 of Part I and to the guidelines and recommendations listed in Part IV of this Circular for guidance on this implementation. This concerns especially the European Banking Authority (“EBA”) Guidelines on internal governance, as updated on 2 July 2021 (Guidelines on internal governance, EBA/GL/2021/05), and the joint EBA and European Securities and Markets Authority (“ESMA”) Guidelines on the assessment of the suitability of members of the management body and key function holders, as updated on 2 July 2021 (EBA/GL/2021/06). The principles and good practices arising from other sources already included in the previous versions of the Circular have been maintained in so far as they have not become obsolete.
\n1 To professionals performing lending operations as defined in Article 28-4 of the Law of 5 April 1993 on the financial sector, Chapter 3 of Part III, with the exception of Sub-chapter 3.4 “Exposures associated with particularly high risk” shall apply. Chapter 2(12) of Part III shall also apply.
\nCircular CSSF 12/552 AS AMENDED BY CIRCULARS CSSF 13/563, 14/597, 16/642, 16/647, 17/655, 20/750, 20/759, 21/785, 22/807 AND 24/860
\nAs regards the appointments of members of the management body and key function holders, this Circular should be read in conjunction with the Prudential Procedure in this respect published on the CSSF website.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}