Circular CSSF 22/828 is a CSSF circular, published 29 December 2022. Subject: Amendment of Circular CSSF 20/750 on requirements regarding information and communication (ICT) and security risk management.
\nLegal basis: Law of 10 November 2009 on payment services and electronic money.
\nRelevant for: AISPs, Credit institutions, Data Reporting Service Providers (DRSPs), E-money institutions, Investment firms, Payment institutions, Payment institutions/electronic money institutions/AISPs, Specialised PFS, Support PFS.
\nKeywords: Cloud, Cybersecurity, eDesk, Information and communications technology (ICT), Information security, Operational risk, Payment Service Provider (PSP), Payment services, Postal financial services, Risk management.
\nAmends Circular CSSF 20/750.
\nCircular CSSF 22/828 Amendment of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management
\nCircular CSSF 22/828 Re: Amendment of Circular CSSF 20/750 on requirements regarding information and communication technology (ICT) and security risk management
\nLuxembourg, 29 December 2022
\nLadies and Gentlemen,
\nTo all credit institutions and to
\nfor payment service providers (PSPs)” of Circular CSSF 20/750 to introduce a
\nThe objective of this circular is to amend paragraph 4. “Additional requirement all PFS
\nform regarding the updated and comprehensive risk assessment of the ICT and
\nTo all payment institutions and to all electronic money institutions
\nsecurity risks related to payment services provided by PSPs (named “PSP ICT Assessment”), and to provide further information on the objective, the scope and the submission process and deadline related to this form. The PSP ICT Assessment form shall be used for the first time concerning the calendar year 2022 and submitted to the CSSF no later than 31 March 2023. The amended version of paragraph 4 is presented in “track changes” in the Annex of the present circular. The revised version of paragraph 4 will enter into force on the date of publication of the present circular. This circular is applicable as of its publication date.
\nClaude WAMPACH
\nMarco ZWICK
\nJean-Pierre FABER
\nFrançoise KAUTHEN
\nClaude MARX
\nAnnex: Amended version of paragraph 4 of the Circular CSSF 20/750
\nAnnex: Amended version of paragraph 4 of Circular CSSF 20/750 4. Additional requirement for payment service providers (PSPs) 1
\nAs provided for in paragraph 24 of Guideline “3.3.5. Reporting” and in accordance with Article 105-1(2) of the LPS, PSPs are required to provide the CSSF with an updated and comprehensive risk assessment related to payment services (hereafter “PSP ICT Assessment”). The form and deadlines are as follows: a.
\nfor credit institutions, this assessment, signed by the management body, must be submitted as soon as possible after the closing of the financial year and no later than 30 April of each year;
\nfor payment institutions and electronic money institutions, this assessment must be included in a dedicated section of the management report on internal control, which must be published in accordance with the requirements set out in Circular CSSF 15/614, no later than the last day of the third month following the closing date of the financial year; and
\nfor POST Luxembourg, this assessment must be included in a dedicated section of the management report on internal control, to be published in accordance with the requirements set out in Circular CSSF 98/143, at the latest one month after the annual general meeting approving the annual accounts of the PSP.
\nThe CSSF has developed a standardised form for the PSP ICT Assessment to be used by all PSPs. The objective of this standardised PSP ICT Assessment form is to give guidance to the PSPs on the CSSF's expectations on the information to be provided via the PSP ICT Assessment, and hence achieve a certain level of harmonisation and comparability among the PSPs' ICT Assessments. Concerning the scope of the PSP ICT Assessment, the following is to be highlighted: •
\nInstitutions whose business model does not include the provision of payment services (as defined in article 1(38) of the LPS), do not have to provide the PSP ICT Assessment. As soon as the business model of an institution includes the provision of payment services, it shall submit to the CSSF for that calendar year a PSP ICT Assessment.
\nEEA Branches established in Luxembourg, which offer payment services, do not have to provide the CSSF with a PSP ICT Assessment.
\nThe text above is the opening of the document; the PDF carries the whole.
\nDocument page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.
"}