Operational Resilience / Outsourcing in Luxembourg

What Changed

The circular consolidates and updates governance rules, focusing on: Management bodies: Responsibilities, composition, qualifications, organization, and functioning, including CSSF authorization of members based on professional experience, standing (e.g., police records), and irreproachable conduct. Internal control functions: Responsibilities, characteristics, organization, and execution of work for compliance officers and internal auditors, with notifications to CSSF including detailed persona

What You Need To Do

• Gap analysis
• Updates and notifications
• Implementation
• Documentation

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] financialcrime.lu
• [6] elvingerhoss.lu

What Changed

Consolidation and repeal: Replaces outdated circulars with unified requirements under the amended Law of 10 November 2009 on payment services, covering central administration (decision-making must be in Luxembourg), management body responsibilities, internal control functions (compliance, risk management, internal audit as independent second/third lines), conflicts of interest management, new product approval processes, and client funds safeguarding (e.g., segregation, daily/weekly reconciliatio

What You Need To Do

• Assess and update governance frameworks
• Confirm control functions
• Implement operational safeguards
• Document proportionality
• Retain records and report

Key Dates

References

• [1] financialcrime.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] elvingerhoss.lu
• [5] cssf.lu
• [6] cssf.lu

What Changed

Mandatory Electronic-Only Submission: Documents listed in Annex I must be transmitted exclusively via e-file (http://www.e-file.lu) or SOFiE (http://www.cetrel-securities.lu/wp_static/what-do-we-offer/secured-reporting-channel-sofie-sort/), in PDF format supporting read access, printing, copy/paste, and word search; other methods post-February 1, 2019, are null and void. Dynamic Annex Updates: The annex, published on the CSSF website, is regularly updated (e.g., latest noted April 1, 2025) and i

What You Need To Do

• Register/access e-file or SOFiE platforms if not already (test/production environments available since February 2019)
• Consult and adhere to the latest Annex I for document list, nomenclatures, and formats (PDF with full functionality)
• Ensure submissions are final/official versions matching hard copies; use specified identifiers for UCIs/SIFs/SICARs
• Implement processes for automatic/manual transmission (e
• Train staff on responsibilities and integrate into reporting workflows; reference CSSF FAQs for closing documents

Key Dates

References

• [1] bsp.lu
• [2] cssf.lu
• [3] mondaq.com
• [4] cssf.lu
• [5] e-file.lu
• [6] cssf.lu
• [7] cssf.lu
• [8] dechert.com

What Changed

Updates to Descriptive Report and Self-Assessment Questionnaire: Refines content, format, and submission requirements for support PFS's annual submissions, emphasizing more detailed disclosures on operations, risks, and controls (building on CSSF 24/850). Auditor Engagement Rules: Introduces specific practical guidelines for approved statutory auditors, including mandatory scope of work, independence confirmations, and standardized procedures for reviewing support PFS reports. Management Letter

What You Need To Do

• *Review and Update Processes
• *Engage/Confirm Auditors
• *Implement Templates and Testing
• *Training and Governance
• *Submit on Time

Key Dates

What Changed

Standardized Reporting Templates: Introduces detailed formats and content requirements for the annual descriptive report and self-assessment questionnaire, covering governance, risk management, internal controls, and operational metrics specific to support PFS activities (e.g., IT services, administrative support, custody). Auditor Engagement Rules: Mandates approved statutory auditors to perform specific procedures, issue a management letter highlighting control weaknesses, and prepare a separa

What You Need To Do

• Annual Reporting Cycle
• February to review submissions, test controls, and issue management letter (flagging deficiencies) plus separate compliance report
• Governance Updates
• Auditor Coordination
• Record-Keeping

Key Dates

What Changed

Repeals Annex B of Circular CSSF 22/811 with immediate effect, replacing it with streamlined annual reporting via a core compliance-focused Self-Assessment Questionnaire (SAQ) that assesses governance, internal controls, operational organization, and risk management; detailed instructions are now on the CSSF website. Introduces prior CSSF authorisation requirements for entities acting as UCI administrators, including a defined administrative procedure with application details in Annex A; authori

What You Need To Do

• Assess eligibility and obtain prior CSSF authorisation via Annex A application (or notify substantial changes); ensure ongoing validity by monitoring operational model and delegations
• Adapt internal processes for revised annual UCIA reporting (SAQ-focused, integrated where applicable); submit using CSSF website instructions starting for FY ending 31 Dec 2025
• Review/update contracts with UCIs/IFMs to define roles, responsibilities, and oversight; implement delegation monitoring, remediation plans, and ICT compliance (DORA/Circular 25/882 or 20/750)
• For DORA-scope entities, align outsourcing arrangements with Circular CSSF 25/882

Key Dates

References

• [1] cssf.lu
• [2] blog.uit.lu
• [3] ogier.com
• [4] cssf.lu
• [5] cssf.lu
• [6] cssf.lu
• [7] harneys.com

What Changed

Authorisation Requirements: Prior CSSF authorisation is mandatory for appointment as UCI administrator, via full application under sectoral laws or a simplified administrative procedure; application must include details per Annex A, with ongoing updates for substantial changes. Scope of UCI Administration: Defines three core functions—registrar, NAV calculation/accounting, and client communication—requiring only one designated service provider per function per UCI (or compartment); UCI/IFM may p

What You Need To Do

• Submit authorisation application to CSSF with Annex A information before commencing UCI administration; notify substantial changes and keep file updated
• Establish/implement governance, controls, escalation processes, resource adequacy, ICT/business continuity per circular; ensure single provider per function
• For delegations
• Conclude written contracts with UCI/IFM; submit annual UCIA activity reports

References

• [1] cssf.lu
• [2] lexnow.lu
• [3] cssf.lu
• [4] stibbe.com
• [5] cssf.lu
• [6] cssf.lu
• [7] ey.com
• [8] simmons-simmons.com

What Changed

The circular introduces the following material modifications to Circular CSSF 07/325: *New Supervisory Module UCI administration** has been added as a thematic module to the self-assessment questionnaire, reflecting increased regulatory attention to fund administration practices. *Enhanced Self-Assessment Framework** Existing modules have been updated to better align with supervisory objectives and current regulatory priorities. The revised SAQ now captures a broader range of supervisory point

What You Need To Do

• *Update Self-Assessment Processes
• Revise internal SAQ completion procedures to address the new UCI administration module
• Ensure all thematic modules reflect current supervisory expectations
• *Assess UCI Administration Compliance
• If the institution provides or is involved in UCI administration services, conduct a detailed assessment of compliance with CSSF expectations

Key Dates

References

• [1] bakermckenzie.com
• [2] debevoise.com
• [3] cssf.lu
• [4] arendt.com
• [5] cssf.lu
• [6] cssf.lu
• [7] stradalex.lu
• [8] cssf.lu