Publication of a new notification template for critical or important ICT outsourcing

On 17 February 2023, the Commission de Surveillance du Secteur Financier (CSSF) issued a press release, informing about the publication of a new notification template to be used as of 20 February 2023 by In-Scope Entities in order to notify the CSSF of critical or important information and communications technology (ICT) outsourcing arrangements, in accordance with points 59 and 60 of Circular CSSF 22/806 on outsourcing arrangements.
This new template replaces the previous template (Notification for outsourcing of material IT activities). Specific attention has been paid to align the terminology and structure of the template to Circular CSSF 22/806. The notification periods and communication channels remain unchanged by this change.
In order not to penalise In-Scope Entities (ISEs) that are well advanced in the preparation of a notification based on the previous template, ISEs may introduce notifications using the previous template during a transitional period until 20 March 2023. After this date only notifications received with the new template will be considered as notified in line with the instructions and forms available in accordance with point 59 of Circular CSSF 22/806.
As a reminder, according to points 59 and 60 of Circular CSSF 22/806 on outsourcing arrangements ISEs shall notify the competent authority in advance in the following cases of outsourcing of a critical or important function:
a) planned, new critical or important outsourcing arrangements;
b) material changes to existing critical or important outsourcing arrangements; and
c) changes to outsourcing arrangements that lead to an outsourced function becoming critical or important.
In-scope entities shall fill this notification template to notify the CSSF of a critical or important information technology outsourcing (ITO). The template shall be submitted in two formats, one PDF version duly signed by the authorised management, and one in editable MS Word format, via e-mail or secure communication channel to the CSSF agent in charge of the supervision of the in-scope entity. In the case (a) above, the prior notification shall be done by the in-scope entity as early as possible before the planned implementation date of the outsourcing project but, in any case, at least three months – or one month (when resorting to a Luxembourg support PFS) – before this date. In the cases (b) and (c) above, the notification shall be done by the in-scope entity without undue delay. Any outsourcing arrangement which has not been notified within the above notification period and/or without using this template and these instructions will be considered as being not notified. The same applies in case of incomplete notifications.