Outsourcing: What’s New for Banks?

In April 2022, the Luxembourg Financial Sector Supervisory Commission (CSSF) published Circular 22/806, aimed at providing greater clarity on the rules governing the outsourcing of certain functions.

Outsourcing has become increasingly common in the financial sector in recent years. The pandemic has further accelerated demand for digitalisation among financial professionals. As not all companies have the necessary expertise in-house, many have turned to external service providers to meet these needs. “There are several reasons for outsourcing: economies of scale, cost reduction, increasingly complex regulations, difficulties in recruiting qualified staff and the need to enhance expertise,” explains Anne-Marie Ka, Senior Counsel at Brucher Thieltgen & Partners.

The CSSF defines outsourcing very broadly as any process, service or activity that would otherwise be performed by the entity itself. The functions most commonly concerned include IT and support services, commercial and marketing activities, and administrative management services. “Outsourcing may take place through external service providers, but also within a company’s own organisational structure. While it offers numerous advantages, it also entails certain risks. Companies may lose some control over the outsourced activity. Questions relating to internal expertise and logistics may also arise when outsourcing becomes excessive. The key is to strike the right balance.”

Clarifying Outsourcing Rules

Until then, several sets of rules applied to supervised entities. Both the European Banking Authority (EBA) and the European Securities and Markets Authority (ESMA) had issued European guidelines governing outsourcing by financial institutions, investment firms and the use of cloud computing services. “These European guidelines, together with the various CSSF circulars governing outsourcing, could create some confusion, particularly regarding their respective scopes of application. The new Circular 22/806 helps clarify which rules now apply.”

Indeed, the circular introduces significant changes. In particular, it incorporates European standards into Luxembourg’s regulatory framework to ensure that financial sector entities are subject to a consistent set of rules. “Luxembourg’s outsourcing rules are now consolidated into a single document. Their scope of application has also been extended. Previously, the guidelines applied to a relatively limited group of entities, including credit institutions, payment institutions, electronic money institutions and certain investment firms. The new framework also covers investment funds, their managers and other market participants when outsourcing information and communication technology (ICT) services.”

The circular also introduces requirements specific to Luxembourg. Given the significant number of subsidiaries operating in the country, intra-group outsourcing agreements must also comply with the new rules.

However, not all functions may be outsourced. Restrictions apply to audit and internal control functions, for which only operational tasks may be outsourced. Furthermore, access rights must be guaranteed to the regulator (CSSF), supervisory bodies and auditors to ensure effective oversight of outsourced activities.

Avoiding Interpretation Issues

While some companies took a cautious approach and ensured compliance before the new requirements became applicable, others still needed to follow suit. “These companies will have to assess their current situation and, where necessary, implement internal policies and amend their existing contracts. Future agreements will also have to reflect the new regulatory requirements. This means that renegotiations with service providers may be necessary.”

The circular applies from 30 June 2022 to all outsourcing agreements entered into, reviewed or amended on or after that date. Although no specific timetable was provided, companies were advised to review their critical or important outsourcing arrangements before 31 December 2022. “If compliance cannot be achieved by that date, the CSSF must be informed. We assist our clients in reviewing their internal policies, as well as their existing and future contracts. We also provide support with notifications to the CSSF to ensure that the documentation submitted complies with the applicable requirements.”

Anne-Marie Ka, Partner : anne-marie.ka@btplawyers.lu