Recent developments in IT outsourcing

In May 2017, the CSSF published several circulars on IT outsourcing, among which the three following circulars bring new requirements:

• Circular 17/654 on cloud computing, which intends to clarify the regulatory framework for recourse to cloud computing infrastructure supplied by an external service provider
• Circular 17/655, which updates requirements on outsourcing for credit institutions and investment firms (it actually updates Circular 12/552 on central administration, internal governance and risk management), and
• Circular 17/656, which repeals Circular 05/178 and harmonises the requirements on outsourcing across the financial sector (i.e. resulting in an alignment between requirements for investment firms, specialised PSF and support PSF)

Developments in IT outsourcing

The developments in IT outsourcing brought by these circulars can be summarized as follows:

• Preparing for bill of law 7024
• Allowing IT systems management/operations to be outsourced to any IT provider abroad
  
• Increasing requirements on confidentiality and integrity of data and systems
  
• Defining the detailed requirements under which institutions supervised by the CSSF may recourse to (or offer) cloud computing solutions
  

Opportunities and threats of cloud computing

The circular on cloud computing will allow institutions supervised by the CSSF to use cloud solutions of global leaders such as Amazon Web Services, Microsoft Azure, or Google Cloud Platform. This could bring stiff competition to the local IT outsourcing market led by Support PSF. Indeed, these global cloud solutions are well known for their ease of use, flexibility, scalability, and of course, for their cost effectiveness (provided they are consumed optimally).