On 27 March 2019, the CSSF issued a new Circular 19/714 (the “Circular”) in order to update its guidelines on the use of cloud computing infrastructure, as presented in its initial circular (the “Cloud Circular”) 17/654.
Inclusion of investment fund managers
The Circular now explicitly provides that all investment fund managers subject to Circular CSSF 18/698 on the authorization and organization of investment fund managers incorporated under Luxembourg law must comply with the requirements of the Cloud Circular.
The obligations that investment fund managers must now comply with are not new, insofar as they are a mere extension of the obligations already applicable to credit institutions, professionals of the financial sector as well as payment institutions and electronic money institutions.
The main changes to the current obligations are:
Entry into force
The various new obligations are “applicable with immediate effect” to investment fund managers, safe for the obligation to establish the cloud computing outsourcing register which is delayed to 12 months from the entry into force of the Circular.
Any necessary action under the Circular should be swiftly implemented by investment fund managers falling under the scope of circular CSSF 18/698.