On 10 May 2017, NautaDutilh Luxembourg hosted a breakfast meeting on recent and upcoming legal changes affecting IT outsourcing in the financial sector. The seminar took place at the Sofitel in Kirchberg and drew a diverse crowd, including representatives of Luxembourg’s key banks, IT service providers, and audit and corporate services firms.
Technology and IP Partner Vincent Wellens and his team, associates Carmen Schellekens and Barbara Giroud, as well as Banking & Finance Counsel Jad Nader delved into various topics including the new statutory outsourcing exception to bank secrecy, the prudential principles of central administration and internal governance, the impact of the new General Data Protection Regulation, which will enter into force in less than a year's time, the new Luxembourg financial regulatory framework for outsourcing, and the introduction of specific rules applicable to cloud services.
On 17 May 2017, the CSSF published four circulars intended to streamline the rules on outsourcing in the financial sector. The circulars provide for a detailed framework under which financial service providers may outsource activities, in particular IT-related services, without violating the principles of central administration and sound governance. The new framework answers the growing demand from financial institutions to outsource activities, especially in the field of IT, and offers more possibilities to do so, including the use of cloud services. However, it should be noted that where outsourcing is possible, strict conditions and CSSF oversight continue to apply.
The seminar concluded with a series of best practices and key takeaways, guiding the audience through the main practical and legal questions to consider when implementing outsourcing projects and drafting contracts.
Feedback was very positive and participants indicated their interest in attending similar events in the future.