AGEFI Luxembourg - mai 2025

Mai 2025 27 AGEFI Luxembourg Fonds d’investissement O n 9April 2025, theCSSF pub- lishedCirculars 25/881, 25/882, and 25/883, accompaniedby a clarifying communiqué . These develop- ments have drawn considerable atten- tion across Luxembourg’s financial sec- tor for their impact on information and communication technology (ICT) risk management, DORA imple- mentation, and third-party oversight. Collectively, they represent a substantial step toward regulatory coherence and stronger digi- tal resilience. A central concern for leadership teams across investment funds and their managers, banks and payment service providers (PSPs) has been the scale and impact of the resulting compliance changes. True to its rep- utation, the CSSF has sought to simplify imple- mentation rather than complicate it — this latest regulatory update is no exception. Circular CSSF 25/881: Refining ICTRiskRequirements Tobeginwith,Circular25/881amendsCircular20/750 by narrowing its scope. Previously, Circular 20/750 appliedtoawiderangeoffinancialentities,including PSPs. The updated version removes PSPs from its remit, as they are now covered under the newly issued Circular 25/880. As amended, Circular 20/750 now applies only to entities outside DORA’s scope and not classified as PSPs. While Circular 20/750 served as a foundational framework, Circular 25/881 buildsonitwithmoretargetedapplicabilityandalign- mentwithDORA’s regulatory architecture. Circular CSSF 25/882: Governing ICTThird-Party Services underDORA Circular 25/882 introduces comprehensive require- ments for financial entities subject to DORA, specifi- cally concerning their use of ICT third-party service providers. Importantly, the circular expands regula- tory coverage: all ICT third parties — regardless of whether their services qualify as outsourcing — are nowwithintheCircular’sscope.Incomparison,under Circular 22/806, outsourcing was defined as any arrangement in which a third-party provider per- forms a function thatwouldotherwise be carriedout by the regulated entity itself. Not all third-party arrangementswerepreviouslyconsidered“outsourc- ing.”ThisdistinctionnolongerappliestoICTservices underDORA.Asaresult,fromnowon,theterm“ICT services” would broadly include all services encom- passing digital and data services provided through ICT systems on anongoing basis. The Circular also offers practical instructions on the submission of certain information and reporting in relation to the use of ICT third-party providers, including: - Notification: Entities must notify the CSSF at least three months before entering into ICT-related con- tractual arrangements — except for contracts with Luxembourg-based support professionals of the financial sector (PFS), where the notice period is reduced to onemonth. - Register of Information: Firms must maintain and annually submit a Register of Information at entity, sub-consolidated, and consolidated levels. Registers for a calendar yearmust cover all arrangements con- cluded by year-end and be submitted between 28 February and31Marchof the followingyear. For the first reporting cycle (2025), the register must include allarrangementsupto31March2025andbesubmit- tedbetween 1April and 31May 2025. - Cloud Services: The Circular consolidates various definitions from earlier guidance and introduces the mandatory designation of a CloudOfficer, responsi- ble for overseeingcloudservicegovernance,whether hosted internally or managed by third-party providers via a client interface. Circular CSSF 25/883: Updating the Framework forOutsourcing Circular25/883amendsCircular22/806,clarifyingthe split between ICT and non-ICT outsourcing. Under the newapproach: - Part I ofCircular 22/806 applies only tooutsourcing arrangements that do not involve ICT -DORA applies toall ICTservices fromthirdparties, regardlessofwhethertheymeettheformaldefinition of outsourcing. Exceptions include: -InvestmentFundManagers(IFMs)authorizedsolely underArticle 125-1 of Chapter 16 of theUCI Law, for which Circular 22/806 continues to apply fully, even for ICToutsourcing. -EntitiesnotsubjecttoDORAbutcoveredbyCircular 22/806,forwhichbothPartsIandIIofCircular22/806 remain applicable. Investment FundManagers: NavigatingDual RegulatoryTracks For Investment Fund Managers (IFMs), the path to compliance is not merely procedural— it is strategic and high-stakes. While the new Circulars usher in transformative change, Circular 18/698, and its antic- ipatedrevision,remainsfirmlyinforce,creatingalay- eredanddemandingregulatory landscape that IFMs must nownavigatewithprecision. In this evolving regime, IFMs find themselves at the intersectionoflegacyrulesandforward-lookingman- dates. Circulars 25/882 and 25/883 must be read in conjunctionwith18/698—anexercisethatisfarfrom academic. The stakes are real: regulatory missteps could expose firms to supervisory scrutiny and rep- utationaldamage.Torespondeffectively,IFMsmust rise to the occasion by: - Conducting rigorous due diligence on ICT third- party providers, ensuring alignment not only with DORAbut alsowith the elevated expectations of the CSSF. - Drafting bulletproof contracts that embedDORA- compliant provisions, reflect an acute awareness of criticality, risk, andoversight. - Diligently maintaining the DORA Register of Information , leaving no room for omission when reporting ICT third-party arrangements. Practicallyspeaking,forexample,aLuxembourgIFM, whendelegatingtheportfoliomanagementfunction, must ensure compliance with CSSF Circulars 18/698 and25/883,andwouldapproachkeythird-partyrelat- ed activities as follows: -AssessmentofCritical/ImportantFunctions would beacommonassessmentencompassingallfunctions leveraging third-party services. -Duediligenceandclauseslistedinthird-partycon- tracts, forallICTservices(e.g.,useofmarketinforma- tion service such as Bloomberg or ThomsonReuters, transactionprocessingservices suchas SWIFTor any cloud-based applications) and outsourcing not con- cerningICT(e.g.,payrollmanagementservicesorHR services)wouldbeacommonsetofduediligencecri- teria – that alignswithDORAandCircular 22/806 as amendedby25/883.Non-ICTservices,underCircular 18/698, e.g., PortfolioManagement, that do not come underoutsourcingwouldhavetobebasedontopical set of due diligence criteria. -Broadly,intermsof Registers ,allICTservices–beit cloud-basedaccountingsoftware,portfolio/fundman- agement tools such as Yardi, eFront or Aladdin and market information services would all be listed in DORA’s Register of Information . While any non-ICT service be it a non-ICT outsourcing service under 25/883 or a non-ICT service under 18/698 would be listed under the Outsourcing Register detailed in Circular 22/806 as amendedby 25/883. - Other key deliverables such as Exit Plans and Risk Assessments couldbecreatedinamannerthatjointly applies toCirculars 18/698 and 25/883. Crucially, for all non-ICT third-party engagements, IFMs cannot lose sight of their obligations under Circular18/698.Thesearrangementsmuststillunder- go careful vetting and be documented in the OutsourcingRegister—anenduringtestamenttothe dual compliance tracks IFMsmust nowmaster. All circulars emphasize the need to assess “critical or important”functions,establishexitstrategies,andcon- duct risk assessments for all third-party service rela- tionships.TheCSSF’supdatedregulatoryframework ensuresgreaterconsistency,clarity,andpreparedness in managing third-party and digital risks across Luxembourg’s financial sector. Complementing theCirculars To complement the Circulars, the CSSF issued a Communiqué clarifying two additional keys points: - Support PFS firms offering services such as IT sys- temssupport,communicationnetworkser- vices, dematerialization, and archiving now fall withinDORA’s scope. -Twodistinctnotificationformshavebeen introduced – one for ICT third-party arrangementssupportingcriticalorimpor- tant functions under DORA; and another for ICT outsourcing by entities not subject to DORA. Conclusion:ANew Chapter inRisk Governance The release of Circulars 25/881, 25/882, and 25/883 — together with the communiqué —marks awatershedmomentintheevo- lution of Luxembourg’s regulato- ry landscape for digital operational resilienceandthird-partyriskmanagement.These measures are not simply regulatory adjustments. They represent a strategic consolidation of frame- works to ensure clarity, consistency, and alignment with European standards such as DORA. The key to an operationally efficient third-party/delegation oversight framework aligned to the newCirculars is to find synergies between the requirements for the individualframeworkcomponentsoftheseCirculars with those of Circular 18/698. Developing an inte- gratedapproachtooversightframeworkdeliverables such as registers, due diligence, contractual clauses, governancecontrols,exitplans,riskassessmentsand policies serves as its cornerstone. This avoids dupli- cation of activities that are needed to comply with themultiple layers of related regulation. TheCSSF’s approachdemonstrates its ongoingcom- mitment to providing clarity and helping financial institutions navigate complex compliance expecta- tionswithoutunnecessaryburden.Entitiesmustnow shift their focus from interpretation to execution — establishing robust internal governance structures, clearlydelineatingICTandnon-ICToutsourcing,and embeddingtheupdatednotificationandrecord-keep- ing requirements intoday-to-day operations. Forfirmsacrossthespectrum—fromPSPsandIFMs to banks and investment entities — the message is clear:digitalresilienceisnolongerjustatechnicalcon- cern, but a core element of strategic and operational soundness.Withthetoolsandguidancenowinplace, the responsibility lies with firms to take a proactive, structured, and forward-looking approach to third- party and ICT risk oversight in the years ahead. Jens SCHMIDT Partner, Wealth and Asset Management Consulting Leader Johann LOBO Senior Manager, IT Regulation, Technology Risk EY Luxembourg How Investment Fund Managers Can Seamlessly Align Digital Resilience with Delegation Oversight DASHBOARD AGEFI Luxembourg 30-Apr-2025 31-Dec-2024 DIFF % Dow 30 (DJI) 40.669,36 42.544,22 -4,41% S&P 500 (GSPC) 5.569,06 5.881,63 -5,31% Euro Stoxx 50 5.160,22 4.869,28 5,98% DAX (GDAXI) 22.496,98 19.909,14 13,00% CAC 40 (FCHI) 7.593,87 7.380,74 2,89% FTSE 100 (FTSE) 8.462,77 8.173,00 3,55% LuxX index 1.459,14 1.303,91 11,90% Nikkei 225 (N225) 36.045,38 39.894,54 -9,65% Shanghai (SHCOMP) 3.279,03 3.351,76 -2,17% US Fed Funds Rate 4,33% 4,48% -0,15% 3 Month US Treasury Rate 4,31% 4,37% -0,06% 5 Year US Treasury Rate 3,72% 4,38% -0,66% European Central Bank (ECB) Refinancing Rate 2,40% 3,15% -0,75% 5-Year Eurozone Central Government Bond 2,36% 2,49% -0,13% Barrel (West Texas Intermediate) 0,3219 0,4088 -21,24% ǧ West Texas Intermediate (prix en euro par litre) Natural gas: 1 m3= 0,1036 0,1228 -15,63% ǧ Natural Gas, Henry Hub-I (prix en euro par m3) Natural gas: 1MWh= 9,99 11,84 -15,63% ǧ Natural Gas, Henry Hub-I (prix en euro par MWh) Natural gas: 1 MMbtu= 3,33 3,83 -13,05% $ Natural Gas, Henry Hub-I (prix en $ par MMbtu) Gold: 1 Kg= 91.386,09 76.453,87 19,53% ǧ Gold: 1 oz= 3.232,69 2.624,49 23,17% $ Silver: 1 Kg= 906,03 840,14 7,84% ǧ Silver: 1 oz= 32,05 28,84 11,13% $ Government Debt/GDP last previous trend Japan 216,2% Dec. 2024 217,2% Singapore 173,1% Dec. 2024 171,7% Greece 158,3% Sep. 2024 160,1% Italy 135,3% Dec. 2024 136,2% USA 123,4% Dec. 2024 122,3% Argentina 116,7% Dec. 2024 155,4% France 113,0% Dec. 2024 110,6% Canada 106,8% Dec. 2024 107,5% Senegal 105,7% Dec. 2024 99,7% Belgium 105,6% Sep. 2024 104,4% Spain 101,8% Dec. 2024 105,1% UK 98,8% Aug. 2024 100,0% Ukraine 95,4% Dec. 2024 84,4% Portugal 95,0% Dec. 2024 97,1% Egypt 90,4% Dec. 2024 95,8% Brazil 88,3% Dec. 2024 84,7% China 85,7% Dec. 2024 83,4% Austria 81,8% Dec. 2024 77,8% Finland 81,7% Dec. 2024 77,2% India 81,3% Dec. 2024 81,6% European Union 81,0% Dec. 2024 81,6% South Africa 74,2% Sep. 2024 72,2% Hungary 73,6% Dec. 2024 76,0% Morocco 69,5% Dec. 2023 71,5% Malaysia 69,4% Dec. 2024 69,8% Israel 69,0% Dec. 2024 61,3% Slovenia 67,0% Dec. 2024 69,4% Germany 62,7% Dec. 2024 62,7% Thailand 64,4% Mar. 2025 61,9% Slovakia 59,3% Dec. 2024 55,6% Iceland 59,1% Dec. 2024 62,0% Croatia 57,7% Dec. 2024 61,8% Norway 55,1% Dec. 2024 44,5% Nigeria 55,0% Jun. 2024 42,4% Poland 55,3% Apr. 2025 49,5% Romania 53,1% Dec. 2024 51,1% Mexico 47,7% Sep. 2024 48,1% Latvia 47,2% Sep. 2024 45,9% Serbia 47,2% Dec. 2024 48,0% Korea 46,8% Dec. 2024 45,5% New Zealand 44,3% Sep. 2024 41,9% Chile 44,0% Sep. 2024 40,9% Australia 43,8% Dec. 2024 42,8% Czechia 43,7% Sep. 2024 42,7% Netherlands 43,3% Dec. 2024 45,1% Ireland 40,9% Sep. 2024 43,3% Indonesia 38,8% Dec. 2024 39,2% Lithuania 38,2% Dec. 2024 37,3% Qatar 37,4% Dec. 2024 43,3% Sweden 33,5% Dec. 2024 31,6% Denmark 30,0% Dec. 2024 29,3% Taiwan 29,0% Dec. 2023 29,5% Saudi Arabia 28,7% Dec. 2024 26,3% Luxembourg 26,6% Sep. 2024 26,8% Turkiye 24,7% Dec. 2024 29,3% Estonia 23,6% Dec. 2024 20,2% Botswana 22,6% Dec. 2024 22,5% Switzerland 23,3% Dec. 2028 23,8% Bulgaria 24,1% Dec. 2024 23,1% Azerbaijan 21,2% Dec. 2024 21,9% Russia 16,4% Dec. 2024 16,7% Large differences may exist due to the definition of public debt (gross vs. net debt, government financial assets, etc.) Ce tableau de bord, une exclusivité d'AGEFI Luxembourg, permet au lecteur : 1° de voir les returns des principaux actifs et indices financiers pour l'année en cours / 2° de voir sur une page les principaux indices boursiers et taux d'intérêts / 3° de connaître le coût de production de plusieurs produits d'énergie en euro, à comparer avec le prix au détail / 4° de connaître le prix de l'or et de l'argent en kilo et en euros / 5° de voir immédiatement la dette publique/PIB pour plusieurs pays significatifs (tendance 2022) This dashboard, exclusive to AGEFI Luxembourg, allows the reader: 1° to see the returns of the main assets and financial indices for the current year / 2° to see on one page the main stock market indices and interest rates / 3° to know the production cost of several energy products in euros, to compare with the retail price / 4° to know the price of gold and silver in kilos and in euros. / 5° to immediately see the public date/GDP for several significant countries