Circular CSSF Cloud Computing: Fewer Constraints, New Opportunities
It is with a text of fewer than 20 pages that the Financial Sector Supervisory Commission (CSSF) has, according to observers, revolutionized the ICT context in Luxembourg. The 17/654 Cloud Computing Circular proposed at the end of May 2017 defines the framework within which a company can outsource services based on a cloud computing infrastructure that is no longer necessary based in Luxembourg.
Three actors are mainly concerned by this change. What impacts can we anticipate for companies monitored by the CSSF? Will the profession of financial sector professionals (PSF) change? And what about the job of Luxemburg cloud operators? Let’s take stock of the changes that are emerging.
Companies monitored by the CSSF: the lifting of constraints
These companies are facing new choices. Under certain conditions, they can now locate their data wherever they want in Europe. If they use a PSF operator, it is up to him to ensure that the Cloud service and the way it is managed to comply with the CSSF standards. The bodies monitored (named ESCR in the circular) must request prior authorization from the CSSF to use a subcontractor that operates on a cloud infrastructure.
If a monitored company decides to operate itself in the cloud, it must appoint a Cloud Officer who ensures that the outsourcing operator does not derogate from the circular.
Thus, the regulatory burden on the financial sector remains substantially the same while the management possibilities of their systems diversify considerably.
Professionals in the financial service: opportunities multiplied
For professionals in the financial sector who can adapt to this change, opportunities are multiplied. They continue to ensure that the systems they operate on behalf of the monitored bodies are always in compliance with the CSSF regulations. But, they can deliver their services on a range of greatly enriched cloud platforms. In addition to the various national cloud operators, they can exercise their business with large generalist Clouds (Amazon, Google, IBM, and Microsoft). However, they must ensure that these cloud operators are based in a European Union country and that they comply with Luxembourg law.
Beyond a simple platform choice, PSF operators now have the opportunity to deliver their expertise in financial services across Europe. Take the example of a large European bank based in Luxembourg. Thanks to the new circular, it will be able to choose a PSF provider to operate the systems of all its subsidiaries, without having to repatriate all the data to Luxembourg.
Cloud operators: a clarified role but the need to differentiate in the face of competition
Luxemburg cloud operators will now compete with actors with disproportionate means. At first glance, this change can be considered a risk. But to look closely, the circular presents a major step forward: that of clarifying the roles of each. Luxembourg operators are now on a level playing field with the international competition. This will likely encourage players to specialize in cutting-edge financial services delivered in the cloud to distinguish themselves from a competition that has already won the price war.
A circular that is unanimous
It can be considered that the regulatory pressure on companies complicates their daily work. However, it is the opposite effect that the CSSF circular aims at a simplification and a lifting of the constraints.
It clarifies the concept of Cloud Computing (who needed it) and the different ways to deliver it. It defines the role of the various players while opening up new markets for Luxembourg professionals. For companies prepared for this new context, opportunities are numerous.Tags: Cloud computing