CSSF Circular 22/806 — Outsourcing arrangements
The single outsourcing framework, now applying to DORA entities for business process outsourcing only.
- Issued by
- CSSF
- Applies in
- Luxembourg
- Edition
- as amended 2025
- Area
- Operational resilience & ICT
What an assessor reads first.
The headline requirements in Amoreg’s catalogue, in the issuer’s own numbering where it has one. They are where a review starts, not a transcription of the text.
- CRITCriticality assessmentGovernance
- NOTPrior notification of critical outsourcing to the CSSFReporting
- CONContractual requirementsThird parties
- REGOutsourcing registerRecords
- EXITExit strategiesThird parties
How Amoreg keeps you on it.
Enable the CSSF Circular 22/806 — Outsourcing arrangements and the Monitor suggests CSSF as a source. Every publication it records keeps its source, stage and date.
Inspector reads your policies against these 5 requirements every week and opens a finding wherever one falls short, citing the rule and drafting the fix. A person decides what is applied.
Each week
- Read cssf.lu/en/news
- Check the library against 5 requirements
- Open findings with drafted fixes
- Wait for a person to decide
Policy does not yet set out: criticality assessment
- Rule
- CSSF Circular 22/806 — Outsourcing arrangements, CRIT
- Area
- Governance
- Proposed by
- Inspector
- Decided by
- A named person, once reviewed
The same ground, elsewhere.
- DORA — Digital Operational Resilience ActICT risk management, incident reporting, resilience testing and third-party risk for financial entities.European Union · 8 controls
- NIS2 DirectiveCybersecurity risk-management measures and incident reporting for essential and important entities.European Union · 4 controls
- UK Operational Resilience (FCA SYSC 15A / PRA SS1/21)Important business services, impact tolerances, mapping and scenario testing.United Kingdom · 5 controls
- UK Outsourcing & Third-Party Risk (SYSC 8 / PRA SS2/21)Requirements for outsourcing and third-party arrangements, including critical third parties.United Kingdom · 5 controls
- Central Bank of Ireland — Operational Resilience & Outsourcing GuidanceThe cross-industry guidance on operational resilience and on outsourcing.Ireland · 4 controls
- MAS Technology Risk Management GuidelinesTechnology risk governance, security, resilience and third-party expectations for financial institutions.Singapore · 5 controls
Also in Luxembourg
- Luxembourg AML Law of 12 November 2004 & CSSF Regulation 12-02The professional obligations under the 2004 Law and CSSF Regulation 12-02 for the financial sector and fund industry.Luxembourg · 6 controls
- CSSF Circular 20/750 — ICT and security risk managementEBA ICT and security risk guidelines applied to Luxembourg entities outside DORA's scope.Luxembourg · 5 controls
Questions
Does Amoreg watch for changes to the CSSF Circular 22/806 — Outsourcing arrangements?
Yes. Enable it and the Monitor suggests Commission de Surveillance du Secteur Financier as a source; every publication it records keeps its source, stage and date.
Can Amoreg check our policies against the CSSF Circular 22/806 — Outsourcing arrangements?
Yes. Inspector reads your library against its requirements every week and opens a finding, with the rule it cites and a proposed fix, wherever a policy falls short. A person decides what is applied.
Which edition does Amoreg use?
The catalogue records as amended 2025. Editions were last verified in August 2026, and the Monitor records new publications as they appear.