CSSF Circular on teleworking: governance and security requirements applicable as of 30 September 2021

14 Apr 2021


Dorothée David

On 9 April 2021, Luxembourg’s financial supervisory authority (CSSF) published CSSF Circular 21/769 (in English) relating to governance and security requirements  for Supervised entities to perform tasks or activities through Telework.

The Circular is intended to apply under normal general working conditions and not within the context of the Covid-19 pandemic. Subject to that proviso, the Circular will come into force on 30 September 2021.

The Circular points out that the introduction of teleworking in the financial sector does not require the CSSF’s approval. The purpose of the Circular is to define the requirements associated with organisation, internal controls and information security with which entities supervised by the CSSF must comply when they introduce teleworking solutions for their employees.

The Circular does not cover contractual relationships between supervised entities and their employees, which continue to be governed in particular by the Convention of 20 October 2020 on the legal framework for teleworking (see our Newsflash of 1 February 2021).