New rules on outsourcing in the Luxembourg insurance sector

On 19 August 2022, the Luxembourg Commissariat aux Assurances (CAA) published Circular 22/16 (available only in French) concerning the requirements when outsourcing "important operational activities" to third parties.

The Circular also contains information on the applicable outsourcing notification procedure to the CAA.

The Circular clarifies Article 81 of the amended Law of 7 December 2015¹ on the insurance sector (the Law), which provides that outsourcing of important or critical activities should not undermine the quality of an undertaking's governance system, nor unduly increase operational risk, or impede the CAA's ability to check the entity's compliance.

Who does this affect?

The CAA requires all in-scope entities, notably insurance and reassurance providers, to conduct an assessment prior to outsourcing critical operational activities, by evaluating the risks of the outsourcing agreement and by ensuring the compliance of the agreement with the regulatory framework. All Luxembourgish insurance and reassurance undertakings fall within scope of Article 81, along with their branches abroad and undertakings from third countries having a branch in Luxembourg (see Article 33 of the Law).

What is required?

Before any activities can be outsourced, the in-scope entity has to evaluate if any of the outsourced activities or functions are operationally important or critical or can become so in the future. If the activities or functions are deemed to be important or critical, a notification to the CAA is required.

What does 'important or critical' mean in this context?

The CAA provides a number of reference points to determine if an activity or function can be qualified as important or critical, notably if an insurance provider is unable to provide its services to policyholders without this function or activity. Further, insurance undertakings should also consider the impact that the outsourcing of the activity has on internal control and supervision mechanisms and on the reputation of the company. Key functions, such as risk-management, actuarial, compliance and internal audit, as defined by the Solvency 2 Directive should always be considered as important or critical.

With regards to the professional secrecy as provided for by the Law on the Insurance Sector, the CAA reminds entities that are subject to Article 300 of the Law and that plan to outsource activities containing personal data of policyholders to carefully evaluate if special consent by the policyholders is required and if sufficient measures have been put into place to protect their personal data.

What needs to be notified

All outsourcing of critical or important activities, all outsourcing of key functions as defined by Solvency 2 and any significant evolution in regards to the activities or functions are subject to prior notification to the CAA is. The notification requirement does not apply to any outsourcing of pure IT infrastructure such as cloud computing.

Excluded from the notification requirement is the use of intermediaries for the distribution of insurance products, however, the conclusion of insurance policies and the settlement of claims via an intermediary can be considered in scope of the Circular if the activity is deemed critical or important.

When to notify

The CAA has to be notified of the outsourcing of an activity

• before the conclusion of any outsourcing contract and

• at least one month before the activity is outsourced

via a form available on the CAA website.

The new rules are applicable as of 1 November 2022 to all outsourcing agreements concluded or modified after that date.

For more information, please click here.

¹ Please note that the linked document is an unofficial translation of the consolidated Law, intended for information purposes only and may not reflect all changes to the law.