CSSF Teleworking Circular 21/769

On 9 April 2021 the CSSF published a new Circular 21/769 on “Governance and security requirements for supervised entities to perform tasks or activities through Telework” (“Telework Circular”).

The Telework Circular does not apply under pandemic situations (such as Covid-19 pandemic) or in case of other exceptional circumstances having a comparable impact on the general working conditions.

Under the Telework Circular, all entities supervised by the CSSF and the branches of the Luxembourg regulated entities located abroad (“Supervised Entity”) will be required to have sufficient staff members at the premises to comply with central administration requirements. Notably, the amount of normal working time that individual staff members are allowed to telework, shall be limited. At least one authorised manager/conducting officer shall be on-site at the head office at all times and key functions shall be sufficiently represented every day at the premises.

CSSF approval will not be required for teleworking: it will be the responsibility of the Supervised Entities to assess whether its internal rules comply with the requirements of the Telework Circular (taking into account its size and organisation and the nature, scale and complexity of its activities).

The Supervised Entities shall identify all risks resulting from telework, as well as monitor and mitigate them. The internal controls functions (i.e. compliance and internal audit) shall also consider the telework situation in their missions.

The Supervised Entities will be required to establish a telework policy and to review and update existing policies and procedures to take into account telework. The practical implementation of the telework policy shall also be monitored and documented notably with a record disclosing the identity and function of staff allowed to telework. Staff of the Regulated Entities shall be trained with respect to teleworking. Furthermore, specific IT requirements mentioned in the Telework Circular must also be complied with by Supervised Entities in the context of telework (e.g. encryption).

Finally, additional requirements also apply from a labour law perspective notably further to the new agreement on telework signed on 20 October 2020 between the social partners LCGB, OGB-L and UEL, which was declared a general obligation by Grand Ducal Regulation of 22 January 2021 and which is now binding for all companies in Luxembourg.

The Telework Circular was due to apply from 30 September 2021, however, given that the coronavirus is still active, the CSSF has indicated that it will only apply as from the end of the pandemic, in accordance with Article 66 of the Telework Circular.