The long-awaited circular for financial institutions operating
in Luxembourg and leveraging cloud services1 has been
released by Luxembourg's financial authority, the CSSF.
The circular will change the landscape of cloud services in
Luxembourg, as from now on cloud service providers (IaaS, SaaS, and
PaaS) will not have to be regulated by the CSSF anymore, nor will
their data have to be hosted in Luxembourg (as long as the client
provides consent). The new directive additionally provides clear
guidelines for organizations that are considering cloud services as
part of their IT supply chain. The guidelines could be summarized
as honoring one prime goal: stronger governance.
Both business and IT stakeholders should welcome these new
clarifications on the key roles and responsibilities for the
different actors of a cloud delivery model. For too long, cloud
services have been contracted too easily by some organizations,
without an appropriate governance framework,
