CySEC stipulates in the Circular that it has already adopted these Guidelines. It reiterates that the Guidelines specify the internal governance arrangements, including sound risk management, that CIFs should implement when they outsource functions, in particular regarding the outsourcing of critical or important functions.

In the Circular, CySEC requires that CIFs:

• Review and amend accordingly any existing outsourcing arrangements, ensuring that these are in line with the Guidelines. Where the review and amendment of outsourcing arrangements of critical or important functions is not finalised by 30 June 2024, CIFs must inform CySEC accordingly via CySEC’s portal, including on the measures planned to complete the review/amendment or the possible exit strategy.
• Complete the documentation (Section 11 of the Guidelines) of all existing outsourcing arrangements, other than for outsourcing arrangements to cloud service providers, in line with the Guidelines following the first renewal date of each existing outsourcing arrangement by no later than by 30 June 2024.

For more information, CySEC’s Circular 604 can be found here.