Application of EIOPA guidelines on outsourcing to cloud service providers by insurers and reinsurers

On 24 April 2020 the European Insurance and Occupational Pensions Authority (EIOPA) issued new guidelines on outsourcing to cloud service providers which apply to insurers and reinsurers. The guidelines supplement the general regulatory framework based on the EU Solvency II Directive and EU Delegated Regulation 2015/35.(1)

Pursuant to Article 16(3) of EU Regulation 1094/2010 establishing the EIOPA, which requires the competent authorities of EU member states to make every effort to comply with EIOPA guidelines and confirm that they intend to do so, the Benelux regulators have indicated their intention to apply the guidelines.

In Luxembourg, the supervisory authority for the insurance sector, the Insurance Commission (CAA), confirmed in Circular 20/13 of 24 June 2020 that it will apply the guidelines in full. Therefore, Luxembourg insurers and reinsurers must abide by the guidelines. The CAA also highlighted that outsourcing operations must comply with the obligation of professional secrecy set out in Article 300 of the amended Act of 7 December 2015 on the insurance sector.

Endnotes

(1) Further information on the scope, requirements and timeline for implementing the guidelines is available here.