As a leading global financial center, Luxembourg has enabled, during the last years, many initiatives aimed at fostering and developing AI solutions for the financial services industry. Those inputs came from both the government and well-established private and institutional actors such as the University of Luxembourg and other representatives from the finance, banking and legal sectors. More notably, the Luxembourg supervisory authority of the financial sector, the Commission de Surveillance du Secteur Financier ("CSSF") monitors how artificial intelligence solutions are likely to affect the financial sector in Luxembourg. In close collaboration with actors from the Luxembourg financial sector, the CSSF intends to anticipate and address forthcoming challenges, which the financial services sector may have to deal with in Luxembourg.

1. A government Driven and Ambitious Strategy on Artificial Intelligence

In 2019, the Luxembourg government launched its strategy on AI with the ambition "to be among the most advanced digital societies in the world, especially in the European Union. The strategy paper recognizes Luxembourg lacks "the critical mass to harvest the opportunities of large-scale datasets", except for the financial services sector.

2. An Innovation Hub Established by the Regulator

In February 2021, the CSSF published a paper aiming at "further describing the involvement and the work of the CSSF regarding the Financial Innovation". In the paper, the CSSF states that the "integration of technological innovation in financial services and markets is a continuing challenge for regulators such as the CSSF." While calling for a "constructive and open dialogue", the CSSF explains that it follows three main principles towards innovation in financial services, including AI:

  • a proactive open regulatory approach;
  • a prudent risk-based regulatory approach;
  • a technology neutral approach.

The above-mentioned paper refers to a research study from the CSSF published in December 2018 in the form of a white paper (without any binding effect for supervised entities) specifically addressing the topic of AI. According to the CSSF, this white paper "provides the foundations for a constructive dialogue with all the stakeholders of the financial sector for a deeper understanding of the practical implementations of AI technology and its implications."

This white paper is published in the following context outlined by the CSSF: "Today, AI is one of the most promising technologies, and different kinds of practical applications, especially in the financial sector, are emerging. This topic attracts a lot of attention, but at the same time, there is still a sense of ambiguity about what kind of technology is hidden behind this term. The potential benefits that AI can bring are enormous, but these can only be achieved if the fundamentals of this technology and its underlying risks are well understood and an adequate control framework is put in place." That is why the research study aims at better understanding what AI is and the related risks. It also provides some practical use cases for the financial sector. Finally, the research study provides some key recommendations to consider when implementing AI.

3. General Rules Remain Applicable for the Moment

Currently, there is no specific national Luxembourg law or regulation in force specifically relating to the use of AI in the financial industry, with the exception of high-frequency algorithmic trading rules, which are however not specific to Luxembourg as they derive from MiFID II. However, financial institutions remain responsible for the services they provide, whatever technology they use. Regulated financial institutions that wish to outsource

all or part of the AI solution they wish to rely on to third party service providers, equally remain liable for the service towards their clients. General outsourcing rules will apply in this case and the CSSF will review the AI solution when reviewing the IT outsourcing notification. However, no specific rules or constraints in relation to AI apply to this review.

Notwithstanding the above, while certain AI services are not specifically regulated, they could nonetheless fall within the scope of the CSSF's supervision when provided by regulated entities to their clients. Notably, Luxembourg requires service providers providing certain IT services to be authorized by and under the supervision of the CSSF in accordance with Article 29-3 of the Law of 5 April 1993 on the financial sector, as amended. This article establishes a specific license of "IT systems and communication networks operators of the financial sector" for professionals who are responsible for the operation of IT systems and communication of regulated entities of the financial sector (e.g., for credit institutions, payment institutions, electronic money institutions, investment firms). Whenever the offer of such IT service providers relies on artificial intelligence, the artificial intelligence systems will then be under the scope of CSSF's general supervision of the relevant regulated activities.

Originally published by Covington.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.