Determine whether an outsourced function is critical or important under Circular CSSF 22/806 (as amended by Circular CSSF 25/883), points 15–20 — and reconcile every conclusion point-per-point against the circular, down to the lettered sub-points. Companion tool: the Risk Assessment (points 66–70).
These fields populate the memo header and the register dates (points 54(i) and 55(c)).
Confirm the arrangement is in scope of the circular and is outsourcing at all, before assessing criticality. Wrong-scope arrangements get a useful conclusion, not a dead end — and ICT/cloud arrangements adjust the assessment and its outputs.
Answer every question above (including the cloud details if cloud applies) and resolve any routing card to continue.
Rule-based, no scoring. The circular says the function shall always be considered critical or important in these situations. Any YES makes the determination — the point 20 factors then only complete the record. Document the basis for each answer, Yes or No: the "No" needs evidence as much as the "Yes".
Answer every trigger shown to continue.
Any factor rated High → suggest critical or important. Otherwise, this many Medium ratings also suggest it (borderline):
Rate every factor (rationale required for High and Medium), and complete the register inputs above.
Select the final determination (with a judgment note if it departs from the suggestion).
Edit freely, then paste into your register (or the IddiLabs Outsourcing Register).
| Obligation | Anchor |
|---|
Trace every relevant circular point — including the lettered and numbered sub-points — to where this assessment addressed it, and see honestly what sits outside this tool.
| Point | Requirement (paraphrased) | Status · where |
|---|
The AI extract is a self-describing copy of the whole assessment: every question, anchor, answer and rationale, plus the computation rules and caveats — ready to paste into Claude, Copilot or any model, or to archive. The JSON version embeds the raw state, so Load working file re-imports it later for the periodic update; Markdown is the paste-into-a-chat version. Data-classification note: pasting the extract into an external AI transfers the data to that provider.
Run the Risk Assessment (points 66–70) and the Due Diligence (points 71–75) companions if not done · check the contract with the Contract Clause Gap Checker · log the arrangement in the Outsourcing Register.