Global Trustee and Fiduciary Services Bite-Sized Issue 10 2026

7 AIFMD CRYPTOASSETS FINTECH FUND LIQUIDITY OPERATIONAL RESILIENCE SUSTAINABLE FINANCE/ ESG T+1 ASIA PACIFIC EUROPE NORTH AMERICA UNITED KINGDOM Global Trustee and Fiduciary Services Bite-Sized | Issue 10 | 2026 Quick Links The AFM says the study identifies four key areas through which asset managers can further strengthen their IT recovery. 1. Consistent classification of critical functions A clear and consistent classification of critical functions forms the foundation for effective IT recovery. Different definitions or classifications within an organization can result in recovery measures that do not always align with the functions that are most important for service delivery. 2. Establishing recovery objectives for critical functions Recovery objectives are often established for systems or applications. Establishing them for critical functions as well provides a clearer picture of what is needed to restore service in a timely manner following a disruption. 3. Include recovery requirements in agreements with IT service providers Many asset managers rely on external IT service providers. Therefore, it is important that agreements with suppliers align with the institution’s recovery objectives. This better ensures that external parties can contribute to the desired level of recovery. 4. Testing with various extreme scenarios Regular testing helps determine whether recovery measures work in practice. It is important to use a variety of scenarios, including severe disruptions such as cyberattacks, prolonged system outages, or issues with an external IT service provider. Link to ICT Recovery in the Asset Management Sector here Operational Guidance for Incident Handling On 28 September 2026, the CSSF announced the publication of a set of rulebooks related to operational guidance for incident handling, developed by a team of cyber security experts from government and regulatory bodies. The CSSF says the rulebooks provide practical, step-by-step guidance for handling specific types of cybersecurity incidents. Each rulebook addresses a particular incident scenario and structures the response across the main stages of incident handling. Depending on the type of incident, the guidance covers: • Typical initial detection, including common signs, alerts and indicators that may reveal an incident; • Immediate response and containment measures to limit the impact and prevent further compromise; • Investigation steps to assess the scope, origin and consequences of the incident; • Remediation measures to address the causes of the incident and restore a secure environment; • Evidence keeping, including relevant information and technical artefacts that should be preserved; • Post-incident activities to reduce the likelihood or impact of similar incidents in the future; • Communication measures, including communication with affected users, management or other relevant parties; and • Key watchpoints highlighting specific risks or issues requiring particular attention. The CSSF says the rulebooks are designed as practical reference guides that can be consulted during an incident, enabling technical and incident response teams to quickly identify relevant actions and measures for the specific situation they are facing. Link to the Rulebooks here