Courses/CSSF Readiness

Available now. Complete, all six modules published

CSSF Readiness: requests, inspections and observation letters

Where the CSSF's powers actually come from, what article 53 allows and what it does not, what an injunction obliges you to do and by when, how an on-site inspection runs from the annual plan through the fact validation meeting to the observation letter, what you owe through eDesk and when, what can be imposed on you, published about you and challenged by you, how to answer the letter and what happens inside a sanction procedure, and the obligations that catch entities out: ICT incident notification under DORA, thematic reviews and common supervisory actions, and the whistleblowing channel. There is no published circular describing the inspection procedure, so that part is assembled from the CSSF's own annual report and its published decisions.

List price 149 euros The price the course is sold at once enrolment has opened.

Founder price 99 euros Held for people who registered before enrolment opened. It is a lower price for the same course, not a smaller version of it.

Delivery Complete Available now and complete. All six modules are published in full, together with the end-of-course assessment. The delivery commitment was 15 October 2026; the course was delivered on 24 August 2026.

Access 12 months Access for 12 months from the date of enrolment, including every update published during that period. Updates are published under a dated content version, and the version you were trained against stays on your certificate.

Enrolment opens shortly

No payment is taken anywhere on this site and no card details are collected. Registering your interest costs nothing and commits you to nothing.

Content version: 23 August 2026

All six modules are open to read and watch in full while enrolment is being prepared. Lesson 1.1 needs nothing at all; the rest needs a free account.

Three courses are published today, all three complete. This is a new project and the catalogue is deliberately small. Everything published has been written from primary sources and is dated.

Why this course exists

The powers are not where people look for them, and the procedure is not written down

The first problem

The obvious place to look for what the CSSF can do to you is the law that created it. The Law of 23 December 1998 contains no general power of inspection, no power of injunction, no coercive fine and no general power to sanction. Those are in the sectoral laws, and for most entities that means articles 53, 59 and 63 of the Law of 5 April 1993.

The second problem

There is no published CSSF circular describing how an on-site inspection is conducted. This course is assembled from the legislation, from the CSSF annual report and from the published sanction decisions, and every statement is attributed to one of those.

Currency

Content written from the primary sources. Each instrument carries its own verification date in the source register. Content version: 23 August 2026. The instruments this course relies on were verified on 24 August 2026 and each one carries that date in the source register.

What you get

Six things, and each one is finished for all six modules

Nothing here is a placeholder and nothing is still to come. What is described below exists now, for the whole course.

Eighteen video lessons

All six modules in short lessons, 45:13 of video in total, three lessons to a module, each lesson built around a single thing you can check the same day.

Full written transcripts

Every lesson has the narration in full as a readable article, so you can read the module instead of watching it, or follow both at once.

An assessment for each module, and a final one

Eight questions per module, pass mark 6. On passing you get a printable certificate carrying your name, the course title, the module, the date and the module runtime. The course closes with a twenty question end-of-course assessment across all six modules, pass mark 14 of 20, which is 70 percent. It opens once all six module assessments are passed, and passing it issues a course completion certificate.

Every legal source linked

Each lesson ends with its sources, each one linking to the official text on Legilux or on cssf.lu. Nothing is cited without a link, and every new instrument is entered in the source register with its own verification date.

A course built from what is actually published

No circular describes a CSSF inspection. This course says so, and then builds the sequence from the annual report, the legislation and the published decisions, naming which of the three each statement comes from.

Four working artefacts

The request response playbook, the inspection preparation checklist, the obligations calendar and the appeal deadline map. The first three save what you type against your organisation and export as CSV; all four print to PDF through the browser, and each row names the lesson it is built from.

Syllabus

Six modules

All six modules are published in full, eighteen lessons in all, three to a module, 45 minutes 13 seconds of video. Lesson 1.1 is open to everyone with no account. The remaining seventeen lessons, the reading version and the assessments need a free account, so that your progress, your results and your certificates are recorded against your name. The course closes with an end-of-course assessment drawing on all six modules; it is not a module of its own, and it opens once all six module assessments have been passed.

Module 1. Where the powers come from

Why the law that created the CSSF contains almost none of its powers, what article 53 of the 1993 Law actually allows and what it does not, and how the supervisor decides which entities to look at and when.

StatusPublished LessonsThree Video7:24

LessonTitleAccess

Lesson 1.1 The law that does not contain the powers The 1998 Law created the CSSF and contains almost none of the powers people attribute to it. Where those powers actually sit, and the two provisions of that law that do matter. Open to everyone · 2:25

Lesson 1.2 Article 53, and what it actually allows The inventory of supervisory and investigatory powers, read one clause at a time, including the one that lets the supervisor commission work about you and send you the bill. Account needed · 2:40

Lesson 1.3 How the supervisor decides where to look Supervision is planned, not random. The annual inspection plan, the published priorities, and how to read them in April rather than when the letter arrives. Account needed · 2:19

Start with lesson 1.1 Read the whole module Take the Module 1 assessment

Module 2. The injunction, the fine and the inspection

The injunction and the deadline that is in your letter rather than in a statute, the coercive fine alongside the much larger risk of not answering at all, and how an on-site inspection runs from the annual plan through the fact validation meeting to the observation letter.

StatusPublished LessonsThree Video8:33

LessonTitleAccess

Lesson 2.1 The injunction, and the clock it starts There is no statutory deadline in article 59. There is a deadline in your letter, and three measures that unlock when it passes, none of which is a fine. Account needed · 2:41

Lesson 2.2 The coercive fine, and what it costs to ignore one The coercive fine is capped and survivable. Failing to act on an injunction is a ground for sanction in its own right, and the published decisions show what that costs. Account needed · 2:45

Lesson 2.3 How an on-site inspection actually runs No circular describes the procedure. What the CSSF publishes about its own inspections, the fact validation meeting that decides what the letter says, and the bill at the end. Account needed · 3:07

Start with lesson 2.1 Read the whole module Take the Module 2 assessment

Module 3. eDesk and the recurring obligations

Getting into the portal before you need it, the shape of the reporting calendar including the event driven obligations that catch entities out, and how to answer a request for information so that the correspondence reads well if it is ever read again.

StatusPublished LessonsThree Video7:26

LessonTitleAccess

Lesson 3.1 The portal, and getting into it before you need it Access to eDesk takes documents, an approval and a certificate. Arranging it on the day a deadline falls is the failure that repeats. Account needed · 2:13

Lesson 3.2 What you owe, and when The shape of the reporting calendar: the obligations that arrive on a date, the ones that arrive when something happens, and the ones that arrive because the supervisor asked. Account needed · 2:31

Lesson 3.3 Answering a request for information Three ways to answer badly, only one of which is refusing, and the sequence that keeps your correspondence on the right side of a sanction file. Account needed · 2:42

Start with lesson 3.1 Read the whole module Take the Module 3 assessment

Module 4. Sanctions, publication and appeal

Four sanction scales in four laws with a factor of twenty between them, publication by name as the default and the assessment behind anonymity, and the one month deadline that is not one month in every regime.

StatusPublished LessonsThree Video7:21

LessonTitleAccess

Lesson 4.1 What can be imposed, and on whom Four scales in four laws, differing by a factor of twenty, plus the professional ban that reaches a named individual directly. Account needed · 2:43

Lesson 4.2 Publication, and how long it follows you Publication by name is the default, anonymity is an assessment rather than a favour, and the decision stays up for five years. Account needed · 2:16

Lesson 4.3 Appeal, and the deadline that is not one month One month to the Tribunal administratif in almost every regime, forty days onwards, and no suspensive effect while you contest it. Account needed · 2:22

Start with lesson 4.1 Read the whole module Take the Module 4 assessment

Module 5. After the letter

What a response to an observation letter actually contains and why the remediation dates you set become commitments, what happens inside a sanction procedure that no circular describes, and how far your file travels once professional secrecy has opened one of its gateways.

StatusPublished LessonsThree Video7:19

LessonTitleAccess

Lesson 5.1 Answering an observation letter The letter is not a sanction and not an injunction. What a response that works actually contains, and why the remediation dates you set become commitments. Account needed · 2:34

Lesson 5.2 Inside a sanction procedure An administrative procedure rather than a trial, which moves the decisive moment to the written exchange before the decision, and puts it early. Account needed · 2:29

Lesson 5.3 Cooperation, secrecy and the supervisors you never see Professional secrecy protects your file and a closed list of gateways lets it travel. What that means for a group whose entities answer to different supervisors. Account needed · 2:16

Start with lesson 5.1 Read the whole module Take the Module 5 assessment

Module 6. The obligations that catch people out

Notifying a major information and communication technology incident under DORA and Circular CSSF 25/893, the three stage cycle that turns a published priority into a thematic review or a common supervisory action, and the whistleblowing channel that obliges you to build something whether or not anybody ever uses it.

StatusPublished LessonsThree Video7:10

LessonTitleAccess

Lesson 6.1 ICT incidents and DORA Notification of a major incident through eDesk, a classification decision that has to be prepared before the incident, and no aggregated reporting. Account needed · 2:22

Lesson 6.2 Thematic reviews and common supervisory actions The three stage cycle that turns a published priority into a question on your desk, and the feedback report that tells you what the supervisor found in entities like yours. Account needed · 2:25

Lesson 6.3 The whistleblower, and what it obliges you to build A channel that goes around you, a reversal of the burden of proof, and the internal arrangements every supervised entity has to have in place. Account needed · 2:23

Start with lesson 6.1 Read the whole module Take the Module 6 assessment

Final item. The end-of-course assessment

Not a module, and last in the course. Twenty questions across all six modules, pass mark 14 of 20, which is 70 percent. Available once the six module assessments have been passed. Passing issues a course completion certificate that records the content version, the runtime of 45 minutes 13 seconds across eighteen lessons, and the six module titles.

AssessmentWhat it coversAccess

Final End-of-course assessment Eight scenarios taken from the module assessments and reworded to stand alone, one from each module and two modules contributing a second, and twelve questions written for this assessment alone, each of which needs two modules held together at once. Every answer is marked with the reason it is right or wrong, and the result is broken down module by module. Account needed · 20 questions · Pass mark 14

Prerequisite All six module assessments passed The route is not hidden. Open it early and it tells you which modules remain and links you to each one. Six of six

Go to the end-of-course assessment

Module 1 runs 7 minutes 24 seconds, Module 2 runs 8 minutes 33 seconds, Module 3 runs 7 minutes 26 seconds, Module 4 runs 7 minutes 21 seconds, Module 5 runs 7 minutes 19 seconds and Module 6 runs 7 minutes 10 seconds, which is 45 minutes 13 seconds of video across eighteen lessons. Every module carries three lessons, which is the production standard the course was recorded under. The course closes with an end-of-course assessment of 20 questions drawing on all six modules at a pass mark of 14, which is 70 percent, and which is not a module of its own.

What is included

Everything you get for the price

Video lessonsEvery lesson is a recorded video built around a single point you can act on the same day, with playback speed control.
Full written transcriptsThe narration of every lesson in full as a readable article, word for word, so you can read the course instead of watching it.
A reading version that printsThe whole of each published module as one continuous article, typeset for reading in one sitting and for printing or saving as a PDF from the browser.
An assessment with a certificate of completionEight questions per module, pass mark six, retakeable without limit. Passing issues a printable certificate carrying your name, the module, the date, the content version, the duration as video runtime, the issuing body and the legal references the module covered.
The artefactsWorking documents, not slides: request response playbook, inspection preparation checklist, obligations calendar, appeal deadline map, worked case on published sanctions, source register. They sit inside the course area behind your account, print through the browser, and the response playbook, the inspection checklist and the obligations calendar save what you type against your organisation.
Every legal source linked to its official textEach lesson ends with its sources, each one resolving to the official text on Legilux, on cssf.lu or on EUR-Lex. Nothing is cited without a link.

What is not included

Stated openly, before you spend anything

No
No legal adviceThis is training material. It does not constitute legal or regulatory advice on your entity, your file or your facts, and no lawyer or adviser is engaged by your enrolment.
No
No accreditation by any bodyThe certificate of completion is issued by this project alone. It is not accredited, recognised or endorsed by the CSSF, by any other supervisory authority, or by any professional association.
No
No guarantee of any career outcomeNothing here guarantees a job, a promotion, an appointment as RC or RR, or approval of any person by any authority.
No
No live tuitionThere are no live sessions, no scheduled classes and no tutor. Everything is recorded and written, and you work through it at your own pace.

Access

Access for 12 months from the date of enrolment, including every update published during that period. Updates are published under a dated content version, and the version you were trained against stays on your certificate.

Artefacts

Four working documents, not four more slide decks

These are the part of the course you take back to your desk. They sit inside the course area behind a free account, they print to PDF through your browser, and each one carries the content version and states that it is a working template rather than legal advice. Every row names the lesson it is built from and the instrument it rests on.

The four artefacts

The playbook, the checklist and the calendar save what you type against your organisation, so they can be filled in over several sittings, exported as CSV and printed as a dated, signed off document. The appeal deadline map is a reference card with nothing to fill in.

ArtefactWhat it isBehaviour

Artefact 1 Request response playbookThe structure of an answer to a request for information or an observation letter: dated acknowledgement, one row per point in the supervisor own order, a consistency check against what the entity has already filed, and a dispatch record. Structure and provisions, not model wording. Save, export, print

Artefact 2 Inspection preparation checklistThirty items grouped by the stage of the cycle, from reading the published priorities in April through eDesk access, standing evidence, the fact validation meeting and the tracking of every observation after the letter. Save, export, print

Artefact 3 Obligations calendarThe recurring and event driven obligations named in the course, filterable by entity type and by what triggers them, each with its instrument and its channel. A general map, not your calendar, and it says so. Save, export, print

Artefact 4 Appeal deadline mapA one page reference card: the law, the article that grants the recourse, the period and the court, first instance and second. One month almost everywhere, three months in exactly one place, and no suspensive effect anywhere. Print

Two further artefacts are shared with the AML course and cover this one too: the worked case on the published sanction decisions and the source register.

Open the artefacts

How this course is built

The same four checks were applied to every claim in all six modules before they were recorded.

Read against the text

Every article number cited was checked against the consolidated text of the law, not against a summary of it.

The absence of a circular is stated

Where no official document describes a procedure, the course says so and names what it used instead.

Figures attributed

Inspection counts, fee amounts and sanction figures are taken from the annual report, the fee regulation and the published decisions, each one identified.

Sources linked, not listed

Each source resolves to its official page on Legilux or cssf.lu, so you can check the course against the instrument.

Who this is for

Compliance officers, conducting officers, in-house counsel and fund and ManCo staff who will answer a request for information, sit in a fact validation meeting, read an observation letter, or decide whether a technology incident has to be notified. It assumes no prior knowledge of the 1993 Law.

What the course leaves you with

The ability to say which law a given power comes from, what article 53 does and does not allow, what an injunction obliges you to do and by when, what happens when that period passes, how an inspection runs and where in it a factual error is cheap to correct, what your entity owes through eDesk and what it owes when something happens, how to answer a request so the file reads well later, which sanction scale applies to you, how long a publication follows you, how many days you actually have to challenge a decision, what a response to an observation letter has to contain and what the dates in it commit you to, where your influence sits inside a sanction procedure, how far your file travels once a secrecy gateway opens, how a major technology incident is notified and who has to be able to classify it, what a thematic review and a common supervisory action are and how they are announced, and what a whistleblowing channel obliges you to build.

How to work through it

Watch or read the eighteen lessons in order, take the eight question assessment at the end of each module, then close with the end-of-course assessment. It takes an evening.

Your next step

Lesson 1.1 is open to everyone, with no account. Start there, then create a free account to carry on through the remaining lessons, the assessments and the certificates.

The whole course is open now

Eighteen lessons across six modules, full transcripts, an assessment with a certificate at the end of each module, and a final course assessment. Nothing is still to come. Enrolment opens shortly.

Start lesson 1.1 Create a free account