CSSF Readiness: requests, inspections and observation letters
Where the CSSF's powers actually come from, what article 53 allows and what it does not, what an injunction obliges you to do and by when, how an on-site inspection runs from the annual plan through the fact validation meeting to the observation letter, what you owe through eDesk and when, what can be imposed on you, published about you and challenged by you, how to answer the letter and what happens inside a sanction procedure, and the obligations that catch entities out: ICT incident notification under DORA, thematic reviews and common supervisory actions, and the whistleblowing channel.
For compliance officers, conducting officers, in-house counsel and fund and ManCo staff who will answer a request, sit in a fact validation meeting or read an observation letter. No prior knowledge of the 1993 Law assumed.
What you can do afterwards. Know what an inspection expects, and how a request and an observation letter are answered.
See the teaching before you pay. Two lessons of this course are open with no account and no payment, and every lesson lists the instruments it is built from with a link to the official text, so the material is on the table before the price is. Access runs 12 months from the day you buy and includes every update published to this course in that time.
Expensing it? Ask for the invoice to be made out to your firm, with its VAT number, billing address and your purchase order reference. Buying for several people instead: seats for a team, or how teams and invoices work.
Content version: 25 September 2026. The terms of sale are available in full at checkout.
Supervision is planned a year at a time, and the plan is not a secret
The supervisory departments propose inspections on a risk based methodology, an annual plan is drawn up and validated by the Executive Board, and the supervisory priorities are published alongside it. Article 3-1 of the Law of 23 December 1998 obliges the CSSF to publish and keep updated the rules and the criteria and methods of its supervisory review. Reading the priorities early in the year and reading them when the letter arrives are two different positions to be in, and lesson 1.3 is about the difference.
Law of 23 December 1998, article 3-1The powers are not where people look for them, and the procedure is not written down
The obvious place to look for what the CSSF can do to you is the law that created it. The Law of 23 December 1998 contains no general power of inspection, no power of injunction, no coercive fine and no general power to sanction. Its one sanctioning provision, article 2-1(2) and (3), is confined to breaches of named articles of the Credit Rating Agencies Regulation (EC) No 1060/2009 and reaches almost nobody. The powers that reach you are in the sectoral laws, and for most entities that means articles 53, 59 and 63 of the Law of 5 April 1993.
There is no published CSSF circular describing how an on-site inspection is conducted. This course is assembled from the legislation, from the CSSF annual report and from the published sanction decisions, and every statement is attributed to one of those.
Six modules
Six modules and 18 lessons, each with its transcript and its own source register, lessons 1.1 and 1.2 free to watch. An assessment closes every module and a certificate is issued for each one, and the course closes with an end-of-course assessment drawing on all six modules.
Module 1. Where the powers come from
Why the law that created the CSSF contains almost none of its powers, what article 53 of the 1993 Law actually allows and what it does not, and how the supervisor decides which entities to look at and when.
Learning objectives
- Locate the supervisory and sanctioning powers in the sectoral laws rather than in the Law of 23 December 1998, and state what the two provisions of that law which do matter (article 16 on professional secrecy and article 20 on supervision in the public interest) actually say.
- Set out what article 53 of the Law of 5 April 1993 allows, including verifications by auditors or experts at the expense of the person concerned, the reach to providers to whom functions are outsourced, and the requirement that every decision state the reasons on which it is based.
- Explain how supervisory attention is allocated through the annual inspection plan and the published priorities, and read the published priorities as the schedule of questions the entity will be asked.
Module 2. The injunction, the fine and the inspection
The injunction and the deadline that is in your letter rather than in a statute, the coercive fine alongside the much larger risk of not answering at all, and how an on-site inspection runs from the annual plan through the fact validation meeting to the observation letter.
Learning objectives
- Read an injunction under article 59 correctly: the period is the one set in the letter and not in any statute, and the three measures unlocked when it passes are suspension of members of the management body, of voting rights and of the business.
- State what the coercive fine under article 63(3) can and cannot cost, and explain why failing to act on an injunction or on a decision is a ground for sanction in its own right under article 63(1).
- Describe the sequence of an on-site inspection as the CSSF itself publishes it, and identify the fact validation meeting as the point at which an observation can still be corrected before it is fixed in a letter.
Module 3. eDesk and the recurring obligations
Getting into the portal before you need it, the shape of the reporting calendar including the event driven obligations that catch entities out, and how to answer a request for information so that the correspondence reads well if it is ever read again.
Learning objectives
- Arrange eDesk access before it is needed (the certificate, the endorsement, and more than one endorsed user) and recognise that some reporting does not run through the portal at all.
- Map the reporting calendar into obligations that arrive on a fixed date, obligations that arrive when something happens, and obligations that arrive because the supervisor asked.
- Answer a request for information so that it is neither late, nor partial, nor inconsistent with what the entity has already filed, and keep the record of what was sent and when.
Module 4. Sanctions, publication and appeal
Four sanction scales in four laws with a factor of twenty between them, publication by name as the default and the assessment behind anonymity, and the one month deadline that is not one month in every regime.
Learning objectives
- Identify which sanction scale applies to a given entity, and that the scales sitting in the different sectoral laws differ substantially from one another and reach named natural persons alongside the entity.
- Explain publication by name as the default, the grounds on which anonymity or deferral is assessed rather than granted on request, and how long a published decision stays available.
- State the appeal route to the Tribunal administratif and the one-month deadline that applies in almost every regime, the forty days onwards to the Cour administrative, and that a challenge has no suspensive effect.
Module 5. After the letter
What a response to an observation letter actually contains and why the remediation dates you set become commitments, what happens inside a sanction procedure that no circular describes, and how far your file travels once professional secrecy has opened one of its gateways.
Learning objectives
- Construct a response to an observation letter that addresses each observation separately and in the supervisor order, states a position on each, and gives every accepted point a named owner and a date that then becomes a commitment.
- Describe a sanction procedure as an administrative procedure whose decisive moment is the written exchange before the decision, and the weight the published decisions give to cooperation, self detection and consistency.
- Explain the professional secrecy binding the CSSF and the closed list of gateways through which a file reaches other authorities, and what that requires of consistency across a group.
Module 6. The obligations that catch people out
Notifying a major information and communication technology incident under DORA and Circular CSSF 25/893, the three stage cycle that turns a published priority into a thematic review or a common supervisory action, and the whistleblowing channel that obliges you to build something whether or not anybody ever uses it.
Learning objectives
- Notify a major ICT incident under DORA and Circular CSSF 25/893: who decides that an incident is major, who files, from which account, that reporting is not aggregated, and that an outsourced filing arrangement is itself declared.
- Follow the three-stage cycle from a published priority through a collection exercise to a feedback report, and use the feedback report as a statement of what the supervisor found adequate in comparable entities.
- Build the internal whistleblowing arrangements required of a supervised entity, and explain the reversal of the burden of proof introduced by the Law of 16 May 2023.
Final item. The end-of-course assessment
15 questions across all six modules, pass mark 11 of 15, which is 73 percent. Passing issues a course completion certificate recording the content version and the runtime of 45 minutes 13 seconds across 18 lessons.
Everything you get for the price
- Video lessonsEvery lesson is built around a single point you can act on the same day, with playback speed control.
- Full written transcriptsThe narration of every lesson word for word, so you can read the course instead of watching it.
- A reading version that printsEach module as one continuous article, typeset for reading in one sitting and for saving as a PDF.
- An assessment with a certificate of completionA scored assessment for every module, with its question count and pass mark shown before you start, retakeable without limit. The certificate carries your name, the module, the date, the content version and the legal references it covered.
- The artefactsWorking documents, not slides: request response playbook, inspection preparation checklist, obligations calendar, appeal deadline map, worked case on published sanctions, source register. They print through the browser, and the response playbook, the inspection checklist and the obligations calendar save what you type against your organisation.
- Every legal source linked to its official textEach lesson ends with its sources, each resolving to the official text on Legilux, cssf.lu or EUR-Lex.
Stated openly, before you spend anything
- NoNo legal adviceTraining material, not advice on your entity or your file.
- NoNo accreditation by any bodyThe certificate of completion is issued by this project alone. It is not an official qualification.
- NoNo guarantee of any career outcomeNo job, no promotion, no appointment as RC or RR, and no approval of any person by any authority.
- NoNo live tuitionEverything is recorded, and you work at your own pace.
Concise by design. The narrated video runs about 45 minutes across 18 lessons, which is short on purpose: there is no filler, no restated slide and no reading out of the law. What takes the time is what you do with it, the transcripts, the source registers, the 6 module assessments and the artefacts you fill in for your own entity.
The same course for several people
- Team price 499 euros for 5 peopleOne seat each, 12 months from the date of purchase.
- Team price 899 euros for 10 peopleOne seat each, 12 months from the date of purchase.
- Larger teamsLarger teams by arrangement, through the contact page.
A team is bought in the entity's name: the checkout takes the legal name and billing address, with a VAT number if you have one. Pay by card and the seats open at once, or ask for an invoice and pay it by bank transfer. Each seat is activated by the employee it is sent to.
The certificate and the artefacts, before you buy them
Both of these are normally behind the paywall. They are shown here because the two questions that decide this purchase are what the training file gets and whether the artefacts are working documents or slides.
Four working documents, not four more slide decks
This is the part of the course you take back to your desk. The playbook, the checklist and the calendar save what you type, export as CSV and print as a dated document.
The source register of this course lists every instrument the six modules are built from. One further artefact is shared with the AML course and covers this one too: the worked case on the published sanction decisions.
How this course is built
Explore the laws and source material behind all six modules.
Articles in context
Article numbers appear alongside the points they support.
The absence of a circular is stated
Where no official document describes a procedure, the course says so and names what it used instead.
Sources linked, not listed
Each source resolves to its official page on Legilux or cssf.lu, so you can check the course against the instrument.
Compliance officers, conducting officers, in-house counsel and fund and ManCo staff who will answer a request for information, sit in a fact validation meeting, read an observation letter, or decide whether a technology incident has to be notified. It assumes no prior knowledge of the 1993 Law.
The ability to say which law a given power comes from, what article 53 does and does not allow, what an injunction obliges you to do and by when, what happens when that period passes, how an inspection runs and where in it a factual error is cheap to correct, what your entity owes through eDesk and what it owes when something happens, how to answer a request so the file reads well later, which sanction scale applies to you, how long a publication follows you, how many days you actually have to challenge a decision, what a response to an observation letter has to contain and what the dates in it commit you to, where your influence sits inside a sanction procedure, how far your file travels once a secrecy gateway opens, how a major technology incident is notified and who has to be able to classify it, what a thematic review and a common supervisory action are and how they are announced, and what a whistleblowing channel obliges you to build.
The whole course is on sale now
18 lessons across six modules, with a certificate at the end of each one.