The law that does not contain the powers
The 1998 Law created the CSSF and contains almost none of the powers people attribute to it. Where those powers actually sit, and the two provisions of that law that do matter.
Prefer to read? The full transcript of this lesson is on the Read tab, word for word.
If you want to understand what the CSSF can do to you, the obvious place to look is the law that created it. That instinct is wrong, and following it is why so many people misdescribe this regime. The Law of 23 December 1998 established the CSSF. It is an institutional statute. It says what the body is, how it is governed, how it is funded, and what its remit covers.
What it does not contain is any general power of inspection, any power of injunction, any coercive fine, or any general power to sanction. Those words do not appear in it. Its only sanctioning provision, article 2-1, concerns credit rating agencies and nothing else. So where are the powers? In the sectoral laws. For most of what this course covers, that means the Law of 5 April 1993 on the financial sector, and specifically its articles 53, 59 and 63.
Two provisions of the 1998 Law do matter, and both cut in a direction people do not expect. Article 16 imposes professional secrecy on the CSSF itself, backed by the criminal code. Information you give it is protected, and there is a closed list of gateways through which it can be shared. And article 20, which is the one to remember.
Supervision by the CSSF is carried out solely in the public interest. It is expressly not intended to safeguard the individual interests of supervised entities, their clients or third parties. For the CSSF to incur civil liability, gross negligence must be shown. Read that plainly. The supervisor is not there to protect you, and suing it is close to impossible. That is not cynicism, it is the statute.
Every instrument cited above, linked to its official text
Articles 2-1, 16 and 20 of the Law of 23 December 1998, and articles 53, 59 and 63 of the Law of 5 April 1993. The powers are in the second of those laws, not the first.
- Law of 23 December 1998 establishing a financial sector supervisory commission Consolidated version published by the CSSF. Article 2-1 on credit rating agencies, article 3-1 on publishing the criteria and methods of supervision, article 16 on professional secrecy of the CSSF, article 20 on supervision in the public interest and on civil liability https://www.cssf.lu/en/Document/law-of-23-december-1998-2/
- Law of 23 December 1998, as published in the Journal officiel Legilux, official publication https://legilux.public.lu/eli/etat/leg/loi/1998/12/23/n2/jo
- Law of 5 April 1993 on the financial sector Consolidated version published by the CSSF. Article 53 carries the supervisory and investigatory powers, including the duty to state reasons in paragraph 4, article 59 the injunction and suspension powers, article 63 and its lettered articles the sanctions, the coercive fine, publication and the right of appeal, article 63-4 the factors taken into account in setting a penalty, and article 64-2 the reporting of certain sanctions to the European Banking Authority https://www.cssf.lu/en/Document/law-of-5-april-1993/
Content written from the primary sources. Each instrument carries its own verification date in the source register. Content version: 23 August 2026
The whole module as one article
All three transcripts of Module 1 in order with the sources at the end, typeset for reading in one sitting and for printing.
Eight questions, pass mark 6
Six multiple choice and two scenarios on Module 1. Pass and you get a printable certificate carrying your name, the date and the module runtime.
The four artefacts
The request response playbook, the inspection preparation checklist, the obligations calendar and the appeal deadline map. Three of them save what you type against your organisation, and all four print.
The source register
Every instrument this course relies on, with its date, its official reference and the date it was last verified.