The whistleblower, and what it obliges you to build
A channel that goes around you, a reversal of the burden of proof, and the internal arrangements every supervised entity has to have in place.
- The video of every lesson, and the word-for-word transcript beside it
- Every claim linked to its primary source, with a source register per lesson
- An assessment for each of the 6 modules, and an end-of-course assessment
- A printable certificate carrying your name, the date and the content version
- The downloadable artefacts and one page references for this course
Expensing it? The invoice can be made out to your firm, with its VAT number and your purchase order reference. Buying for several people: seats for a team.
The narrated video runs about 45 minutes across the 18 lessons. That is short on purpose: no filler and no reading out of the law, with the work in the transcripts, the sources, the assessments and the artefacts.
Module 6. The obligations that catch people out
Notifying a major information and communication technology incident under DORA and Circular CSSF 25/893, the three stage cycle that turns a published priority into a thematic review or a common supervisory action, and the whistleblowing channel that obliges you to build something whether or not anybody ever uses it. Lesson 6.1, ict incidents and dora. Lesson 6.2, thematic reviews and common supervisory actions. Lesson 6.3, the whistleblower, and what it obliges you to build.
Every instrument this lesson is built from, linked to its official text
The Law of 16 May 2023, Memorial A n. 232, is the transposition and the source of the reversal of the burden of proof. The CSSF operates its own channel, separate from eDesk. The internal arrangements are in section 5.3.4, points 94 and 95, of Circular CSSF 12/552, in article 38(2) item 16 of CSSF Regulation 12-02 for the specific, independent and anonymous anti money laundering channel, and in point 160 of Circular CSSF 18/698 for investment fund managers.
- Law of 16 May 2023 on the protection of persons who report breaches Memorial A n. 232, Legilux. Transposes Directive (EU) 2019/1937 and goes beyond it, covering reports of breaches of national law generally rather than of Union law alone. It carries the protection against retaliation and the reversal of the burden of proof https://legilux.public.lu/eli/etat/leg/loi/2023/05/16/a232/jo
- CSSF whistleblower protection and the CSSF reporting channel The CSSF page describing its own channel for reporting breaches of financial sector regulation, separate from eDesk, with acknowledgement to the reporter and protection against retaliation https://www.cssf.lu/en/whistleblower-protection/
- Circular CSSF 12/552, as amended Central administration, internal governance and risk management. Section 5.3.4, points 94 and 95, carry the internal alert procedure: open to all staff, confidential, running outside the normal reporting lines up to the supervisory body, with follow up and with no adverse consequences for the reporter https://www.cssf.lu/en/Document/circular-cssf-12-552/
- CSSF Regulation No 12-02 of 14 December 2012 Coordinated version published by the CSSF https://www.cssf.lu/en/Document/cssf-regulation-n12-02-2/
- Circular CSSF 18/698 of 23 August 2018 Authorisation and organisation of Luxembourg investment fund managers https://www.cssf.lu/en/Document/circular-cssf-18-698/
Module 6. The obligations that catch people out
- Lesson 6.1. ICT incidents and DORA 2:22
- Lesson 6.2. Thematic reviews and common supervisory actions 2:25
- Lesson 6.3. The whistleblower, and what it obliges you to build 2:23 · this page
Open this lesson
Access to CSSF Readiness: requests, inspections and observation letters opens the video, the word-for-word transcript, the module assessments and the certificates. If you already have access, sign in and this page becomes the lesson.
Or watch lesson 1-1 of this course free, with no account: CSSF Readiness: requests, inspections and observation letters, the free sample.