CSSF Readiness : demandes, inspections et lettres d'observations

Objectifs d'apprentissage

• Locate the supervisory and sanctioning powers in the sectoral laws rather than in the Law of 23 December 1998, and state what the two provisions of that law which do matter (article 16 on professional secrecy and article 20 on supervision in the public interest) actually say.
• Set out what article 53 of the Law of 5 April 1993 allows, including verifications by auditors or experts at the expense of the person concerned, the reach to providers to whom functions are outsourced, and the requirement that every decision state the reasons on which it is based.
• Explain how supervisory attention is allocated through the annual inspection plan and the published priorities, and read the published priorities as the schedule of questions the entity will be asked.

Objectifs d'apprentissage

• Read an injunction under article 59 correctly: the period is the one set in the letter and not in any statute, and the three measures unlocked when it passes are suspension of members of the management body, of voting rights and of the business.
• State what the coercive fine under article 63(3) can and cannot cost, and explain why failing to act on an injunction or on a decision is a ground for sanction in its own right under article 63(1).
• Describe the sequence of an on-site inspection as the CSSF itself publishes it, and identify the fact validation meeting as the point at which an observation can still be corrected before it is fixed in a letter.

Objectifs d'apprentissage

• Arrange eDesk access before it is needed (the certificate, the endorsement, and more than one endorsed user) and recognise that some reporting does not run through the portal at all.
• Map the reporting calendar into obligations that arrive on a fixed date, obligations that arrive when something happens, and obligations that arrive because the supervisor asked.
• Answer a request for information so that it is neither late, nor partial, nor inconsistent with what the entity has already filed, and keep the record of what was sent and when.

Objectifs d'apprentissage

• Identify which sanction scale applies to a given entity, and that the scales sitting in the different sectoral laws differ substantially from one another and reach named natural persons alongside the entity.
• Explain publication by name as the default, the grounds on which anonymity or deferral is assessed rather than granted on request, and how long a published decision stays available.
• State the appeal route to the Tribunal administratif and the one-month deadline that applies in almost every regime, the forty days onwards to the Cour administrative, and that a challenge has no suspensive effect.

Objectifs d'apprentissage

• Construct a response to an observation letter that addresses each observation separately and in the supervisor order, states a position on each, and gives every accepted point a named owner and a date that then becomes a commitment.
• Describe a sanction procedure as an administrative procedure whose decisive moment is the written exchange before the decision, and the weight the published decisions give to cooperation, self detection and consistency.
• Explain the professional secrecy binding the CSSF and the closed list of gateways through which a file reaches other authorities, and what that requires of consistency across a group.

Objectifs d'apprentissage

• Notify a major ICT incident under DORA and Circular CSSF 25/893: who decides that an incident is major, who files, from which account, that reporting is not aggregated, and that an outsourced filing arrangement is itself declared.
• Follow the three-stage cycle from a published priority through a collection exercise to a feedback report, and use the feedback report as a statement of what the supervisor found adequate in comparable entities.
• Build the internal whistleblowing arrangements required of a supervised entity, and explain the reversal of the burden of proof introduced by the Law of 16 May 2023.