The law that does not contain the powers

If you want to understand what the CSSF can do to you, the obvious place to look is the law that created it. That instinct is wrong, and following it is why so many people misdescribe this regime. The Law of 23 December 1998 established the CSSF. It is an institutional statute. It says what the body is, how it is governed, how it is funded, and what its remit covers.

What it does not contain is any general power of inspection, any power of injunction, any coercive fine, or any general power to sanction. Those words do not appear in it. Its only sanctioning provision, article 2-1, concerns credit rating agencies and nothing else. So where are the powers? In the sectoral laws. For most of what this course covers, that means the Law of 5 April 1993 on the financial sector, and specifically its articles 53, 59 and 63.

Two provisions of the 1998 Law do matter, and both cut in a direction people do not expect. Article 16 imposes professional secrecy on the CSSF itself, backed by the criminal code. Information you give it is protected, and there is a closed list of gateways through which it can be shared. And article 20, which is the one to remember.

Supervision by the CSSF is carried out solely in the public interest. It is expressly not intended to safeguard the individual interests of supervised entities, their clients or third parties. For the CSSF to incur civil liability, gross negligence must be shown. Read that plainly. The supervisor is not there to protect you, and suing it is close to impossible. That is not cynicism, it is the statute.