I need to bring my Luxembourg organisation into compliance with article II.5.3.3 of CSSF 12/552 (CSSF 12/552). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPR NIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915 CSSF 20/758 CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750CSSF 12/552CSSF 11/504 (repealed)CSSF 24/847

Article II.5.3.3

Section 5.3.3 - La fonction informatique

CSSF Circular 12/552 on central administration, internal governance and risk management · CSSF 12/552

Section 5.3.3. La fonction informatique 90. Les établissements organisent leur fonction informatique de manière à en avoir le contrôle et à en assurer la robustesse, l’efficacité, la cohérence et l’intégrité conformément au chapitre 3 de cette partie. Pour ce faire, ils respectent les exigences de la circulaire CSSF 20/750 relative aux exigences en matière de gestion des risques liés aux technologies de l’information et de la communication et à la sécurité.

91. Les établissements qui, en matière de fonction informatique, recourent à des prestataires de services respectent en particulier les conditions prévues dans la circulaire CSSF 22/806 dédiée à l’externalisation.

16/647, 17/655, 20/750, 20/759, 21/785, 22/807 ET 24/860

Luxgap guidance · DPO & CISO

How to comply

The classic trap

The IT function is no longer a mere technical support in the eyes of the CSSF: it is a full governance function, for which the management body remains accountable even when everything is outsourced. The classic trap, sanctioned in practice by the CSSF, is the institution that believes it satisfies Article II.5.3.3 by signing a cloud contract, without ever demonstrating the control, robustness and integrity required by cross-reference to circulars CSSF 20/750 (ICT and security risk management) and CSSF 22/806 (outsourcing). The CSSF checks substance: an up-to-date ICT outsourcing register, tested exit plans, assessed provider criticality, and above all the institution's ability to retain effective control of its IT from Luxembourg.

What the CSSF actually looks at

A complete ICT outsourcing register, distinguishing critical or important providers under circular 22/806, with prior notification to the CSSF for critical arrangements.
Effective compliance with circular 20/750: ICT governance, asset classification, vulnerability management, continuity and incident handling.
Exit strategies that are documented AND tested, not merely drafted, for each critical cloud provider.
Evidence that the central administration retains control: audit rights, data access, location, reversibility.
Consistency with DORA since January 2025, which absorbs and tightens a large part of these requirements for CSSF-regulated financial entities.

How Luxgap automates this risk

Our Luxgap ICT Outsourcing Sentinel turns the obligation to control the IT function into continuous evidence that stands up before the CSSF. An AI agent fetches your real ICT providers itself by cross-checking your Sage BOB 50 invoices, Odoo contracts, M365 tenant, Azure and AWS, then automatically reconstructs the full outsourcing chain your 22/806 register is supposed to reflect, without anyone filling in a form.

Detects each new ICT provider as soon as a payment, contract or cloud access appears in your connected systems, and classifies it critical or not against the CSSF 22/806 grid.
Checks for each critical provider the presence of a tested exit plan, audit rights, data location and up-to-date certifications (ISO 27001, SOC 2, ISAE 3402).
Calculates a maturity score against the domains of circular CSSF 20/750 (ICT governance, vulnerability management, continuity, incidents) and flags priority gaps.
Alerts in real time via Teams as soon as an outsourcing arrangement becomes critical and triggers the CSSF prior-notification workflow.
Generates the ICT outsourcing register, pre-filled and DORA-aligned, ready to present during an on-site inspection.
Produces a timestamped, cryptographically sealed PDF report, enforceable before the CSSF, demonstrating effective control of the IT function from Luxembourg.

Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real providers, with a free blind audit within 48h to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Section 5.3.3 - La fonction informatique

They trust us

Before we chat