I need to bring my Luxembourg organisation into compliance with article II.7.4 of CSSF 12/552 (CSSF 12/552). What are the concrete requirements, the sanctions, and how can Luxgap support me?

The classic trapPoint 185 sets a simple but formidable rule: outsourcing must never hollow out the governance and risk management requirements of the circular. In practice, the CSSF sanctions institutions that outsource an activity (cloud, portfolio management, IT, back-office) without keeping real control of the risks, without an effective audit right, or without continuous supervision of the provider. The most frequent trap: a contract signed once and never reassessed, whereas circular 22/806 mandates a full lifecycle (pre-outsourcing analysis, materiality, register, monitoring, exit strategy).The operational traps of CSSF outsourcingAbsence of a comprehensive outsourcing register distinguishing critical or important activities from non-critical ones, with documented sub-outsourcing chains.Outsourcing that de facto shifts the central administration outside Luxembourg, in direct breach of Part II of 12/552.Audit rights and regulator access rights not stipulated or not exercisable (data centres outside the EU, contractual refusal by the cloud provider).Absence of a tested exit strategy for critical functions, leaving the institution captive to its provider.Outsourcing of AML/CFT activities without compliance with CSSF regulation 12-02, while the AML responsibility remains fully with the institution.Internal control functions (compliance, risk, internal audit) outsourced without complying with chapter 6.2 and without a qualified internal contact point.How Luxgap automates this riskOur Luxgap Outsourcing Control Tower turns your outsourcing management into a living register, enforceable before the CSSF, that detects your real providers and not the ones you believe you control. The tool cross-references your contracts (Odoo, SharePoint M365), your payment flows (Sage BOB 50) and your technical accesses (Azure Active Directory, Microsoft Defender for Cloud Apps) to reconstruct the full outsourcing chain, including cascading sub-outsourcing, without asking your compliance officer to fill in a single form.Automatically detects each new outsourcing relationship as soon as a contract, a recurring payment or a privileged access appears in your connected systems.Classifies each arrangement against the materiality grid of circular 22/806 (critical or important, non-critical) and triggers the required level of analysis.Verifies the presence of the audit right, the CSSF access right, EU data localisation and the exit strategy, and alerts on missing clauses.Continuously checks that the central administration effectively remains in Luxembourg and flags any substance drift towards a foreign provider.Monitors provider certifications (ISO 27001, SOC 2, approvals) and alerts before expiry via an instant Teams notification.Produces a timestamped PDF report, enforceable during a CSSF inspection, demonstrating compliance with point 185 and the 22/806 lifecycle.Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your ...

EU frameworkGDPR NIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915 CSSF 20/758 CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750CSSF 12/552CSSF 11/504 (repealed)CSSF 24/847

Article II.7.4

Sous-chapitre 7.4 - Externalisation (« Outsourcing »)

CSSF Circular 12/552 on central administration, internal governance and risk management · CSSF 12/552

Sous-chapitre 7.4. Externalisation (« Outsourcing »)

185. L’externalisation ne doit pas aboutir à une situation dans laquelle l’esprit ou la lettre de la présente circulaire en matière d’administration centrale, de gouvernance interne et de gestion des risques ne sont plus respectés.

Pour une définition de l’externalisation et des exigences et informations générales relatives à l’externalisation d’activités (en complément de celles applicables aux fonctions de contrôle interne conformément au chapitre 6.2 de la présente partie), référence est faite à la circulaire 22/806 dédiée à l’externalisation.

Pour toute externalisation d’activités entrant dans le domaine de la lutte contre le blanchiment et le financement du terrorisme, référence est également faite au règlement CSSF 12-02 relatif à la lutte contre le blanchiment et contre le financement du terrorisme.

16/647, 17/655, 20/750, 20/759, 21/785, 22/807 ET 24/860

Luxembourg specificity

circulaire CSSF 22/806 relative a l'externalisation et reglement CSSF 12-02

In Luxembourg, outsourcing by credit institutions and investment firms is governed by a full framework: CSSF circular 22/806 (transposing the EBA outsourcing guidelines) sets out prior notifications to the CSSF for critical or important arrangements, the register obligation, and the exit strategy. CSSF regulation 12-02 applies additionally to any outsourcing affecting AML/CFT, with responsibility remaining entirely with the obliged institution.

Luxgap practice: keep the outsourcing register continuously up to date and notify the CSSF before any critical or important arrangement; retain timestamped evidence of each pre-outsourcing analysis and each exit strategy test.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Point 185 sets a simple but formidable rule: outsourcing must never hollow out the governance and risk management requirements of the circular. In practice, the CSSF sanctions institutions that outsource an activity (cloud, portfolio management, IT, back-office) without keeping real control of the risks, without an effective audit right, or without continuous supervision of the provider. The most frequent trap: a contract signed once and never reassessed, whereas circular 22/806 mandates a full lifecycle (pre-outsourcing analysis, materiality, register, monitoring, exit strategy).

The operational traps of CSSF outsourcing

Absence of a comprehensive outsourcing register distinguishing critical or important activities from non-critical ones, with documented sub-outsourcing chains.
Outsourcing that de facto shifts the central administration outside Luxembourg, in direct breach of Part II of 12/552.
Audit rights and regulator access rights not stipulated or not exercisable (data centres outside the EU, contractual refusal by the cloud provider).
Absence of a tested exit strategy for critical functions, leaving the institution captive to its provider.
Outsourcing of AML/CFT activities without compliance with CSSF regulation 12-02, while the AML responsibility remains fully with the institution.
Internal control functions (compliance, risk, internal audit) outsourced without complying with chapter 6.2 and without a qualified internal contact point.

How Luxgap automates this risk

Our Luxgap Outsourcing Control Tower turns your outsourcing management into a living register, enforceable before the CSSF, that detects your real providers and not the ones you believe you control. The tool cross-references your contracts (Odoo, SharePoint M365), your payment flows (Sage BOB 50) and your technical accesses (Azure Active Directory, Microsoft Defender for Cloud Apps) to reconstruct the full outsourcing chain, including cascading sub-outsourcing, without asking your compliance officer to fill in a single form.

Automatically detects each new outsourcing relationship as soon as a contract, a recurring payment or a privileged access appears in your connected systems.
Classifies each arrangement against the materiality grid of circular 22/806 (critical or important, non-critical) and triggers the required level of analysis.
Verifies the presence of the audit right, the CSSF access right, EU data localisation and the exit strategy, and alerts on missing clauses.
Continuously checks that the central administration effectively remains in Luxembourg and flags any substance drift towards a foreign provider.
Monitors provider certifications (ISO 27001, SOC 2, approvals) and alerts before expiry via an instant Teams notification.
Produces a timestamped PDF report, enforceable during a CSSF inspection, demonstrating compliance with point 185 and the 22/806 lifecycle.

Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real outsourcing register, with a free blank audit within 48h to measure your exposure before any engagement.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Sous-chapitre 7.4 - Externalisation (« Outsourcing »)

They trust us

Before we chat