How to comply with article II.8 of CSSF 12/552?

Question

I need to bring my Luxembourg organisation into compliance with article II.8 of CSSF 12/552 (CSSF 12/552). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapPoint 186 imposes a precise legal reporting duty toward the CSSF: ICAAP/ILAAP reports, the annual compliance attestation signed by authorised management, and the summary reports of the three internal control functions (compliance, risk, internal audit). The classic trap is not forgetting these documents, but filing them late, in a non-admitted language (only French, German or English are accepted), or with a generic compliance attestation that fails to demonstrate a genuine, requirement-by-requirement review. The CSSF sanctions rubber-stamp attestations: authorised management that signs a blanket compliance statement without an audit trail engages its personal responsibility, and the gap between the attestation and operational reality becomes the first weakness exploited during an on-site inspection.What the CSSF checks on legal reportingThe annual attestation actually covers each requirement of circular 12/552, not a global untraceable declaration.ICAAP/ILAAP reports are submitted through the channel and calendar of circular CSSF 19/731, without delay.The internal control functions summary reports are dated, signed by the function head and consistent with the underlying detailed reports.The drafting language is French, German or English, end to end.Authorised management can demonstrate the review process that led to signing the attestation (committees, agenda items, deliberations).How Luxgap automates this riskOur Luxgap Regulatory Filing Cockpit turns the rubber-stamp annual attestation into requirement-by-requirement opposable evidence and makes late filing impossible. The tool maps every requirement of circular 12/552 into traceable control points, then pulls the evidence itself from your systems (SharePoint M365, internal GRC, document management, committee minutes) to link each compliance statement to a dated source, without asking authorised management to fill in a spreadsheet.Breaks circular 12/552 into unit requirements and attaches to each the matching documentary evidence extracted from M365, your DMS or your GRC tool.Calculates a completeness score for the annual attestation and flags requirements with no evidence before authorised management signs.Monitors the ICAAP/ILAAP filing calendar set by circular CSSF 19/731 and alerts via Teams as each deadline approaches.Checks the drafting language (French, German, English) and blocks any document not compliant with the CSSF transmission channel.Aggregates the summary reports of the compliance, risk and internal audit functions and detects inconsistencies with the underlying detailed reports.Produces a time-stamped, sealed PDF dossier, opposable to the CSSF, tracing the review process that led to the attestation.Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blank audit within 48h to measure your exposure...

Chapitre 8 - Reporting légal

They trust us

Before we chat