I need to bring my Luxembourg organisation into compliance with article II.4.1.1 of CSSF 18/698 (CSSF 18/698). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Section 4.1.1. : Exigences numériques 59. Les membres de l’organe de direction/organe directeur doivent être au minimum au nombre de trois. Toutefois, dans le cas d'une structure dualiste dans laquelle sont séparées les fonctions de surveillance et de gestion, le conseil de surveillance doit être composé au minimum de trois membres et le directoire doit être composé au minimum de deux membres.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

CSSF Circular 18/698 sets a seemingly trivial arithmetic threshold, but this is precisely where authorisation files stumble. The CSSF does not merely count heads: it checks that the three members of the management body (or the three of the supervisory board and two of the management board in a dualistic structure) exercise effective, distinct and documented presence. A figurehead mandate, a director sitting on ten entities, or a management board reduced to a single operational person triggers a refusal or a request for further information that extends the review by several months.

What the CSSF actually checks behind the number

The minimum composition (three members, or three plus two in a dualistic setup) must be maintained continuously, not just on authorisation day: an unfilled resignation puts you immediately in breach.
The separation of supervisory and management functions must be real: no overlap of persons between supervisory board and management board.
Each member must meet the honourability and competence (fit and proper) requirements assessed individually.
Effective availability (number of cumulated mandates) must be demonstrable, with the CSSF cross-checking mandates declared in the register.
Any change of composition must be notified to the CSSF ex ante, with a complete candidate file.

How Luxgap automates this risk

Our Luxgap Governance Quorum Monitor makes a silent breach of your regulatory quorum structurally impossible. The tool connects to your mandate register, your Active Directory / M365 directory and your HR reference system (Sage BOB 50, Workday LU) to reconstruct in real time the exact composition of your management body and detect any drop below the CSSF 18/698 threshold the moment a resignation, an expired mandate or a vacancy appears.

Continuously calculates the headcount of the management body and management board, and alerts instantly via Teams as soon as the number falls below three (or below two for the dualistic management board).
Detects overlaps of persons between supervisory board and management board that violate the separation of functions required in a dualistic structure.
Scans each member's cumulated mandates via RCS data and flags profiles at risk of insufficient availability before the CSSF raises them.
Automatically generates the change-of-composition notification file, prefilled with the fit and proper documents the CSSF expects.
Produces a timestamped and sealed PDF report, admissible during a prudential review, demonstrating continuous maintenance of the regulatory quorum since authorisation.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real organisation, with a free blind audit within 48h to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Section 4.1.1 - : Exigences numériques

They trust us

Before we chat