Partie VIII - : Communication avec la CSSF

CSSF Circular 18/698 — Authorisation and organisation of investment fund managers (and AML/CFT provisions) · CSSF 18/698

Partie VIII. : Communication avec la CSSF 617. Le GFI fait usage dans sa communication écrite avec la CSSF d’une langue acceptée par la CSSF. L’usage des langues luxembourgeoise, française, allemande ou anglaise est accepté dans tous les cas.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

Part VIII of CSSF 18/698 looks trivial, but it frames the entire formal relationship between the investment fund manager (IFM) and the CSSF. The trap is not the language itself (Luxembourgish, French, German or English are all accepted), but the traceability and consistency of written communications. In practice the CSSF penalises IFMs that keep no centralised register of their exchanges, that submit documents in a non-accepted language for certain regulatory annexes, or that cannot prove the sending and receipt of a notification within the deadlines. A single lost letter becomes a documentary breach during an inspection.

Practical pitfalls on CSSF communication

Mixing languages within a single regulatory file (report in English, annex in French) without consistency, slowing down the review and creating a rejection risk.
Using uncontrolled channels (personal emails, shared mailboxes) with no timestamp or proof of filing on CSSF portals (eDesk, S3, reporting transmission).
Lack of a single register of incoming and outgoing communications, making it impossible to reconstruct a history during an audit.
Delegating communication to a service provider (central administration, depositary) without a traceability clause or access to acknowledgements of receipt.
Neglecting response deadlines to CSSF requests, due to the absence of a deadline alerting system.

How Luxgap automates this risk

Our Luxgap Regulator Comms Vault turns your scattered exchanges with the CSSF into a single, timestamped and enforceable register that makes losing a regulatory communication impossible. The tool connects to your Microsoft 365 mailboxes, your filings on CSSF portals (eDesk, S3) and your SharePoint spaces to automatically capture every incoming and outgoing letter, with its language, subject and acknowledgement of receipt.

Automatically captures every CSSF communication from M365, SharePoint and transmission portals, without manual re-entry.
Detects the language of each document and alerts when an annex is sent in a language not accepted by Part VIII (other than Luxembourgish, French, German, English).
Timestamps and cryptographically seals every submission and acknowledgement to build enforceable proof in case of inspection.
Alerts via Teams as soon as a CSSF request approaches its response deadline, with open or closed status tracking.
Generates a timestamped PDF report reconstructing the full history of exchanges over a given period, handed directly to the CSSF inspector.

Available as a complement to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free blind audit within 48h to measure your exposure before any commitment.

How Luxgap can help

External CISO

Appoint us as your information security officer: we take operational ownership of policy, governance, risk, audits and incidents, with NIS 2 or DORA where they apply.

See the CISO mandate

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Partie VIII - : Communication avec la CSSF

They trust us

Before we chat