How to comply with article 1 of CSSF 20/750?

Question

I need to bring my Luxembourg organisation into compliance with article 1 of CSSF 20/750 (CSSF 20/750). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapChapter 1 looks harmless, but it triggers the CSSF's first reflex during an inspection: checking whether your entity falls within the scope. Many support PSFs and specialised PSFs wrongly assume that circular 20/750 only concerns banks or systemic entities. The CSSF sanctions precisely this scoping mistake: an entity that applies a watered-down ICT security baseline because it considered itself out of scope ends up in full non-compliance, since the circular applies in its entirety to all support PSFs, all specialised PSFs and POST Luxembourg in its capacity as a payment services provider.The scope trap: who is really coveredThe challenge is not reading the article, but correctly qualifying your status and measuring the gap against the full requirements. Concrete points of attention:A support PSF (client communication agent, primary or secondary IT systems operator) is subject to the entirety of 20/750, including ICT risk governance, logical and physical security, change management and continuity.Your LSF qualification (articles 29-1 to 29-6 for support PSFs) determines the applicable baseline: a classification error is paid for through corrective measures under a deadline imposed by the CSSF.The amendment by circular CSSF 25/881 aligns the text with DORA: financial entities must check which of the two frameworks prevails according to their status, with no grey zone.Outsourcing to a support PSF does not dilute responsibility: the principal remains responsible for supervising the ICT chain.How Luxgap automates this riskOur Luxgap Scope Qualifier definitively closes the scoping question: it automatically determines whether your entity falls under 20/750, under DORA, or both, and generates the map of applicable requirements article by article. A specialised AI agent reads your articles of incorporation, your CSSF authorisation, your Odoo outsourcing contracts and your activity register to qualify your LSF status (support PSF, specialised PSF, payment services provider) without you having to interpret the text yourself.Automatically classifies your entity against the LSF grid (articles 29-1 to 29-6) and confirms the full applicability of circular 20/750.Detects the interplay with DORA since the CSSF 25/881 amendment and flags which of the two frameworks prevails according to your authorisation.Generates an exhaustive compliance matrix covering each applicable ICT requirement (governance, logical security, continuity) mapped to your real perimeter.Scans your outsourcing contracts to support PSFs and alerts on the supervision responsibilities that remain enforceable against you.Produces a timestamped PDF report, enforceable before the CSSF during an inspection, demonstrating that your scoping is documented and justified.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your perimeter. Request a tailored quote and our teams will prepare a demonstration on your actual authorisation, with a fre...

Chapitre 1 - Les entités relevant du champ d’application

They trust us

Before we chat