The classic trap
Point III.2 is sanctioned by the CSSF not because the institution ignores its concentrations, but because it only measures them on the traditional balance sheet. In practice, supervisors flag the blind spot of cross-risk concentrations: a single cloud provider supporting core banking, regulatory reporting and payroll creates a massive operational concentration that nobody aggregates. The CSSF expects proactive identification, not an after-the-fact observation. The lack of a consolidated view across client, counterparty, country, sector and provider, including related parties, is the classic trigger for supervisory findings.
The invisible concentrations the CSSF looks for first
- Off-balance-sheet intra-risk concentration: guarantees, financing commitments, derivatives on the same counterparty.
- Concentration on connected groups of clients and related parties, often split across several systems and therefore never summed.
- Undeclared country or sector concentration because the sectoral mapping (NACE) is not kept up to date.
- Operational cross-risk concentration linked to outsourcing: a single provider bundling several critical functions (see also CSSF 22/806).
- Liquidity concentration on a small number of depositors or funding sources.
- Absence of formalised internal thresholds and documented breach alerts.
How Luxgap automates this risk
Our Luxgap Concentration Radar makes the concentration blind spot impossible by automatically aggregating your exposures by client, connected group, country, sector and provider, on and off balance sheet. The tool connects to your core banking, your third-party master data (Odoo, Sage BOB 50), your outsourcing contract register and your related-party references, then rebuilds every concentration cluster in real time, without asking the risk team to consolidate Excel exports by hand.
- Automatically detects connected groups of clients and counterparties through ownership and related-party analysis, summing exposures scattered across multiple systems.
- Computes on and off-balance-sheet intra-risk concentrations (guarantees, commitments, derivatives) by counterparty, country and NACE sector.
- Cross-references the outsourcing register with the application map to reveal operational cross-risk concentrations on a single provider.
- Alerts instantly on Teams or by email whenever an internal threshold is breached, including the three-month evolution path.
- Produces a timestamped PDF report enforceable before the CSSF, demonstrating the proactive identification and particular vigilance required by point III.2.
Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real data, with a free blind audit within 48h to measure your exposure before any commitment.
