How to comply with article Annexe of CSSF 22/806?

Question

I need to bring my Luxembourg organisation into compliance with article Annexe of CSSF 22/806 (CSSF 22/806). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThis annex is not a mere documentary cross-reference: it defines the European normative foundation that the CSSF transposes and makes binding in Luxembourg. The classic trap is to treat Circular 22/806 as a standalone text while ignoring that the CSSF sanctions non-compliance with the EBA/GL/2019/02 Guidelines (outsourcing) and the ESMA Cloud Guidelines (ESMA50-164-4285) that it integrates by reference. Since the amendments by CSSF 25/883 and then 26/915, the articulation with the DORA Regulation (EU 2022/2554), applicable since 17 January 2025, creates a double layer of obligations: institutions still steering their ICT outsourcing on the old version of the circular end up out of step on the DORA register of information and on the reinforced contractual clauses.The normative references your framework must traceThe EBA/GL/2019/02 Guidelines require a complete register of outsourcing arrangements, distinguishing critical or important functions.The ESMA Cloud Guidelines (ESMA50-164-4285) specifically govern cloud outsourcing, with requirements for exit strategy and effective audit rights.The CSSF Circular 21/777 (amending 17/654) has been absorbed: your documentation must reflect the consolidated 22/806 version, not the repealed texts.The CSSF 25/883 and 26/915 amendments align the framework with DORA: register of information, prior notification of critical outsourcing, minimum contractual clauses.The support PFS (articles 29-3, 29-5, 29-6 of the LSF) remain in scope as ICT subcontractors of the financial sector.The test the CSSF applies during an inspection is simple: can you demonstrate, entity by entity and contract by contract, compliance with the correct corpus as of the applicable date ? A register frozen on an earlier version is enough to materialise a gap.How Luxgap automates this riskOur Luxgap Outsourcing Compliance Radar makes it impossible for a gap to open between your internal framework and the normative corpus actually in force. A specialised AI agent continuously monitors EBA, ESMA and CSSF publications, cross-checks each new version (25/883, 26/915) against your outsourcing register, and alerts you as soon as a contractual clause or a register requirement becomes obsolete in light of DORA.Automatically detects obsolete normative references in your outsourcing contracts by cross-checking your contract base (Odoo, SharePoint M365) with the consolidated version of the circular.Classifies each arrangement as critical or important under the EBA/GL/2019/02 grid and flags those falling into the scope of the DORA register of information.Verifies the presence of the minimum clauses required by the ESMA Cloud Guidelines: audit rights, exit strategy, data location, subcontracting chain.Generates the DORA register of information pre-filled, aligned with the technical templates applicable since 17 January 2025.Alerts in real time via Teams as soon as a change in a circular or ESA Guideline affects one of your ICT providers or...

Annexe - Liste des Orientations des ESA mises en œuvre

They trust us

Before we chat