How to comply with article III of CSSF 22/806?

Question

I need to bring my Luxembourg organisation into compliance with article III of CSSF 22/806 (CSSF 22/806). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe application date is not a mere calendar formality: it is the first thing the CSSF checks during an on-site review. Many in-scope entities (banks, investment firms, payment and e-money institutions, support PSF, CSSF-regulated fintechs) treated 30 June 2022 as a theoretical go-live date and never went back over their legacy outsourcing arrangements. The trap is twofold: first, the obligation to remediate retroactively at the first renewal (no later than 31 December 2022), and second, the obligation to proactively inform the CSSF in good time when the remediation of critical or important functions cannot be completed. Failing to notify that delay is itself a breach.The calendar traps the CSSF sanctionsBelieving only new contracts signed after 30 June 2022 are in scope: the text requires reviewing and amending the entire legacy stock.Forgetting the DORA layer: since 17 January 2025, circular 22/806 (amended by CSSF 25/883 then 26/915) interlocks with Regulation DORA (EU 2022/2554) for ICT arrangements, with reinforced register requirements.Not dating or tracing remediation contract by contract, which makes it impossible to prove compliance at the first renewal deadline.Neglecting the proactive notification to the CSSF for unfinished critical functions, including catch-up measures and any exit strategy.Ignoring that a documented exit strategy must exist for each critical arrangement, even when remediation is running late.How Luxgap automates this riskOur Luxgap Outsourcing Remediation Tracker turns your stock of outsourcing arrangements into an opposable timeline, where each contract carries its renewal date, its compliance status and its remediation evidence. The tool pulls your contracts directly from your document management (M365 SharePoint, Odoo, eBRC) and cross-checks each arrangement against the requirements of circular 22/806 as amended, without asking your compliance officer to re-enter a single deadline.Automatically detects each outsourcing arrangement and its renewal date by reading contracts stored in SharePoint, Odoo or your DMS via a specialised LLM agent.Classifies each arrangement as important or critical under the circular grid and the EBA/GL/2019/02 guidelines, and flags those also falling under DORA.Calculates remediation status contract by contract and alerts in real time when a renewal approaches without documented compliance.Generates the pre-filled CSSF notification letter for any critical function whose remediation will not be completed, including planned measures and exit strategy.Produces a timestamped, sealed PDF report, opposable to the CSSF during a review, demonstrating compliance with the Part III deadlines.Available as an add-on to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real arrangements, with a free blind audit within 48h to measure your exposure before any commitment.

Partie III - Date d’application

They trust us

Before we chat