How to comply with article 3 of CSSF 25/880?

Question

I need to bring my Luxembourg organisation into compliance with article 3 of CSSF 25/880 (CSSF 25/880). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapImmediate effect is the phrase that kills any comfortable remediation roadmap. The CSSF grants no transition period on circular 25/880: since 9 April 2025, your USP relationship management processes and your PSP ICT Assessment must be aligned. In practice, compliance teams discover the maturity gap during an on-site inspection or annual questionnaire, and the CSSF sanctions less the missing content than the absence of a documented and dated remediation plan. For PSPs under the LSP, the interplay with DORA (applicable since 17 January 2025) creates a scissor effect: two frameworks enforceable simultaneously, with no grace period.The immediate effect trap on CSSF circularsNo grandfathering clause: existing USP contracts must be reassessed, not only new ones.Compliance evidence is built retroactively from 9 April 2025: any subsequent incident, complaint or audit will be analysed under the new framework.The PSP ICT Assessment must be available on first request from the CSSF, with no additional production delay.The DORA / LSP / 25/880 interplay creates cumulative obligations: critical ICT third-party register, resilience testing, major incident management, USP information.The absence of a dated gap analysis before 9 April 2025 is in itself a negative indicator during an inspection.How Luxgap automates this riskOur Luxgap CSSF Circular Radar turns every CSSF publication into a dated and enforceable action plan, within 48 hours of release on the official register. The tool continuously monitors CSSF, BCL, ABBL and EBA publications, classifies each text by scope (PSP, bank, fund, support PFS), and automatically generates the gap mapping between your current procedures and the new framework by cross-referencing SharePoint, Confluence and your compliance DMS.Detects every new circular, FAQ or EBA Q&A on publication and links it to your institution's regulatory scope.Generates a dated article-by-article gap analysis, time-stamped and electronically signed, constituting proof of a proactive approach enforceable against the CSSF.Produces a remediation plan with milestones, named owners and deadlines aligned to the effective date (immediate, 3 months, 6 months), exportable to Jira or ServiceNow.Instantly alerts the Head of Compliance, DPO and CISO via Teams or Slack as soon as a circular affects a process already documented in your register.Automatically cross-references 25/880, DORA, LSP and NIS 2 requirements to avoid duplicate workstreams and identify shared controls.Archives an inspection-ready file for the CSSF: awareness timeline, management committee decisions, execution evidence.Available alongside a Luxgap CISO or Compliance Officer mandate or as a dedicated SaaS module depending on your regulatory scope. Request a tailored quote and our teams will prepare a demonstration on your real scope, with a free 48-hour blank audit to measure your exposure to the 25/880 + DORA package before any commitment.

Chapitre 3 - Date d’application

They trust us

Before we chat