How to comply with article 3 of CSSF 25/880?

Question

I need to bring my Luxembourg organisation into compliance with article 3 of CSSF 25/880 (CSSF 25/880). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe immediate effect wording of article 12 is the most underestimated trap in CSSF circular 25/880. Unlike DORA texts that come with transition periods, the CSSF grants no compliance grace period here: since 9 April 2025, every PSP under the LSP (law of 10 November 2009) is expected to apply the expectations on payment service user (PSU) relationship management and ICT assessment (the PSP ICT Assessment). In practice, the CSSF penalises institutions that treat an immediate-effect circular as a medium-term objective, especially during on-site inspections or thematic reviews where the absence of a dated implementation trail is flagged immediately.Why immediate effect is a concrete operational riskNo grace period: compliance must be demonstrable as of 9 April 2025, not at the next budget cycle.The burden of proof sits with the PSP: you must show when and how each requirement was embedded.The reference to EBA Q&A no. 2018_4176 forces continued alignment with the European interpretation even after entry into force.The interplay with the DORA package creates a calendar-confusion risk: a deferred DORA requirement does not excuse an immediate CSSF 25/880 requirement.During an inspection, the absence of a timestamped register of compliance actions is read as non-application.How Luxgap automates this riskOur Luxgap Circular Effective-Date Tracker makes it impossible to miss an immediate-effect CSSF circular by turning every regulatory publication into a timestamped, defensible action plan. The tool continuously monitors the CSSF and EBA publication feeds, breaks circular 25/880 into atomic requirements, and cross-references each one against your real evidence pulled from M365, SharePoint, your GRC and your Jira or ServiceNow tickets, without asking your compliance officer to fill in a single spreadsheet.Automatically detects each new CSSF circular and its application-date clause, and alerts your compliance team on Teams as soon as it is published.Breaks CSSF 25/880 into unit requirements (PSU relationships, PSP ICT Assessment) and links each to an owner and a deadline.Scans your M365 and SharePoint document stores to automatically map existing evidence to each requirement and flag the gaps.Verifies alignment with the cited EBA Q&A (no. 2018_4176) and flags any interpretation divergence.Calculates a coverage score per circular and separates immediate-effect requirements from deferred DORA requirements.Produces a timestamped, cryptographically sealed PDF report, defensible before the CSSF, proving the exact implementation date of each requirement.Available as an add-on to a Luxgap DPO or CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real perimeter, with a free blind audit within 48h to measure your exposure before any commitment.

Chapitre 3 - Date d’application

They trust us

Before we chat