How to comply with article M.0 of CSSF 25/881?

Question

I need to bring my Luxembourg organisation into compliance with article M.0 of CSSF 25/881 (CSSF 25/881). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThis preamble looks trivial, but it defines the exact scope of covered entities and the precedence of the English text in case of divergence. The trap the CSSF sanctions in practice is not reading the addressee list, it is the false assumption of non-applicability: a payment institution or an e-money institution assumes circular 20/750, now aligned with DORA through 25/881, does not concern it, or a Luxembourg branch believes it is covered by the group framework. During an inspection, the CSSF checks that the entity has formally documented its status under the LFS, the LPS and DORA, and that it applies the corresponding ICT risk management baseline.Scope pitfalls you must not overlookA professional of the financial sector (PFS) under the Law of 5 April 1993 is covered, including support PFS (client communication agents, IT systems operators) that are often forgotten.Payment institutions and e-money institutions under the Law of 10 November 2009 are explicitly targeted, even when operating under free provision of services.POST Luxembourg, for its postal financial services, falls within scope under the Law of 15 December 2000.In case of linguistic divergence, the English text prevails: any internal policy drafted solely on the French version must be cross-checked against the English version, otherwise an enforceable interpretation gap may arise.The interaction with DORA (EU Regulation 2022/2554) is direct: 25/881 aligns the 20/750 baseline with DORA requirements, so the entity must demonstrate consistent compliance across both frameworks, with no grey zone.How Luxgap automates this riskOur Luxgap Scope Qualifier removes the regulatory scope blind spot: it automatically determines which texts your entity is subject to (LFS, LPS, POST law, DORA, amended circular 20/750) and produces an enforceable map of your ICT obligations. The tool queries your legal entity repository (trade register, group structure in your ERP, declared CSSF authorisations) and cross-references each status with the applicable regulatory matrix, without your compliance team filling in a single form.Classifies each entity in your group (credit institution, PFS, support PFS, payment institution, EMI) under the LFS and LPS and derives the applicable ICT baseline.Detects forgotten or mis-qualified entities by cross-checking your CSSF authorisations against your actual legal org chart.Generates a mapping matrix between the requirements of the amended circular 20/750 and the DORA articles, flagging coverage gaps.Automatically compares the French and English versions of applicable texts and alerts when an internal policy relies on a divergent wording.Produces a time-stamped PDF report, enforceable before the CSSF during an inspection, demonstrating the formal qualification of scope and the applicable framework for each entity.Available as a complement to a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and ou...

Addressees and date

They trust us

Before we chat