How to comply with article 4 of CSSF 25/882?

Question

I need to bring my Luxembourg organisation into compliance with article 4 of CSSF 25/882 (CSSF 25/882). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapPoint 27 looks deceptively harmless: CSSF Circular 25/882 applies with immediate effect from 9 April 2025. Many Luxembourg financial entities read this as a mere administrative timestamp, when it actually means there is no transition period. The CSSF expects your ICT contractual arrangements register, your mandatory DORA clauses (Articles 28 and following) and your notification processes to be operational already. During a SREP review or a targeted inspection, the argument "we are finalising our compliance" does not hold: immediate effect makes every day of delay enforceable against you.What "immediate effect" actually meansThe register of information on ICT contractual arrangements (DORA ITS format) must be maintained and exportable on the CSSF's first request, with no grace period.Existing ICT contracts must already embed the mandatory clauses (audit rights, data localisation, exit strategies, subcontracting chains) or be covered by a documented and dated remediation plan.The classification of critical or important functions supported by ICT providers must be fixed and justifiable.The reference to Delegated Regulation (EU) 2024/1774 and the amendment by CSSF Circular 26/915 impose active regulatory monitoring: your ICT risk management framework must resynchronise as soon as a technical standard evolves.Notification of new or amended arrangements covering critical functions must follow the CSSF channel and timeline, without waiting for the annual review.The real risk is not missing a future date, it is believing you still have time when the deadline has already passed.How Luxgap automates this riskOur Luxgap DORA Contract Sentinel turns the "immediate effect" obligation into a continuous, provable compliance state rather than a permanent race against the CSSF calendar. An AI agent reads your supplier contracts stored in Odoo, SharePoint M365 or your DMS, extracts ICT providers, and checks each arrangement against the mandatory DORA clauses (Articles 28 to 30) and the practical requirements of Circular 25/882, without your compliance team filling in a single spreadsheet.Automatically detects each new ICT provider as soon as a contract or payment appears in Odoo, Sage BOB 50 or your M365 flows, and adds it to the register of information in DORA ITS format.Analyses every missing clause (audit right, data localisation, exit strategy, subcontracting chain) and proposes the ready-to-sign amendment template.Classifies each supported function as critical or important using the DORA grid and justifies the qualification in an enforceable way.Monitors in real time the evolutions of Delegated Regulation (EU) 2024/1774 and amending circulars such as CSSF 26/915, and alerts via Teams as soon as a clause in your contract portfolio becomes non-compliant.Prepares CSSF notifications for new or amended arrangements covering critical functions, with the expected content and timeline.Produces a timestamped register and a sealed PDF report, enforce...

Chapitre 4 - Date d’application

They trust us

Before we chat