How to comply with article M.5 of CSSF 25/883?

Question

I need to bring my Luxembourg organisation into compliance with article M.5 of CSSF 25/883 (CSSF 25/883). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe phrase immediate effect is deceptively simple. CSSF 25/883 applies from 9 April 2025, but it does not create a new standalone framework: it amends CSSF 22/806 and shifts part of the ICT requirements under the DORA regulation, applicable since 17 January 2025. The trap sanctioned in practice is steering on an outdated version of the text. Entities that keep applying the old CSSF 22/806 (with its now-deleted EEA cloud clauses) or that ignore the interplay with CSSF 25/882 end up out of step during an on-site CSSF inspection, with internal policies referencing repealed obligations or missing the DORA cross-references.The pitfalls of multi-circular consolidationSteering on the 25/883 PDF alone: its annex reproduces the amended 22/806, but the truly enforceable consolidated version also incorporates the later amendments from CSSF 26/915.Keeping in your internal policies the specific cloud contractual clauses (EEA applicable law, EEA resilience) now deleted because covered by DORA.Reading 25/883 without reading CSSF 25/882 jointly on third-party ICT services for DORA entities.Misclassifying your entity across the 4 restructured cases (DORA entity, non-DORA, withdrawn, art. 125-1 UCITS management company) and applying the wrong regime.Forgetting that the sanctions regime remains that of 22/806, augmented by DORA sanctions (up to 1% of average daily turnover) for the ICT requirements that shift.How Luxgap automates this riskOur Luxgap Circular Version Tracker makes steering on an outdated text impossible: it permanently maintains the enforceable consolidated version of your CSSF circulars and alerts you whenever an amendment affects an article your internal policies cite. The tool cross-references the CSSF regulatory repository, your governance documents stored in M365 or SharePoint, and a specialised LLM agent that reads your ICT policies and detects references to repealed clauses.Automatically reconstructs the real consolidated version of CSSF 22/806, incorporating the successive amendments from circulars 25/883 and 26/915, with a concordance table.Scans your internal policies stored in SharePoint and Odoo and highlights every reference to a deleted clause (EEA cloud clauses) or to an article moved under DORA.Classifies your entity into one of the 4 restructured cases and generates the mapping of effectively applicable obligations, distinguishing the 22/806 regime from the DORA shift.Alerts in real time via Teams as soon as a new CSSF circular amends a text you cite.Produces a timestamped PDF report, enforceable before the CSSF, demonstrating that your documentary corpus reflects the up-to-date consolidated version during an on-site inspection.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a tailored quote and our teams will prepare a demonstration on your real policies, with a free blank audit within 48h to measure your exposure before any commitment.

Entry into force, signatories and annex

They trust us

Before we chat