How to comply with article 4 of CSSF 25/893?

Question

I need to bring my Luxembourg organisation into compliance with article 4 of CSSF 25/893 (CSSF 25/893). What are the concrete requirements, the sanctions, and how can Luxgap support me?

Accepted Answer

The classic trapThe application dates of a CSSF circular look harmless, but this is exactly where entities get caught during an inspection. Chapter 4 of CSSF 25/893 creates a two-speed regime: immediate effect for entities under points 1a) to j) and l), but a six-month transitional period for account information service providers (point 1k). During this transition, applying the wrong incident notification framework, believing that CSSF 24/847 or CSSF 21/787 is still valid when it has been repealed for your category, exposes you to a failure to notify a major incident within DORA deadlines. The CSSF sanctions late or missing notification, not just the substance of the incident.The trap of overlapping transitional regimesEntities under 1a) to j) and l) switch immediately to DORA: CSSF 24/847 becomes inapplicable and CSSF 21/787 (EBA/GL/2021/03 Guidelines, PSD2) ceases to apply from publication.Entities under 1k) (account information service providers) keep the classification criteria and notification arrangements of the old circulars for six months.CSSF 21/787 will be formally repealed six months after publication: any internal procedure still referencing it must be rewritten before that deadline.The major operational risk: a compliance team applying the PSD2 classification threshold when the DORA threshold (Article 18 of Regulation 2022/2554) is now required, or the reverse depending on your exact category.Your entity qualification (1a-j, 1k or 1l) mechanically determines which channel, format and deadline bind you: a misclassification is a compliance failure.How Luxgap automates this riskOur Luxgap Regulatory Timeline Tracker eliminates the risk of switching to the wrong notification framework by automatically managing your regulatory deadlines according to your exact CSSF entity category. The tool maps your status (point 1a-j, 1k or 1l) to the correct regime, calculates the repeal date of the CSSF 24/847 and 21/787 circulars applicable to your profile, and triggers alerts before each switch, drawing on your internal M365, Confluence and GRC repositories.Classifies your entity into the correct CSSF category and automatically determines whether you fall under immediate effect or the six-month transitional period.Calculates and displays the countdown to the repeal of CSSF 21/787 and the full switch to the DORA notification framework.Detects in your internal incident notification procedures (SharePoint, Confluence, GRC wiki) any obsolete reference to CSSF 24/847 or 21/787 and flags the documents to be rewritten.Alerts your compliance team via Teams as soon as a transitional deadline approaches, with the correct notification channel and deadline to apply.Produces a timestamped PDF report enforceable before the CSSF, demonstrating that your notification setup follows the correct framework at each key date.Available as a complement to a Luxgap CISO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our te...

Chapitre 4 - : Date d’application

They trust us

Before we chat