CSSF ¦ The CSSF's Professional Secrecy and its Legal Exceptions

The CSSF restates the limits of its professional secrecy and why sanctions are published by name

Luxembourg’s financial supervisor, the Commission de Surveillance du Secteur Financier (CSSF), has set out, in French only, the legal framework governing its professional secrecy and the exceptions to it. The clarification responds to questions about why the authority says so little in public about its supervisory work while publishing a growing number of administrative sanctions. Both follow from one principle. Secrecy is the rule and is protected by criminal law, so every disclosure, including the naming of sanctioned firms and individuals, needs an express legal basis.

Secrecy serves the supervised, not the supervisor

The CSSF acts exclusively in the public interest, as Article 20(1) of its organic law of 23 December 1998 provides. Supervision depends on firms sharing information they would never disclose to anyone else, and much of that information is covered by business secrecy. Without a strict confidentiality regime, supervised entities would have little reason to be candid with the authority.

The CSSF stresses that professional secrecy exists mainly to protect that flow of information, so that supervised persons can share everything the supervisor needs in confidence. The Court of Justice of the European Union has made the same point repeatedly, notably in Baumeister (C-15/16), UBS Europe (C-358/16) and Buccioni (C-594/16), all decided in 2018.

Confidentiality also matters where supervision uncovers possible criminal offences. When the CSSF works with judicial authorities, secrecy protects the confidentiality of the criminal investigation, so that administrative and criminal responses can be coordinated. In financial crime cases, early disclosure could alert suspects and give them time to move assets.

Bastian Schwind-Wagner _Follow

"The CSSF is drawing a clear line: what firms tell their supervisor stays protected by criminal law, but what the supervisor decides against them becomes public. Both rules follow from the same principle that every disclosure needs an express legal basis, and the courts have backed the authority on both.

For firms in enforcement proceedings, the practical consequence is to treat publication as the default outcome. Anyone hoping for deferral or anonymity needs to raise it early and bring evidence that fits the narrow statutory grounds, because reputational harm alone will rarely be enough."

A criminally sanctioned, institutional duty

The obligation itself is laid down in Article 16 of the organic law. Members of the CSSF’s bodies, its approved statutory auditor and anyone who works or has worked for the authority must keep confidential information received in the course of their duties secret. That information may only be disclosed in summary or aggregate form that prevents individual supervised entities from being identified, without prejudice to cases covered by criminal law.

Breaches are punishable under Article 458 of the Luxembourg Criminal Code, which makes professional secrecy a matter of public policy and provides for imprisonment of eight days to six months and a fine of €500 to €5,000. Equivalent secrecy provisions apply under the sectoral laws for which the CSSF is the competent authority, including the Law of 5 April 1993 on the financial sector, the Law of 17 December 2010 on undertakings for collective investment, the Law of 10 November 2009 on payment services, the Law of 12 July 2013 on alternative investment fund managers and the Law of 30 May 2018 on markets in financial instruments.

The CSSF describes its secrecy as an institutional confidentiality regime attached to the data it collects, covering business secrets such as information on acquisitions and disposals of qualifying holdings, financial data such as bank account and investment information, and information linked to its investigative and sanctioning powers. Because this secrecy is a matter of public policy, every exception must be expressly provided for by law. Under Luxembourg case law, protected information is information that, by its nature and its link to the person concerned, must legitimately remain secret and was obtained in a professional context that creates a duty of silence.

Two general exceptions in the Criminal Code

Article 458 of the Criminal Code itself contains two general exceptions. The first applies when a person is called to testify in court, or before a commission of inquiry with extended judicial powers. The second applies where the law requires or authorises disclosure. Outside those cases, revealing confidential information remains a criminal offence. Specific statutes then define the situations in which the CSSF may or must depart from its secrecy.

Information exchange with other authorities

Article 16 of the organic law expressly allows the CSSF to exchange information with other authorities, in particular within the European Union and in the framework of the Single Supervisory Mechanism. These exchanges are subject to strict cumulative conditions: the receiving authority must be bound by equivalent secrecy, the information must be necessary for the performance of its tasks, and it may only be used for the purpose stated when it was shared.

Cross-border AML/CFT supervision depends on authorities passing findings to each other, and the conditions attached to those exchanges determine how far information provided by a Luxembourg firm can travel.

The rights of the defence

A further exception concerns cases falling within criminal law, as interpreted by the case law on Article 16, where a document in a party’s administrative file is covered by the CSSF’s secrecy. The CSSF will not risk disclosing confidential information about third parties, since the harm could be irreparable, and will communicate only the extracts it considers relevant, relying on Article 13 of the Grand-Ducal Regulation of 8 June 1989 on administrative procedure.

The final decision rests with the court. Following UBS Europe, the national court must check whether the information sought has an objective link to the grievances against the person concerned. If it does, the court balances that person’s interest in a full defence against the interest in keeping the information confidential, and it may order the CSSF to disclose specific items to the court.

For firms and individuals facing CSSF enforcement, this means access to the authority’s file is not unlimited. Third-party information, including data on other supervised entities, is protected, and contested access requests end up before the administrative courts.

Publication of sanctions is the rule, anonymity the exception

For the market, the publication of administrative sanctions matters most. The CSSF explains that its duty of transparency toward supervised entities, market participants and consumers justifies a departure from secrecy in conditions defined and strictly limited by law.

Publication of sanctions by name is a principle set by the EU legislator in most of the applicable directives and regulations and transposed into the Luxembourg sectoral laws. Its purposes are to strengthen the deterrent effect of sanctions, to inform the public about the applicable rules and to show that the supervisor actually uses its sanctioning powers against conduct that threatens the integrity and stability of the financial sector.

As a result, administrative sanctions imposed by the CSSF must in principle be published by name. The CSSF points to the General Court’s judgment of 8 July 2020 in VQ v ECB (T-203/18) and to the Luxembourg Administrative Court’s judgment of 19 July 2023 (No 48647C). In the latter, the court described the publication of sanctions under the provision at issue as systematic, with anonymous publication in three defined situations as the only qualification.

When publication can be delayed or anonymised

The exceptions depend on the applicable legal framework. They typically apply where publication by name could jeopardise the stability of financial markets or an ongoing investigation, or would cause disproportionate harm to the person concerned. In the last case, the CSSF weighs the potential harm to the sanctioned person against the public interest in deterrence, the prevention of further breaches, public information and the fact that third parties may have suffered from the breaches.

Before any decision on publication, the CSSF examines the legal and factual elements of the file in an adversarial procedure and checks whether any statutory exception applies. Where one does, the law allows it to defer publication or publish anonymously. The publication decision remains subject to review by the administrative courts.

What this means for supervised entities

The CSSF has not introduced new rules, yet the practical conclusion for firms is plain. They should expect any administrative sanction, including sanctions for AML/CFT failings, to be published with their name unless they can show that one of the narrow statutory exceptions applies. Reputational damage alone will be weighed against a strong public interest in transparency, and the case law cited by the CSSF backs systematic publication.

Firms facing enforcement proceedings should therefore address publication early, within the adversarial phase, and support any request for deferral or anonymity with concrete evidence that falls within the statutory grounds. They should also prepare their communication with clients, counterparties and investors on the assumption that the sanction will become public.

The same framework works in their favour in other respects. Information they disclose to the CSSF in the course of supervision is protected by criminal law, may only be shared with other authorities under strict conditions, and does not become public outside the narrow channels the law provides.

Dive deeper

• CSSF ¦ The CSSF’s professional secrecy and its legal exceptions (only in French) ¦ Link