The CSSF’s professional secrecy and its legal exceptions

As a result of the questioning that arose as regards the legal provisions limiting the possibility for the CSSF to communicate publicly about the execution of its supervisory missions or as regards multiple publications of administrative sanctions, this communiqué aims to clarify or, at least, remind you of the legal framework applicable to the CSSF’s professional secrecy and its exceptions.

In this context, it should be borne in mind that the CSSF exercises its missions exclusively in the public interest¹ in accordance with Article 20(1) of the Law of 23 December 1998 establishing a financial sector supervisory commission (“Commission de surveillance du secteur financier”) (“Organic Law”).

The financial sector supervisory mission of the CSSF necessarily implies that the persons working for the authority are custodians of confidential information, the disclosure of which could have considerable consequences for the financial system. Consequently, a strict legal framework of the confidentiality rules within the CSSF is one of the bases essential to establish mutual trust between the supervisory authority and the supervised persons, and to preserve lasting stability of the Luxembourg financial system.

The need for such degree of confidentiality, between an authority and the supervised persons, has also been highlighted multiple times by the Court of Justice of the European Union.² Professional secrecy does not exist primarily to protect the supervisory authority, but mainly to allow the supervised persons to share with complete confidence all the necessary information with the authority, so that the latter can correctly exercise its supervision. A large amount of this information transmitted to the authority is subject to business confidentiality for the supervised entities and, in principle, this information must always remain confidential.

Whereas the CSSF may also be confronted with the identification of possible criminal offences when exercising its missions, such an obligation for confidentiality is especially necessary in order to cooperate with the judicial authorities so as to preserve notably the instruction secrecy, ensuring thus a coordinated and efficient response in case of reproachable behaviour likely to prejudice it, at administrative as well as criminal level.

The professional secrecy obligation of the CSSF is laid down in Article 16 of the Organic Law, on pain of sanctions provided for in Article 458 of the Penal Code.³

This principle is also defined, for the supervised entities, in each sectoral law governing the financial sector for which the CSSF is the competent authority.⁴ Article 458 of the Luxembourg Penal Code establishes the professional secrecy as mandatory public policy, criminally sanctioning its breach by persons who are bound by it.

Any infringement of this obligation is thus sanctioned under Article 458 of the Penal Code providing notably for, in case of an offence, a penalty of imprisonment of eight days to six months and a fine between EUR 500 and EUR 5,000.⁵

In that regard, according to the Luxembourg case law in force, the confidential information concerned by this obligation is that which, by nature and its link with the natural or legal person concerned, must legitimately remain secret and which was entrusted or obtained in a professional context creating a duty of silence. Any infringement of that duty will be criminally sanctioned.

Pursuant to its mission of supervising financial sector players, the CSSF has thus to collect and hold information subject notably to business secrecy (e.g. in the framework of acquisitions or disposals of holdings in supervised entities), financial information (e.g. information on banking or investment accounts), or even information directly linked to its investigatory and sanctioning power.

Thus, the CSSF’s professional secrecy is not only a simple personal obligation of discretion or prudence, but a real institutional confidentiality regime attached to the data collected by the CSSF in the exercise of its missions, which is criminally sanctioned.

Whereas the CSSF’s professional secrecy is mandatory public policy, all the exceptions to this principle must be expressly laid down in law, which allows or even requires the publication of some information.

The CSSF’s professional secrecy is not absolute. First, Article 458 of the Penal Code already regulates two clear general exceptions: the first exception is the case where the person is ordered to give testimony in legal proceedings (or in an inquiry committee with extended judicial powers); and the second one is where the law requires or authorises the person to disclose his/her secrets. Consequently, besides these cases laid down in the Penal Code, the disclosure of confidential information remains punishable.

In that regard, some special texts provide for specific legal derogations from the CSSF’s professional secrecy.

In this context, Article 16 of the CSSF’s Organic Law expressly provides for derogations from the obligation of professional secrecy imposed on the supervisory authority, especially in the framework of exchange of information with other authorities (notably within the European Union, for example in the framework of the Single Supervisory Mechanism). However, these exceptions are governed by strict cumulative conditions laid down in the text, such as the reciprocity of the secret at the level of the recipient authority, the necessity of information in the framework of the exercise of their mission but also the restriction of their use for the purpose announced in the framework of this exchange.

Another exception may be highlighted in the “cases governed by criminal law” (within the meaning of Article 16 of the Organic Law and the applicable case law) where a document in an administrative file of a citizen is subject to the CSSF’s professional secrecy.

In such a case, the CSSF cannot risk disclosing confidential information concerning third parties as the damages resulting from such disclosure could be irreparable for the latter. The authority will ensure then to communicate only the extracts it deems relevant.⁶

Ultimately, the jurisdiction seized must weigh up the defence rights and the necessity for the authority to comply with the professional secrecy in order to find a balance between the opposing interests of the parties and, where applicable, require the CSSF to go beyond its legal obligations related to secrecy by providing the information requested by the citizen to the judge seized.⁷

In the framework of the exercise of its missions, the CSSF must also meet a transparency and protection duty towards the supervised entities as well as all the financial sector players, including consumers.

This transparency duty justifies therefore, under defined conditions and strictly limited by law, that the CSSF derogates from its legal confidentiality obligation to meet best interest objectives, notably with respect to administrative sanctions.

In this context, the nominative publication of administrative sanctions adopted by the financial sector supervisory authority such as the CSSF constitutes a principle set by the legislator of the European Union aiming notably to enhance the dissuasive effect of administrative sanctions, to inform the public of the applicable rules, and also to report on the authority’s effective exercise of the sanctioning powers in response to behaviours that could risk jeopardising the integrity and stability of the financial sector.

This principle is now laid down in the vast majority of applicable European directives and regulations and has been transposed in Luxembourg in different sectoral laws applicable to the financial sector that the CSSF ensures that they are properly applied. It is regulated by the requirements of the principle of lawfulness and principle of proportionality which determine the strict legal conditions and limits under which the decisions of the CSSF may be disclosed to the public.

Consequently, the administrative sanctions imposed by the CSSF on entities it supervises must, in principle, be published on a nominative basis, subject to some strict legal exceptions as confirmed by the case law of the General Court of the European Union⁸ and followed by the Luxembourg juge administratif (administrative judge).

These exceptions apply, according to the applicable legal framework, notably when the nominative publication is likely to jeopardise the stability of the financial markets or an ongoing investigation or where it risks causing disproportionate harm to the person concerned.

In the latter case, the CSSF weighs up the interests involved which are, on the one hand, the potential harm suffered by the natural or legal person due to the nominative publication of the administrative sanction and, on the other hand, the public interest, namely ensure the dissuasive effect of the sanction, avoid committing new infringements and inform the public and take into account that third parties have been possibly harmed by the infringements.

The CSSF ensures that in each individual case no exception provided for in the applicable legal framework in relation to the publication is met and performs, prior to any decision with respect to the publication of a sanction, an analysis of the matters of law and of fact in the file that has been brought to its knowledge, in accordance with the adversarial principle.

The applicable legal framework provides for the possibility to defer the nominative publication or to proceed with an anonymous publication where one of the legal exceptions is met.

The publication of administrative sanctions by the CSSF is set in a specific legal framework under which the CSSF complies with the competences attributed to it, the principle of lawfulness and principle of proportionality as well as the guarantees attached to professional secrecy and remains, in any case, subject to control by the administrative jurisdictions.

All the principles, legal and regulatory provisions and case laws governing the CSSF’s professional secrecy ensure a rigorous and coherent application of the confidentiality obligation without leaving room for arbitrariness, while taking into account the transparency duty and the ensuing publication obligations regarding sanctions, as well as the best interest objectives inherent in the CSSF’s mission of supervision of the financial sector.

In this framework, the CSSF exercises its mission with rigour, transparency and responsibility in strict compliance with the law and the guarantees of the rule of law.