Introduction
The publication of the CSSF Annual Report 2025 provides valuable insight into the supervisory priorities, emerging risks and regulatory expectations that will shape the Luxembourg financial sector in the coming years. The report highlights key developments across governance, artificial intelligence, operational resilience, outsourcing, cybersecurity and financial innovation.
For Boards, Conducting Officers, Executive Management, Risk, Compliance and Internal Audit functions, the CSSF Annual Report 2025 offers important indications of where supervisory attention is likely to increase and where institutions should strengthen their control frameworks.
Rather than providing a chapter-by-chapter summary of the report, this article focuses on five key takeaways from the CSSF Annual Report 2025 and their practical implications for Luxembourg financial institutions.
What is the CSSF Annual Report 2025 telling Financial Institutions?
While the CSSF Annual Report 2025 covers a wide range of supervisory activities, several recurring themes emerge throughout the report:
- Strong governance remains fundamental.
- Artificial intelligence is becoming a major supervisory topic.
- Operational resilience and cybersecurity continue to be key priorities.
- Outsourcing and third-party dependencies remain under heightened scrutiny.
- Control functions must adapt to increasingly complex risks.
These themes should be carefully considered when reviewing governance arrangements, risk management frameworks, compliance programmes and internal audit plans.
1. Artificial intelligence has become a Governance, Risk and Control issue
One of the strongest messages emerging from the CSSF Annual Report 2025 is that Artificial Intelligence is no longer simply an innovation topic. The CSSF identifies AI-related risks including model governance, accountability, cybersecurity, operational resilience, financial crime, data quality and third-party concentration risks.
The report also emphasises the role of Boards and Executive Management in understanding AI-related risks and ensuring appropriate oversight mechanisms are in place.
What this means for Governance, Risk, Compliance and Internal Audit
- Governance: Board oversight of AI use cases and AI strategy.
- Risk Management: Inclusion of AI-related risks within enterprise risk assessments.
- Compliance: Monitoring evolving regulatory requirements including the EU AI Act.
- Internal Audit: Independent review of AI governance frameworks, controls and accountability structures.
What financial institutions should do:
- Develop an AI governance framework.
- Establish an inventory of AI use cases.
- Clarify accountability and ownership.
- Review third-party AI dependencies.
- Incorporate AI within audit and compliance monitoring plans.
2. Operational resilience and DORA remain key supervisory priorities
The CSSF Annual Report 2025 highlights growing cyber threats, technology dependencies and operational vulnerabilities facing financial institutions. A successful implementation of DORA is presented as a significant regulatory milestone.
There is an expectation of the regulator to move beyond compliance projects and demonstrate sustainable operational resilience capabilities.
What this means for Governance, Risk, Compliance and Internal Audit
- Governance: Oversight of operational resilience and ICT risk.
- Risk Management: Effective identification and monitoring of ICT-related risks.
- Compliance: Monitoring compliance with DORA obligations.
- Internal Audit: Independent assessment of operational resilience and ICT governance frameworks.
What financial institutions should do:
- Test resilience and recovery arrangements.
- Review DORA implementation programmes.
- Reassess ICT risk management frameworks.
- Strengthen incident management procedures.
- Review critical ICT service provider oversight.
3. Outsourcing remains under regulatory scrutiny
The CSSF Annual Report 2025 continues to highlight the risks associated with dependence on third-party providers and concentration risks within the financial sector. The report reinforces a long-standing supervisory principle: responsibility for outsourced activities always remains with the regulated entity.
What this means for Governance, Risk, Compliance and Internal Audit
- Governance: Effective oversight of outsourcing arrangements.
- Risk Management: Assessment of concentration and dependency risks.
- Compliance: Monitoring compliance with CSSF and DORA outsourcing requirements.
- Internal Audit: Assessment of outsourcing governance and monitoring frameworks.
What financial institutions should do:
- Review outsourcing risk assessments.
- Reassess criticality classifications.
- Strengthen monitoring of service providers.
- Review exit strategies and contingency arrangements.
- Ensure regular reporting to governing bodies.
4. Internal Audit coverage must remain aligned with risk
An important observation emerging from the CSSF Annual Report 2025 concerns outsourced internal audit arrangements. The report notes situations where fee pressure may contribute to insufficient audit coverage and weaker follow-up of recommendations.
This observation raises a broader governance question:
Is internal audit coverage determined by risk, or by budget?
We know what the answer should be.
What this means for Governance, Risk, Compliance and Internal Audit
Boards should understand the relationship between available audit resources and the assurance that can be provided.
Internal Audit should remain risk-driven and continuously demonstrate its value through meaningful insights, challenge and recommendations.
What financial institutions should do:
- Review audit plans against risk assessments.
- Assess assurance coverage of key risks.
- Ensure adequate follow-up of recommendations.
- Revisit resource adequacy discussions.
- Focus audit effort on areas of greatest risk exposure.
5. Technology transformation is accelerating
The CSSF Annual Report 2025 discusses several technological developments that are likely to shape the future of financial services, including Artificial Intelligence, tokenisation, distributed ledger technology and quantum computing.
The message is clear: institutions must ensure that governance frameworks evolve alongside technological innovation.
What this means for Governance, Risk, Compliance and Internal Audit
Control functions will increasingly need to assess risks arising from new technologies while ensuring appropriate governance frameworks are in place.
What financial institutions should do:
- Incorporate emerging technology risks into strategic risk assessments.
- Review governance arrangements surrounding technology initiatives.
- Enhance skills within control functions.
- Develop future-focused audit and compliance capabilities.
- Ensure oversight frameworks evolve with technological change.
You can find the publication here.
Conclusion: Key Lessons from the CSSF Annual Report 2025
The CSSF Annual Report 2025 reinforces a consistent message: financial institutions must ensure that governance, risk management, compliance and internal audit functions evolve at the same pace as the risks they are expected to manage. Whether the topic is Artificial Intelligence, DORA, operational resilience, outsourcing or internal audit effectiveness, the CSSF’s focus is increasingly on demonstrating that governance frameworks operate effectively in practice rather than merely exist on paper. This is aligned with the COSO approach to governance.
At Excelsia, we help Luxembourg financial institutions translate regulatory expectations into practical governance, risk, compliance and internal audit solutions. From AI governance assessments and readiness reviews to outsourced internal audit and risk-based assurance planning, our objective is simple: helping Boards and Management strengthen governance where it matters most for a forward-looking sustainable business.
