Luxembourg’s Financial Sector Supervisory Commission (CSSF) announced in a that it had imposed an administrative fine of €152,100 on the professional of the financial sector Post Luxembourg (Post Finance). The fine, which was imposed on 19 February 2024, was for “breaches of professional obligations concerning the establishment of a central electronic data retrieval system related to Iban accounts and safe-deposit boxes” under the CBRA law.

The CSSF noted that the breaches of professional obligations were specifically related to the fact that not all payment accounts and bank accounts identified by an Iban were reported to the CSSF as part of the CBRA law (due to the use of an incorrect date criteria in data extractions) and that the quality of certain data reported to the CSSF was not sufficient.

The administrative fine came after a CSSF on-site inspection that took place between February and October 2023 at the Post Luxembourg business unit Post Finance on IT risk, said the communiqué from the financial sector’s regulator. It took into account “the gravity and duration of the infringements--which were deemed very high, considering the volume of impacted data, the persistency of the breaches since at least 2021 and the repetitive communication of these facts to the entity--as well as the financial situation of the legal person held responsible for the breaches.”

The CSSF has also taken into consideration the fact that Post Finance “undertook corrective actions in order to resolve certain of the breaches identified.”

Delano contacted Post Luxembourg for comment. In a statement, Post said: “The CSSF has imposed an administrative sanction against Post Finance due to failures in the transmission of data to the CSSF. The observation of these failures is in no way contested by Post Finance. These failures were dealt with without delay to ensure compliance of the Post Finance system with the regulatory requirements for the transmission of its customers’ data to the central electronic system for searching data concerning Iban accounts and safe-deposit boxes. Post Finance would like to underline its full cooperation with the CSSF in its supervisory missions.”