i Sources of law
Given the high degree of harmonisation at the EU level regarding securities laws, the key sources of Luxembourg law in this area are mainly EU regulations, which are directly applicable in Luxembourg, and legal and regulatory texts that implement various EU directives into Luxembourg law. While Luxembourg's legal regulatory framework for securities markets contains ever more European legislation, Luxembourg continually strives for innovation and attractiveness through its national initiatives.
Financial Sector Act
A central piece of legislation for the financial sector is the Luxembourg act dated 5 April 1993 on the financial sector (the Financial Sector Act) transposing many EU directives and regulations (including both the Markets in Financial Instruments Directive and Regulation). As such, the Financial Sector Act regulates various aspects of the securities markets, including authorisation requirements for regulated markets, trade transparency obligation for shares, rules on the admission of financial instruments to trading, requirements on product governance and independent investment advice, and duty to provide information and reporting to clients of the investment firms.
Market Abuse Regulation
Another important legislation is Regulation (EU) 596/2014 (the Market Abuse Regulation), which governs the prevention, detection, investigation and punishment of insider dealing. Besides prohibitions on insider dealing, the Market Abuse Regulation also incriminates market manipulation. Stabilisation measures, buy-back programmes and market soundings must also be analysed in light of the market abuse regime. The Market Abuse Regulation is complemented by Directive 2014/57/EU on criminal sanctions for market abuse (CSMAD). CSMAD, together with certain provisions of the Market Abuse Regulation, was implemented into Luxembourg law by the Luxembourg Act dated 23 December 2016 on market abuse (the Market Abuse Act), which replaced the initial market abuse act from 2006. The Market Abuse Act has confirmed the Commission de Surveillance du Secteur Financier (CSSF) as the competent authority for supervision of the compliance with market abuse rules in Luxembourg. It also deals with the reporting of infringements of Market Abuse Act requirements (including whistleblowing) and the related criminal law provisions.
Information requirements for prospectuses for public offers and admission of transferable securities to trading on a regulated market in Luxembourg are governed by Regulation (EU) 2017/1129 (the Prospectus Regulation). Certain provisions of the Prospectus Regulation (such as the designation of competent authorities, their powers, and the sanctioning regime) were implemented by the Luxembourg act dated 16 July 2019 on prospectuses for securities (the Prospectus Act).
Issuers falling under the scope of the Luxembourg act dated 2008 (the Transparency Act) (which implemented European Directive 2004/109/EC dated 15 December 2004, as amended by Directive 2013/50/EU, on the harmonisation of transparency requirements into Luxembourg law) are obliged to disclose to the public their financial information, information on major holdings and information relating to general meetings and the exercise of voting rights. The latter requirement aims at ensuring equal treatment for all holders of securities that are in the same position.
Other sources of securities law and soft law
In addition to the above, there are various national laws that impact the Luxembourg securities markets. For instance, the amendments in 2016 to the Luxembourg act dated 1915 on commercial companies (the Companies Act) enabled additional types of companies to issue cleared and listed debt securities. These amendments have considerably increased the attractiveness of private limited liability companies as issuance vehicles. The Companies Act also sets out the rules governing bondholders meetings and managerial responsibility, as well as the rules for preparation of financial accounts and their approvals.
The Luxembourg act dated 6 April 2013 on dematerialised securities (the Dematerialisation Act) has modernised Luxembourg securities law by introducing a complete legal framework for dematerialised securities to keep pace with market developments. Accordingly, the dematerialised form of securities exists in addition to the traditional bearer and registered forms of securities. Dematerialised securities thus constitute a third type of securities, and an issuer will be free to choose from the three. The Dematerialisation Act does not provide for compulsory dematerialisation but for compulsory conversion if an issuer so decides.
The Luxembourg act dated 27 July 2003 relating to trust and fiduciary contracts, as amended (the Act on trust and fiduciary contracts) recognises trusts that are created in accordance with the convention on the law applicable to trusts and on their recognition made at The Hague on 1 July 1985 and that are legal, valid, binding and enforceable under the law applicable to the trusts.
The legal framework for securities is completed by Grand Ducal regulations and CSSF's circulars and other guidance on a variety of specific topics. Also important are the rules and regulations of the Luxembourg Stock Exchange (the ROI). The ROI imposes certain obligations on issuers who have securities admitted to trading on a market operated by the Luxembourg Stock Exchange. The ROI also gives power to the Luxembourg Stock Exchange to suspend or delist securities issued by issuers who do not comply with the provisions of the ROI.
ii Regulatory authorities
The competent authority for supervision of the securities markets, including their operators, and for investigations and enforcement of the securities laws in Luxembourg is the CSSF. It is responsible for the verification of compliance of financial information prepared by issuers of listed securities and monitoring of the disclosure obligations of such issuers, and it handles files relating to takeover bids and mandatory squeeze-out or sell-out.
The CSSF is also in charge of promoting transparency and fairness in the markets of financial products and services and is responsible for the enforcement of laws relating to financial consumer protection and the fight against money laundering and terrorist financing. The CSSF carries out its prudential supervision and supervision of the markets in order to contribute to the solidity and stability of the financial sector exclusively in the public interest. The CSSF falls under the authority of the Minister of Finance, but has financial autonomy and autonomy of action as required by international organisations.
The CSSF does not have the power to investigate and prosecute criminal offences. This falls within the sole remit of the criminal investigation police, state prosecutor and criminal courts.
The Commissariat aux Assurances is the Luxembourg authority competent for the supervision of the insurance sector.
iii Common securities claims
Neither the CSSF nor the administrative courts can rule on damages sought by a party that has suffered a loss. The claims for damages are decided solely by the civil courts, except in the case of criminal proceedings, where the victim of a criminal offence can choose to have them awarded by either the civil court or the criminal court.
The most common claims introduced in securities litigation to date are claims for false or misleading statements and omissions in prospectuses and consequential claims for the losses suffered as a result of breaches of the market abuse laws. The party suffering the loss may sue under contractual or non-contractual liability. There are also regular cases on shareholders litigation.
Generally, it is rather difficult in Luxembourg to be successful in secondary liability cases against service providers. For instance, in the case of the prospectuses required under the Prospectus Regulation or the Luxembourg Prospectus Act, the persons responsible for the information in the prospectus are clearly identified in the prospectus. It would, therefore, be difficult to successfully invoke the liability for misleading statement or omissions in a prospectus of additional third persons, even though involved in the preparation and distribution of the prospectus. However, service providers such as attorneys, auditors, financial intermediaries or underwriters can be held liable in the context of their contractual duties and undertakings and to the extent that they have participated in misrepresentations, omissions or other fraudulent conduct in relation to the offer and trade of securities. The most common claims in this respect are the claims of investors that have suffered a loss in relation to securities against their financial intermediary for breach of their professional duty to advise and fully inform the investors.
Companies or professionals subject to the CSSF's oversight may also seek to hold the CSSF liable for damages for the choice and application of the means used to carry out the CSSF's mission. The statutory non-contractual liability regime applicable for the CSSF presupposes gross negligence, which deviates from ordinary civil liability and allows damages to be sought for wrongdoing. This specific liability regime pertaining to the CSSF was challenged before the Constitutional Court as contrary to the constitutional principle of equality before the law. The Constitutional Court dismissed the claims and ruled in a judgment dated 1 April 2011 that the constitutional principle is not breached.
II Private enforcement
i Forms of action
Luxembourg law does not have a specific statutory regime relating to prospectus liability or liability for misleading statements or the omission of pertinent information in an offer or a listing document. Consequently, prospectus liability claims are subject to the general provisions of liability of the Luxembourg Civil Code. On this basis, investors are typically seeking responsibility in securities actions on the ground of contractual or non-contractual liability.
The Luxembourg Prospectus Act provides that the issuer, the offeror, the person seeking admission to trading or the guarantor, as the case may be, shall be responsible for the information included in a prospectus. As mentioned in Section I.iii, a prospectus (prepared under the Prospectus Regulation or the Luxembourg Prospectus Act) must clearly indicate the persons responsible for the accuracy of the information contained thereunder. The prospectus must also include declarations by those persons that, to the best of their knowledge, the information contained in the prospectus is in accordance with the facts and that the prospectus makes no omission likely to affect its import. The prospectus summary and its translations do not entail civil liability, unless it is misleading, inaccurate or inconsistent, when read together with the other parts of the prospectus, or when it does not provide, when read together with the other parts of the prospectus, key information to aid investors when considering whether to invest in such securities.
Liability in contractual and non-contractual matters can only arise if a causal link can be established between the damage suffered by an investor and the event causing such damage. Investors would therefore have to prove that they suffered damage and that such damage is the result of a particular event (e.g., a breach of contract in contractual matters, or a misrepresentation in a prospectus causing a direct loss in an investment). Investors would furthermore have to prove that they relied on the relevant misrepresentation, omission or other fraudulent conduct. The persons responsible for the information included in a prospectus could therefore have a defence if they manage to establish that there is no causal link between the statements made in the prospectus and the loss suffered by a person.
The Luxembourg New Code of Civil Procedure (NCPC) does not provide for the possibility to introduce class actions before the Luxembourg courts. It is, however, possible for several claimants with a common interest to bring a joint claim under certain circumstances.
In Luxembourg, securities claims are not subject to a specific procedure or the jurisdiction of specific courts. Such claims are subject to standard civil or commercial procedure and to the jurisdiction of the general district courts sitting in civil or commercial matters. Decisions rendered by the district courts are subject to appeal before the Court of Appeal and decisions of the Court of Appeal may in turn be reviewed by the Supreme Court, which may only review questions of law, not factual matters.
Judicial proceedings before the district courts are initiated by a written petition. Defendants domiciled in Luxembourg are notified of the proceedings by a bailiff. The written petition must include, among other things, the names and full particulars of each party, the relevant court before which they should appear, a summary of the facts, the nature of the claim and the legal arguments of the claimant.
Written submissions of arguments are required when the judicial proceedings follow civil procedure, but the parties may rely on oral arguments before the lower courts and the district courts sitting in commercial matters. A claimant must be represented by a lawyer registered on list I of the Luxembourg Bar when the written procedure is followed (i.e., in civil matters). In oral proceedings, a claimant may be represented by any lawyer qualified to practice in Luxembourg or by certain persons who are not lawyers (e.g., family members).
Unlike common law jurisdictions, Luxembourg law does not provide for a discovery process and each party must file in due time the evidence it intends to rely on to justify its claim, in accordance with the adversarial principle. In certain circumstances, a party may request the judge to order the other party to disclose a specific document or information through summary proceedings. All documents filed by a party are communicated to the other party before the hearings. Documents and evidence may only be considered by the courts if they have been duly disclosed to the other parties before the hearings. The burden of proof lies on the party asserting a fact.
From a Luxembourg law perspective, a settlement agreement is a contract between the claimant and the defendant to end an existing or future dispute between the parties. In principle, parties to civil liability proceedings, including public authorities, such as the CSSF, may decide to settle their dispute at any time, before or during judicial proceedings. The settlement agreement may (and ideally should) also provide for the settlement of legal or any other costs related to the dispute, although there are no specific rules in this respect. Once a settlement is reached, the parties can no longer take legal action regarding the points agreed under the settlement agreement, and the settlement agreement is considered as res judicata of the last resort.
Court approval is not required, except in some limited situations: for instance, in case of settling by a bankruptcy receiver. A settlement agreement binds only the parties, and would therefore require mutual agreements that need to be identifiable between each of the claimants and the defendant in the case of joint proceedings with multiple claimants.
The CSSF is competent to act as an intermediary to seek amicable settlements between customers and credit institutions or finance professionals. In 2018, the CSSF closed 728 files relating to out-of-court dispute settlement, and in most cases the disputes were settled following the first instructions of the CSSF.2
iv Damages and remedies
Under Luxembourg law, a breach of contract or wrongdoing causing damages may entitle the injured party to obtain indemnification for the entire or actual loss suffered, provided that such loss is lawful, certain, direct and personal. If damages are caused by a breach of contract, the alleged damages should also have been foreseeable at the time of conclusion of the contract.
A wrongdoing may essentially fall into two major categories: wilful misconduct or unintentional misconduct. In the case of wilful misconduct, investors could seek damages calculated, for example, as the difference between the price of the securities and their value at the time of their purchase, had the misrepresentation not been made. Where investors could establish that they have entered into an agreement while relying on misrepresentations or incorrect statements, such agreement may be declared null and void (leading to the return of the parties' original investment as though the agreement never existed). It may also be possible, in certain circumstances, for investors to argue that, as a result of a material misrepresentation, an agreement has been emptied of its substance or cause and to request the courts to rescind the agreement. In the case of unintentional misconduct, a distinction is generally made under Luxembourg law between a minor wrongdoing or gross negligence. There is no statutory definition of what constitutes a minor wrongdoing or gross negligence, and an assessment is therefore made on a case-by-case basis by the courts (it being understood that Luxembourg case law and legal literature are of the view that the assessment of wrongdoing as gross negligence should be made in a restrictive manner). A negligent misrepresentation in a prospectus could potentially fall within the category of unintentional misconduct. In the case of unintentional misconduct, investors would generally only receive damages, and an agreement could in principle not be declared null and void by a court.
Damages awarded to investors generally cover both the effective loss and the loss of profit. The assessment of the profits that an investor has been deprived of is delicate and must take into account the certainty of the loss. Luxembourg law does not provide for punitive or similar enhanced damages, so that under Luxembourg law, investors may only seek indemnification for actual losses.
III Public enforcement
i Forms of action
The CSSF disposes of a broad range of significant measures to act against persons subject to its supervision that would either violate the applicable regulations or not comply with the professional obligations imposed on them. These measures are defined in specific securities laws and include administrative sanctions, such as administrative fines; disgorgement of the profits gained or losses avoided due to the infringement; withdrawal or suspension of the licence to conduct activities; and banning or suspension of individual activities (e.g., trading in securities). Some of the securities laws oblige the CSSF to publish the sanctions imposed on its website.
The CSSF also has various administrative measures that it can adopt to remedy the situation and to protect other participants of the securities markets. These include public warnings informing the public, in particular consumers, about the illegal activities in Luxembourg and the infringing party, and orders requiring the person responsible for the infringement to cease the conduct and to desist from a repetition of that conduct. In the case of non-compliance with disclosure obligations, the CSSF may publish information about the infringing party.
The CSSF does not have the power to investigate and prosecute criminal offences. This falls within the sole remit of the criminal investigation police, state prosecutor and criminal courts. Some infringements under the securities laws, in particular insider dealing, recommending or inducing another person to engage in insider dealing, unlawful disclosure of inside information and market manipulation under the Market Abuse Regulation, may amount to criminal offences. Similarly, under the Prospectus Act, an offer of securities to the public within the territory of Luxembourg without a duly approved prospectus in accordance with the provisions of the Prospectus Regulation is subject to administrative sanction. However, if carried out with intent, it will be re-qualified as a criminal offence. To this end, it is vital that the CSSF and the state prosecutor collaborate closely and exchange any information to avoid overlaps of proceedings and breaches of ne bis in idem principle. Detailed rules on cooperation have been included in this regard in the Market Abuse Act and Code on Criminal Procedure. These include, in particular, a requirement on the CSSF to inform the state prosecutor of the intention to open administrative proceedings. Following such notice, the state prosecutor may decide to initiate criminal prosecution. If the state prosecutor decides to prosecute, the CSSF must refrain from proceeding. Furthermore, if at any time during the administrative proceedings the CSSF becomes aware of indications of possible criminal offences, it must cease the proceedings and transmit the file to the state prosecutor.
In addition, and subject to the specific facts and circumstances of the matter, certain other general and specific criminal law related provisions under the Luxembourg Criminal Code and certain other particular statutory regimes could also apply to trigger criminal liability.
The administrative proceedings before the CSSF are governed by the Grand Ducal regulation dated 8 June 1979 on the procedure to be followed by administrations of the state and the communes (the Grand Ducal Regulation on Administrative Procedure). The general provisions of this regulation are further complemented by various more specific procedural rules included in the securities laws, for which the CSSF is appointed as supervisory authority.
The CSSF initiates enforcement actions either on the basis on the information gathered from its own monitoring (for instance, from analysing the periodic information submitted to it) or based on research through other information channels (such as consumer complaints, publicly available information or whistleblowing). The CSSF has broad investigatory powers and may access any data and documents in any form, recorded telephone conversations and emails. The CSSF can also request data traffic records from telephone operators or conduct on-site inspections. The CSSF may exercise its investigative powers without prior judicial approval. A judicial approval for CSSF actions is only required in cases where the information request or inspection relates to an entity or individual that is not under its supervision.
Upon termination of an investigation process, the CSSF provides the persons concerned with an investigation report informing them of the envisaged decision and the information supporting its conclusions in line with the Grand Ducal Regulation on Administrative Procedure that specifically provides for the right to full access to administrative documents, the concerned party is provided with a complete file on their administrative situation.3 Together with the investigation report, the CSSF requests explanations or, where available, remedy measures to be taken. The investigation proceedings before the CSSF terminate with an administrative decision.
The CSSF does not review its administrative decisions and persons concerned must directly appeal to the administrative court of first instance, which undertakes a full review of the merits of the decision adopted by the CSSF. Representation by a qualified lawyer in the proceeding in front of the administrative court is mandatory. The decision at first instance is normally taken within seven months of proceedings commencement. Following a decision by the court of first instance, an appeal can be lodged with the administrative Court of Appeal. In appeal proceedings, the court generally hands down its judgment within five months of the judgment of the lower court. The appeal against the decision of the CSSF (in first or second instance) has no suspensive effect. The applicant has the possibility of requesting the president of the administrative court to suspend the execution of the contested decision or to impose a safeguard measure.
Criminal prosecution of securities-related enforcement actions is subject to the general principles of criminal procedure (no specific rules apply in this respect).
There is no express legal provision providing for the possibility of settlement of administrative proceedings before the CSSF, although it may use its discretionary powers to determine the amount of an administrative fine or the severity of a sanction, following informal discussions with a supervised entity.
Settlement is, however, available in criminal proceedings, before a decision on the merits by the criminal chamber of the district court is reached. Settlement is only applicable for offences punishable by up to five years of imprisonment. A settlement must be reached within four months from the initial offer (it can be prolonged up to eight months). A formal refusal or failure to respond to an offer or counter-offer within one month renders the procedure null and void. The settlement is recorded in a settlement agreement, which among other things, must provide for agreed criminal sanctions, decision on the costs of the proceedings and damages to be paid (if any). The settlement agreement must be validated by a judge. If the judge refuses to validate the agreement, the settlement procedure is null and void (although this decision may be appealed). The settlement agreement does not impact actions in front of the civil courts. During the hearing on the validation of the settlement, injured parties may either accept the damages agreed in the settlement agreement or request that their claim be ruled by the civil chamber of the district court (although criminal procedure remains applicable).
iv Sentencing and liability
The CSSF has relatively broad discretionary powers when determining administrative sanctions. The range of applicable fines and available administrative measures depends on the relevant legal provision. The CSSF must also take into account all relevant circumstances of the party concerned, such as the gravity and duration of the infringement, the financial strength, the degree of responsibility of the person responsible for the infringement, the level of cooperation, and previous infringements or measures taken by the person responsible for the infringement, to prevent its repetition. Administrative fines and administrative sanctions may be imposed on legal and natural persons.
Criminal courts may condemn the defendant to imprisonment (in the case of natural persons) or corporate dissolution (in the case of legal entities) and/or impose a criminal fine, or both. Most of the criminal offences under the securities laws require intent. Attempted criminal offences are also punishable.
IV Cross-border issues
In the event of a breach of applicable securities laws and regulations or a failure to observe instructions from the CSSF, the CSSF may bring enforcement action against entities under its supervision, including foreign ones. For instance, in a case of market abuse, the powers of the CSSF include any actions carried out in Luxembourg and abroad relating to financial instruments admitted to trading on a trading venue in Luxembourg or for which a request for such an admission has been made.
In international civil cases, the Luxembourg courts will have jurisdiction depending on the applicable international conventions and on the domicile of the parties. According to the provisions of Regulation (EU) No. 1215/2012 (Brussel I bis), the competent court to settle a tortious claim is the court of the EU Member State where the defendant has its domicile or the court of the EU Member State where the direct damage has occurred. Luxembourg courts would, therefore, be competent to settle a tortious claim against a defendant domiciled in another EU Member State brought by a person that suffered direct damage deemed to have occurred in Luxembourg.
Pursuant to Brussels I bis, Luxembourg courts have jurisdiction in civil and commercial matters when parties to an agreement have agreed to submit their disputes to the courts of Luxembourg. If the parties to an agreement have agreed to submit their disputes to the jurisdiction of a foreign court or to arbitration, Luxembourg courts would, in principle, have jurisdiction to order provisional measures in connection with assets or persons located in Luxembourg, and such measures would most likely be governed by Luxembourg law.
V Year in review
On 21 July 2019, the Prospectus Regulation came into force and created, together with the Prospectus Act, a new prospectus regime in Luxembourg. Among other changes, various rules were adopted in the Prospectus Regulation to render the prospectuses more comprehensive for less sophisticated investors, who struggled to wade through very detailed information under the former regime. On the national level, the liability regime remained unchanged and the Luxembourg legislator did not exercise the legislative option to include additional administrative sanctions or a higher level of pecuniary sanctions for breach of the obligations under the Prospectus Regulation.
To reflect on the changes introduced by the Prospectus Regulation and to revamp disclosure requirements for drawing up a prospectus for admission of securities to trading on the alternative market operated by the Luxembourg Stock Exchange (Euro MTF), the Luxembourg Stock Exchange adopted a new version of its ROI. The new ROI entered into force on 31 January 2020.
The year 2019 also saw the entry into force of the law dated 1 March 2019 (the Blockchain Act), which amended the Luxembourg act dated 1 August 2001 on the circulation of securities. The Blockchain Act modernised the current legal framework by specifying that securities may be booked and transferred through secure electronic recording devices, in particular through distributed ledgers such as blockchain.
Concerning the supervisory activities of the CSSF, the 2019 annual report is not yet available. The 2018 annual report of the CSSF indicates that the CSSF imposed only a few administrative sanctions and measures. For instance, in relation to notifications relating to major holdings under the Transparency Act, the CSSF imposed only one sanction and issued three warnings. The main infringements observed during the review of the notifications received by the CSSF consisted of late notifications or disclosure. The warnings, issued notably for late notifications, imply that the holder or issuer concerned will be monitored more strictly in relation to its notifications of major holdings for a period of 18 months. In 2018, an investigation of market manipulation in the form of wash trades (buy/sell transactions in financial instruments with no economic substance) led the CSSF to impose administrative fines on two investors (natural persons) to the maximum limit, amounting to €250,000. Moreover, two investigations (one into insider dealing and the other into market manipulation) have been closed without administrative fines or other administrative sanctions being imposed.
From the sanctions published on the CSSF's website during 2019, it appears that the trend is consistent and that only a few sanctions have been imposed. These include four administrative fines in relation to breaches of the provisions of the Transparency Law (mainly relating to failure by issuers to publish their annual financial statements within the required time limit). The CSSF also published one administrative sanction in connection with a failure to comply with the obligations relating to the prevention and detection of market abuse under the Market Abuse Regulation.
There are no available statistics concerning criminal investigations and proceedings concerning securities markets.
VI Outlook and conclusions
The financial sector plays a key part in Luxembourg's economy, and the Luxembourg authorities (especially the CSSF) strive to find the right balance between increased supervision and the need for sufficient manoeuvring room to allow the financial sector to breathe and develop. The Luxembourg authorities recognise that the trend is towards a common supervisory culture and a harmonised application of a single rule book that deprives them of large parts of their flexibility in the regulation and supervision of the financial sector, which could have an impact on the number of sanctions being imposed on supervised entities.
To maintain the attractiveness of Luxembourg in a context where the regulatory framework becomes more and more harmonised, there are clear signals that the authorities want to differentiate themselves from their foreign counterparts by quality of service, responsiveness and approachability. They are putting a particular focus on maintaining Luxembourg's role as a leading banking, fund and capital markets hub. For instance, the Ministry of Finance has relaunched the High Committee of the Financial Centre to create an institutionalised platform for the exchange of information between key stakeholders of the financial markets and the government, with a view to ensuring that Luxembourg stays at the forefront of economic and financial developments. Several working groups have been set up by the High Committee of the Financial Centre to modernise Luxembourg's legal framework (including the banking, fund, fintech and securitisation legislation) to respond to the needs of the markets and their players. Despite the current focus by the Luxembourg authorities on the covid-19 crisis, we nevertheless expect that new and innovative legislation will be adopted in Luxembourg in the next year to ensure that Luxembourg maintains its status as a leading financial centre.
1 Frank Mausen and Paul Péporté are partners, and Thomas Drugmanne and Kristina Vojtko are senior associates at Allen & Overy.
2 The CSSF Annual Report 2018.
3 The right to full access to administrative documents was confirmed by the Luxembourg courts. However, the courts have ruled that this right is not absolute and that the CSSF does not have an obligation to grant access to the entire file or to disclose information on all third parties involved or on its employees investigating the matters unless relevant for its decision (Cour Administrative 42666C, dated 11 April 2019).