Assess a prospective service provider's suitability under Circular CSSF 22/806 (as amended by Circular CSSF 25/883), points 65(d) and 71–75 — including the points 94–96 certification-reliance conditions applied at selection stage. Companions: Criticality Assessment (pts 15–20) · Risk Assessment (pts 66–70).
Due diligence is part of the pre-outsourcing analysis (point 65(d)); its depth scales with the operational risks of the function (point 71), and any proportionate lightening must be documented (point 6).
Complete the selections above to continue.
Statuses : Satisfactory · Concerns (evidence obtained, issues noted) · Outstanding (evidence requested, not yet received) · Unsatisfactory (evidence fails the check) · N-A. A note is mandatory for every status except Satisfactory — the conscious lightening or the issue is the record (pt 6).
Set a status on every applicable item, with a note wherever the status is not Satisfactory.
The circular sets no fixed due diligence cycle: provider changes are caught by ongoing monitoring (pts 104–110) and the policy's periodic review process (pt 40(d)).
Select the final conclusion (with a judgment note if it departs from the suggestion).
Trace each requirement — including the point 73 letters and the point 96 letters — to where it was answered, and see honestly what sits outside this tool.
| Point | Requirement (paraphrased) | Status · where |
|---|
The AI extract is a self-describing copy of the whole due diligence: every item, anchor, source tag, status, evidence reference and note, plus the conclusion rule and caveats. The JSON version embeds the raw state, so Load working file re-imports it later; Markdown is the paste-into-a-chat version. Data-classification note: pasting the extract into an external AI transfers the data to that provider.
Feed the conclusion into the pre-outsourcing decision alongside the Criticality Assessment and the Risk Assessment · check the draft contract with the Contract Clause Gap Checker · log the arrangement in the Outsourcing Register.