(first publication: 30 October 2024)
BankWealth ManagerAll Firms
Situation as at 31 December 2025
BankAsset ManagerWealth Manager
Situation as at 31 December 2025
BankAsset ManagerWealth Manager
Out-of-court consumer complaint resolution
BankWealth ManagerFintech
No description available.
BankWealth ManagerFintech
Press release 26/06
BankAsset ManagerWealth Manager
No description available.
BankAsset ManagerWealth Manager
No description available.
BankPayment Provider
Submission of the register of information at individual or consolidated level to the CSSF (excluding entities under the direct supervision of the ECB)
BankAsset ManagerWealth Manager
Guidance allowing financial entities to identify the National Competent Authority to which their register of information has to be submitted.
This CSSF guidance document, published on 11 February 2026, provides detailed explanations and resolution steps for error messages encountered during the submission of the DORA Register of Information (RoI) via the eDesk portal, specifically for the 2026 submission cycle. It matters because it enables Luxembourg financial entities to ensure compliant submissions amid enhanced validation checks on more data fields, avoiding re-submission delays and supporting timely transmission to the ESAs by CSSF deadlines. Non-compliance risks supervisory scrutiny under DORA's ICT risk management framework.
What Changed
Enhanced validation checks for the 2026 RoI submission: Applies ESA-defined checks (last updated April 2025) to more data fields to improve data quality, compared to prior cycles.
Specific error resolutions detailed, including requirements for LEI code communication to CSSF beforehand, correct reference date ('2025-12-31') in file naming, plain-CSV files in predefined .zip structure, and proper FilingIndicators.csv/parameters.csv content.
Mandatory inclusion of all tables (even empty) in FilingIndicators.csv set to 'true', with matching identification codes across parent-child records.
Builds...
What You Need To Do
- Assign "DORA Reporting" role in eDesk to dedicated employee(s) per user guide
- Communicate LEI code to CSSF line supervisor prior to first submission to enable upload
- Prepare RoI in plain-CSV files within
- Test submissions against listed error codes (e
- Consult ESAs' EBA resources (data point model, validation rules, FAQs) and CSSF guides (e
Key Dates
31 December 2025 - Reference date for 2026 RoI submission (all contractual arrangements up to this date).
11 February 2026 - Publication date of this error guidance (last updated 10/02/2026).
1 April 2025 to 15 April 2025 - Initial 2025 submission window via eDesk (for context; 2026 window likely similar, pending confirmation).
30 April 2025 - CSSF re-submission deadline post-validation for 2025; analogous for 2026 if errors detected. DEADLINE
May 2025 - ESAs' second-round validation for 2025; expect similar for 2026 with potential re-submissions.
Compliance Impact
Urgency: High - Published today (11 February 2026), this equips firms for imminent 2026 RoI submissions (reference date 31 December 2025), with stricter validations on expanded fields risking rejections/re-submissions. Matters for operational resilience compliance under DORA Article 28, as accurate RoI supports supervisory oversight of ICT third-party risks; delays could trigger CSSF/ESA follow-up or fines. Firms with prior 2025 issues (e.g., portal extensions to May 2025) must prioritize to avoid recurrence.
BankFintechPayment Provider
CVE-2026-1281 & CVE-2026-1340
BankWealth ManagerFintech
Situation as at 31 December 2025
BankAsset ManagerWealth Manager
Situation as at 31 December 2025
BankAsset ManagerWealth Manager
No description available.
Payment Provider
The CSSF informs the market regarding the outcomes of the SFTR Data Quality indicators review performed in 2025
BankBroker DealerPayment Provider
No description available.
BankAsset ManagerWealth Manager
No description available.
BankAsset ManagerWealth Manager
No description available.
CSSF Circular 26/906, published on 20 January 2026, establishes detailed requirements for central administration, internal governance, and risk management for payment institutions (PIs) and electronic money institutions (EMIs) in Luxembourg, repealing prior circulars IML 95/120, IML 96/126, IML 98/143, and CSSF 04/155. It clarifies application of the amended Law of 10 November 2009 on payment services, emphasizing robust governance amid sector growth to ensure safety, efficiency, and trust. This matters for compliance as it mandates comprehensive reviews and updates to governance frameworks by mid-2026, addressing rising transaction volumes.
What Changed
The circular consolidates and updates governance rules, focusing on:
Management bodies: Responsibilities, composition, qualifications, organization, and functioning, including CSSF authorization of members based on professional experience, standing (e.g., police records), and irreproachable conduct.
Internal control functions: Responsibilities, characteristics, organization, and execution of work for compliance officers and internal auditors, with notifications to CSSF including detailed personal and professional information.
Conflicts of interest: Key requirements for a management policy...
What You Need To Do
- Gap analysis
- Updates and notifications
- Implementation
- Documentation
Key Dates
20 January 2026 - Publication date of Circular CSSF 26/906.
30 June 2026 - Compliance deadline: Institutions must assess/review central administration, internal governance, and risk management frameworks to ensure full compliance. DEADLINE
Compliance Impact
Urgency: High - With ~5 months from publication (20 Jan 2026) to compliance (30 Jun 2026), firms face tight timelines for assessments, policy overhauls, and CSSF notifications, especially given repealed circulars and sector growth pressures. Non-compliance risks supervisory actions, as this fosters "sound and prudent management" in a high-volume industry; proactive reviews are essential to avoid disruptions.
Payment ProviderFintech
Central administration, internal governance and risk management
Circular CSSF 26/906, published on 20 January 2026, consolidates and clarifies Luxembourg's rules on central administration, internal governance, and risk management specifically for payment institutions, electronic money institutions, and account information service providers. It repeals prior circulars (IML 95/120, IML 96/126, IML 98/143, and CSSF 04/155) to address growth in transaction volumes by mandating robust governance, control functions, and risk processes, enhancing safety, efficiency, and trust in these services. This matters for compliance professionals as it strengthens defenses against financial crime, operational risks, and supervisory scrutiny in a high-growth sector.
What Changed
Consolidation and repeal: Replaces outdated circulars with unified requirements under the amended Law of 10 November 2009 on payment services, covering central administration (decision-making must be in Luxembourg), management body responsibilities, internal control functions (compliance, risk management, internal audit as independent second/third lines), conflicts of interest management, new product approval processes, and client funds safeguarding (e.g., segregation, daily/weekly reconciliations based on risk).
Governance enhancements: Board approves strategy, risk appetite, AML/CFT...
What You Need To Do
- Assess and update governance frameworks
- Confirm control functions
- Implement operational safeguards
- Document proportionality
- Retain records and report
Key Dates
20 January 2026 - Publication date of Circular CSSF 26/906 .
30 June 2026 - Compliance deadline Institutions must assess, review, and ensure their central administration, internal governance, and risk management frameworks fully comply with the circular. DEADLINE
Compliance Impact
Urgency: High – With a 30 June 2026 deadline (five months from publication), firms face immediate pressure to review and remediate governance gaps amid sector growth and heightened AML/CFT scrutiny; non-compliance risks supervisory actions, fines, or license issues, especially as it closes criminal exploitation vectors like weak controls and third-party risks.
Payment Provider
No description available.
BankAsset ManagerWealth Manager
No description available.
BankWealth ManagerAsset Manager
Electronic transmission of documents to the CSSF
Circular CSSF 19/708 mandates the electronic transmission of specified documents to the CSSF via secure platforms like e-file or SOFiE, effective from February 1, 2019, replacing prior paper or other methods. This updated annex (as amended by Circular CSSF 21/790 and further revisions up to April 1, 2025) standardizes submissions for investment funds and related entities, reducing administrative burdens while ensuring document integrity and CSSF accessibility. Compliance professionals must monitor the dynamic annex list on the CSSF website to avoid nullified submissions.
What Changed
Mandatory Electronic-Only Submission: Documents listed in Annex I must be transmitted exclusively via e-file (http://www.e-file.lu) or SOFiE (http://www.cetrel-securities.lu/wp_static/what-do-we-offer/secured-reporting-channel-sofie-sort/), in PDF format supporting read access, printing, copy/paste, and word search; other methods post-February 1, 2019, are null and void.
Dynamic Annex Updates: The annex, published on the CSSF website, is regularly updated (e.g., latest noted April 1, 2025) and includes prospectuses, management regulations, annual reports, risk management reports, compliance...
What You Need To Do
- Register/access e-file or SOFiE platforms if not already (test/production environments available since February 2019)
- Consult and adhere to the latest Annex I for document list, nomenclatures, and formats (PDF with full functionality)
- Ensure submissions are final/official versions matching hard copies; use specified identifiers for UCIs/SIFs/SICARs
- Implement processes for automatic/manual transmission (e
- Train staff on responsibilities and integrate into reporting workflows; reference CSSF FAQs for closing documents
Key Dates
1 February 2019 - Entry into force Mandatory electronic transmission for listed documents; non-electronic submissions null and void.
28 January 2019 - Publication date of original Circular CSSF 19/708.
22 December 2021 - Amendment by Circular CSSF 21/790.
1 April 2025 - Latest annex update noted.
Ongoing - Regular checks required Entities must monitor CSSF website for annex updates. DEADLINE
Compliance Impact
Urgency: Low (for new implementations post-2019; medium for ongoing monitoring). This matters for operational efficiency and CSSF relations, as non-compliance risks rejected filings, delays (e.g., approvals under SFDR processes), or supervisory scrutiny, but long-standing rule (since 2019) with established platforms reduces immediate pressure. Firms must prioritize annex vigilance to avoid disruptions in routine reporting like annual reports or prospectuses.
Asset ManagerWealth ManagerInsurance Update of Circular CSSF 24/850 on the practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted on an annual basis by support PFS, as well as the engagement of the réviseurs d’entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis.
Circular CSSF 25/903 updates Circular CSSF 24/850, refining practical rules for support Professional of the Financial Sector (support PFS) in Luxembourg regarding their annual descriptive report, self-assessment questionnaire, and the roles of approved statutory auditors (réviseurs d’entreprises agréés). It specifies requirements for auditors' engagement, management letters, and separate annual reports. This matters for support PFS as it enhances supervisory oversight, ensures consistent reporting quality, and strengthens internal controls, directly impacting compliance and audit processes amid CSSF's focus on robust PFS supervision.
What Changed
Updates to Descriptive Report and Self-Assessment Questionnaire: Refines content, format, and submission requirements for support PFS's annual submissions, emphasizing more detailed disclosures on operations, risks, and controls (building on CSSF 24/850).
Auditor Engagement Rules: Introduces specific practical guidelines for approved statutory auditors, including mandatory scope of work, independence confirmations, and standardized procedures for reviewing support PFS reports.
Management Letter and Separate Report: Establishes detailed rules for auditors to issue an annual management letter...
What You Need To Do
- *Review and Update Processes
- *Engage/Confirm Auditors
- *Implement Templates and Testing
- *Training and Governance
- *Submit on Time
Key Dates
1 January 2026 - Effective Date Applies to annual reporting cycles starting for financial year 2025 onwards.
30 April (annually) - Submission Deadline Support PFS must submit descriptive report, self-assessment questionnaire, management letter, and separate auditor report to CSSF by 30 April following the financial year-end (first applicable: 30 April 2026 for FY 2025). DEADLINE
31 December 2025 - Preparation Milestone Auditors must be engaged and initial scoping completed by year-end 2025 for FY 2025 compliance. DEADLINE
Compliance Impact
Urgency: High. This is high urgency for support PFS due to the impending 30 April 2026 deadline for FY 2025 submissions, with non-compliance risking supervisory fines, license reviews, or reputational damage under CSSF's PFS enforcement regime. It matters as it tightens audit accountability, potentially increasing costs (e.g., auditor fees) while reducing reporting errors—critical for smaller support entities with limited resources.
All FirmsFintechPayment Provider
Practical rules concerning the descriptive report and the self-assessment questionnaire to be submitted on an annual basis by support PFS.Engagement of the réviseurs d’entreprises agréés (approved statutory auditors) of support PFS and practical rules concerning the management letter and the separate report to be drawn up on an annual basis.
Circular CSSF 24/850, as amended by Circular CSSF 25/903, establishes practical rules for support Professional of the Financial Sector (support PFS) in Luxembourg to submit annual descriptive reports and self-assessment questionnaires, while also defining the roles of approved statutory auditors (réviseurs d’entreprises agréés) in issuing management letters and separate reports. This guidance standardizes supervisory reporting and audit processes to enhance oversight of support PFS, which provide essential back-office services to authorized PFS. It matters because non-compliance risks supervisory sanctions, reputational damage, and operational disruptions for entities reliant on support PFS structures.
What Changed
Standardized Reporting Templates: Introduces detailed formats and content requirements for the annual descriptive report and self-assessment questionnaire, covering governance, risk management, internal controls, and operational metrics specific to support PFS activities (e.g., IT services, administrative support, custody).
Auditor Engagement Rules: Mandates approved statutory auditors to perform specific procedures, issue a management letter highlighting control weaknesses, and prepare a separate report confirming compliance with the circular's requirements.
Amendments via CSSF 25/903:...
What You Need To Do
- Annual Reporting Cycle
- February to review submissions, test controls, and issue management letter (flagging deficiencies) plus separate compliance report
- Governance Updates
- Auditor Coordination
- Record-Keeping
Key Dates
31 March annually - Deadline for submission of descriptive report, self-assessment questionnaire, management letter, and separate auditor report to CSSF (first applicable for FY 2024 reporting due 31 March 2025). DEADLINE
1 January 2025 - Effective date of original Circular CSSF 24/850.
15 December 2025 - Effective date of amendments in Circular CSSF 25/903, applicable to 2025 reporting cycle onwards.
End of February annually - Support PFS must engage auditors and provide necessary data to enable timely report preparation. DEADLINE
Compliance Impact
Urgency: High – This is a recurring annual obligation with a firm 31 March deadline, where delays trigger automatic CSSF notifications and potential fines (up to €250,000 per Law 1993). It matters for support PFS as it intensifies scrutiny on operational resilience in a post-SFI (2021) landscape, where CSSF prioritizes substance in delegated functions; failure risks de-authorization or client outflows. Early implementation of templates and auditor pipelines is essential to avoid first-year pitfalls.
BankWealth ManagerAll Firms
amending Circular CSSF 22/811.Authorisation and organisation of entities acting as UCI administrators.
Circular CSSF 25/900, issued on 16 December 2025, amends Circular CSSF 22/811 to clarify governance principles, authorisation requirements, and operational standards for UCI (Undertakings for Collective Investment) administrators in Luxembourg, while reforming annual reporting obligations. It matters because it strengthens supervisory oversight, aligns with DORA for ICT outsourcing, and simplifies reporting to enhance efficiency and compliance in the fund administration sector.
What Changed
Repeals Annex B of Circular CSSF 22/811 with immediate effect, replacing it with streamlined annual reporting via a core compliance-focused Self-Assessment Questionnaire (SAQ) that assesses governance, internal controls, operational organization, and risk management; detailed instructions are now on the CSSF website.
Introduces prior CSSF authorisation requirements for entities acting as UCI administrators, including a defined administrative procedure with application details in Annex A; authorisation remains valid unless substantial changes occur, requiring re-application or prior...
What You Need To Do
- Assess eligibility and obtain prior CSSF authorisation via Annex A application (or notify substantial changes); ensure ongoing validity by monitoring operational model and delegations
- Adapt internal processes for revised annual UCIA reporting (SAQ-focused, integrated where applicable); submit using CSSF website instructions starting for FY ending 31 Dec 2025
- Review/update contracts with UCIs/IFMs to define roles, responsibilities, and oversight; implement delegation monitoring, remediation plans, and ICT compliance (DORA/Circular 25/882 or 20/750)
- For DORA-scope entities, align outsourcing arrangements with Circular CSSF 25/882
Key Dates
16 December 2025 - Issuance date; repeal of Annex B of Circular CSSF 22/811 effective immediately.
January 2025 - DORA entry into force, applying to ICT outsourcing for in-scope UCIAs.
31 December 2025 - New reporting framework (SAQ and updated modalities) applies to all financial years ending on or after this date.
Compliance Impact
Urgency: High - Immediate repeal of prior reporting Annex requires prompt process updates; new framework applies to FY 2025 year-ends (just past as of Jan 2026), risking supervisory scrutiny or penalties for non-compliance; DORA alignment adds operational resilience pressure amid ongoing CSSF focus on fund admin governance.
Asset ManagerWealth ManagerBank
Authorisation and organisation of entities acting as UCI administrators
Circular CSSF 22/811, as amended by Circular CSSF 25/900, establishes CSSF requirements for the authorisation, governance, internal organisation, and oversight of entities acting as UCI (Undertakings for Collective Investment) administrators in Luxembourg. It matters because it standardises practices amid regulatory, technological, and market evolutions, ensuring robust controls, risk management, and supervision for fund administration activities critical to Luxembourg's fund industry.
What Changed
Authorisation Requirements: Prior CSSF authorisation is mandatory for appointment as UCI administrator, via full application under sectoral laws or a simplified administrative procedure; application must include details per Annex A, with ongoing updates for substantial changes.
Scope of UCI Administration: Defines three core functions—registrar, NAV calculation/accounting, and client communication—requiring only one designated service provider per function per UCI (or compartment); UCI/IFM may perform functions internally or delegate with oversight.
Governance and Controls: Mandates sound...
What You Need To Do
- Submit authorisation application to CSSF with Annex A information before commencing UCI administration; notify substantial changes and keep file updated
- Establish/implement governance, controls, escalation processes, resource adequacy, ICT/business continuity per circular; ensure single provider per function
- For delegations
- Conclude written contracts with UCI/IFM; submit annual UCIA activity reports
Compliance Impact
Urgency: High – Non-compliance risks CSSF sanctions, as authorisation is prior and ongoing; critical for Luxembourg fund ecosystem given evolutions in tech/markets/DORA. Firms must act promptly if unauthorised or misaligned, especially with annual reporting since 2023 and DORA integration; impacts operational models, delegations, and reporting immediately for active administrators.
Asset ManagerBankAll Firms
Press release 25/18
BankFintechAll Firms
Update of Circular CSSF 07/325 on Provisions relating to credit institutions and investment firms of EU origin established in Luxembourg by way of branches or exercising activities in Luxembourg by way of free provision of services, as amended by Circulars CSSF 21/765 and CSSF 22/827
Circular CSSF 25/898 updates Luxembourg's supervisory framework for EU-origin credit institutions and investment firms operating in Luxembourg through branches or free provision of services. This amendment enhances the self-assessment questionnaire (SAQ) used by the CSSF to align supervisory oversight with current regulatory priorities, particularly adding UCI administration as a new thematic module. The update reflects the CSSF's evolving supervisory focus and requires affected institutions to demonstrate compliance with expanded assessment criteria.
What Changed
The circular introduces the following material modifications to Circular CSSF 07/325:
*New Supervisory Module
UCI administration** has been added as a thematic module to the self-assessment questionnaire, reflecting increased regulatory attention to fund administration practices.
*Enhanced Self-Assessment Framework**
Existing modules have been updated to better align with supervisory objectives and current regulatory priorities.
The revised SAQ now captures a broader range of supervisory points of focus relevant to branch operations and cross-border service provision.
*Scope...
What You Need To Do
- *Update Self-Assessment Processes
- Revise internal SAQ completion procedures to address the new UCI administration module
- Ensure all thematic modules reflect current supervisory expectations
- *Assess UCI Administration Compliance
- If the institution provides or is involved in UCI administration services, conduct a detailed assessment of compliance with CSSF expectations
Key Dates
31 October 2025 - Circular CSSF 25/898 published by the CSSF
19 December 2025 - Related modernization framework (Circular CSSF 25/901) entered into force for Part II UCIs, SIFs, and SICARs
No specific implementation deadline stated - Institutions should align their SAQ responses and compliance documentation with the updated framework immediately upon publication DEADLINE
Compliance Impact
Urgency: HIGH
BankBroker DealerAsset Manager
Press release 25/13
Bank
Press release 25/08
BankAsset ManagerWealth Manager No description available.
BankAsset ManagerWealth Manager