CSSF Updates 2026

What Changed

The circular consolidates and updates governance rules, focusing on: Management bodies: Responsibilities, composition, qualifications, organization, and functioning, including CSSF authorization of members based on professional experience, standing (e.g., police records), and irreproachable conduct. Internal control functions: Responsibilities, characteristics, organization, and execution of work for compliance officers and internal auditors, with notifications to CSSF including detailed persona

What You Need To Do

• Gap analysis
• Updates and notifications
• Implementation
• Documentation

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] financialcrime.lu
• [6] elvingerhoss.lu

What Changed

Consolidation and repeal: Replaces outdated circulars with unified requirements under the amended Law of 10 November 2009 on payment services, covering central administration (decision-making must be in Luxembourg), management body responsibilities, internal control functions (compliance, risk management, internal audit as independent second/third lines), conflicts of interest management, new product approval processes, and client funds safeguarding (e.g., segregation, daily/weekly reconciliatio

What You Need To Do

• Assess and update governance frameworks
• Confirm control functions
• Implement operational safeguards
• Document proportionality
• Retain records and report

Key Dates

References

• [1] financialcrime.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] elvingerhoss.lu
• [5] cssf.lu
• [6] cssf.lu

What Changed

Institutions must establish proportionate strategies, policies, processes, and systems for ESG risk management, covering short-, medium-, and long-term horizons, including transition and physical environmental risks. Develop plans per Article 76(2) CRD with specific timelines, intermediate quantifiable targets, and milestones to address ESG financial risks, consistent with EU objectives (e.g., 55% GHG reduction by 2030, climate neutrality by 2050). Incorporate ESG into internal governance, risk

What You Need To Do

• Map and integrate ESG risks into governance, risk management frameworks, and business strategies, proportionate to scale/risk exposure
• Develop and document ESG risk management plans with quantifiable targets, milestones, timelines, and scenario analyses (broad requirements now; detailed later)
• Conduct assessments of ESG risks in portfolios, including sustainability products, transition finance, and loan origination policies, for SREP submission
• Embed in internal processes per Articles 74, 76, 87a CRD: identify/measure ESG risks (minimum standards), monitor over time horizons, and report to CSSF
• Review and update existing policies/systems for compliance by applicable dates; prepare for CSSF supervisory evaluation of plan robustness

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] cssf.lu
• [6] reporting4066.rssing.com
• [7] cms.law
• [8] lsfi.lu

What Changed

The regulatory landscape has evolved significantly with the introduction of new sustainability reporting requirements: ESRS Implementation (First Year): 2024 marked the first full reporting year under the European Sustainability Reporting Standards (ESRS), with the CSSF conducting a fact-finding exercise to assess reporting quality. The CSSF noted an overall increase in reporting quality with better-structured reports and more relevant disclosures, though key improvement areas remain in compreh

What You Need To Do

• *Financial Information (IFRS)
• *Enhanced Note Disclosures
• *Cash Flow Statement Presentation
• *Segment Reporting Completeness
• *Going Concern Assessment

Key Dates

References

• [1] cssf.lu
• [2] bsp.lu
• [3] cssf.lu
• [4] lexgo.be
• [5] cssf.lu
• [6] lsfi.lu
• [7] cssf.lu
• [8] cssf.lu

What Changed

Mandatory Electronic-Only Submission: Documents listed in Annex I must be transmitted exclusively via e-file (http://www.e-file.lu) or SOFiE (http://www.cetrel-securities.lu/wp_static/what-do-we-offer/secured-reporting-channel-sofie-sort/), in PDF format supporting read access, printing, copy/paste, and word search; other methods post-February 1, 2019, are null and void. Dynamic Annex Updates: The annex, published on the CSSF website, is regularly updated (e.g., latest noted April 1, 2025) and i

What You Need To Do

• Register/access e-file or SOFiE platforms if not already (test/production environments available since February 2019)
• Consult and adhere to the latest Annex I for document list, nomenclatures, and formats (PDF with full functionality)
• Ensure submissions are final/official versions matching hard copies; use specified identifiers for UCIs/SIFs/SICARs
• Implement processes for automatic/manual transmission (e
• Train staff on responsibilities and integrate into reporting workflows; reference CSSF FAQs for closing documents

Key Dates

References

• [1] bsp.lu
• [2] cssf.lu
• [3] mondaq.com
• [4] cssf.lu
• [5] e-file.lu
• [6] cssf.lu
• [7] cssf.lu
• [8] dechert.com

What Changed

This is not a regulatory change or new requirement but an enforcement of existing obligations under the Transparency Law of 11 January 2008 (as amended), specifically Article 4, which mandates issuers to publish half-yearly financial reports, including effective dissemination, storage on the Officially Appointed Mechanism (OAM), and filing with the CSSF. No new rules are introduced; the sanction reinforces the unchanged deadlines and processes for periodic information publication, with the CSSF

What You Need To Do

• All affected parties
• BigRep SE specifically
• wide actions are mandated beyond general adherence, but proactive audits are advisable given CSSF's supervisory focus

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] cssf.lu
• [6] opensanctions.org
• [7] cssf.lu
• [8] complianceandmarketsadvisors.com

What Changed

No new regulatory changes or requirements are introduced in this publication, as it is an enforcement notice rather than a circular or guideline. It serves as a disclosure of an ongoing or concluded enforcement case, aligning with CSSF's practice of publishing sanction details to deter non-compliance and inform the market, without altering existing rules. #

What You Need To Do

• For the named population
• For all supervised firms
• Update internal policies, train staff on enforcement precedents, and ensure robust reporting under Circular CSSF 19/726 or Transparency Law obligations

References

• [1] cssf.lu
• [2] aoshearman.com
• [3] pwc.lu
• [4] bakermckenzie.com
• [5] cssf.lu
• [6] cssf.lu
• [7] elvingerhoss.lu
• [8] ey.com

What Changed

This is not a regulatory change but an enforcement precedent under existing rules: non-compliance with Article 5(1) of the AML/CFT Law, which mandates annual submission of a financial crime questionnaire ("Questionnaire") to the CSSF. The fine was calculated per Articles 8-4(1), 8-4(2)(f), and 8-4(3)(a), considering circumstances under Article 8-5(1). Publication followed Article 8-6(1) after a proportionality assessment, confirming no market stability risks. No new requirements were introduced;

What You Need To Do

• Immediately review internal processes for annual Questionnaire submission, ensuring calendar invites and automated reminders for the 4 April deadline (covering prior year-end data)
• Conduct a gap analysis on AML/CFT cooperation obligations under Article 5(1), including response protocols to CSSF reminders or queries
• Update compliance calendars and train staff on escalation procedures; document all submissions with proof (e
• If late, proactively submit overdue items and request meetings if needed, as non-response forfeits mitigation opportunities

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] seqlense.com
• [5] bsp.lu
• [6] cvc.com
• [7] gouvernement.lu
• [8] caceis.com

What Changed

This is not a regulatory change but rather an enforcement action clarifying existing obligations: Mandatory Annual Questionnaire Requirement: All professionals supervised, authorized, or registered by the CSSF must submit an annual questionnaire on financial crime by April 4 each year, covering the preceding calendar year. Cooperation Obligation: Article 5(1) of the amended Law of 12 November 2004 on AML/CFT establishes a non-negotiable duty to cooperate with the CSSF, which includes timely su

What You Need To Do

• regulated entities must
• *Establish Calendar Controls
• *Designate Responsible Parties
• *Prepare Documentation
• *Monitor Communications

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] seqlense.com
• [4] cssf.lu
• [5] cssf.lu
• [6] blogs.duanemorris.com
• [7] cssf.lu
• [8] cssf.lu

What Changed

This is not a regulatory change or new requirement but an enforcement precedent under existing rules: non-compliance with the annual financial crime questionnaire submission, mandated by Article 5(1) of the AML/CFT Law, triggers fines per Articles 8-4(1), 8-4(2)(f), and 8-4(3)(a). The CSSF considered all relevant circumstances under Article 8-5(1) to set the €10,000 fine amount and published the sanction nominatively after proportionality assessment per Article 8-6(1), confirming no market stabi

What You Need To Do

• Ensure timely submission of annual financial crime questionnaires by 4 April each year (for prior calendar year data); implement calendar reminders and escalation processes for CSSF requests
• Respond promptly to CSSF reminders or queries on AML/CFT compliance to avoid escalation to fines; document any delays with justification evidence
• No retroactive actions needed for this case, but conduct gap analysis on reporting workflows to prevent similar breaches

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] regulatoryandcompliance.com
• [6] cssf.lu
• [7] sec.gov
• [8] pinsentmasons.com

What Changed

This is not a regulatory change but rather an enforcement action clarifying existing obligations. However, it reinforces critical compliance requirements: Mandatory Annual Questionnaire Submission: All CSSF-supervised professionals, including AIFMs, must submit an annual questionnaire on financial crime by the specified deadline (in this case, 4 April 2025 for the year ending 31 December 2024). Cooperation Obligation: Article 5(1) of the amended Law of 12 November 2004 on the fight against mon

What You Need To Do

• *Establish Calendar Controls
• *Designate Responsible Parties
• *Monitor CSSF Communications
• *Document Submission
• *Escalate Non-Compliance Immediately

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] opensanctions.org
• [5] boldergroup.com
• [6] bsp.lu
• [7] efama.org
• [8] pwc.lu

What Changed

This is not a regulatory change but rather an enforcement action clarifying existing obligations: Mandatory Annual Questionnaire Requirement: All CSSF-supervised professionals must submit an annual questionnaire on financial crime covering the preceding calendar year. Cooperation Obligation: Article 5(1) of the amended Law of 12 November 2004 on AML/CFT imposes a non-negotiable duty to cooperate with CSSF supervisory requests. Enforcement Escalation: The CSSF will issue reminders before imposin

What You Need To Do

• regulated entities must
• *Identify Reporting Obligations
• *Calendar Management
• *Documentation
• *Escalation Protocol

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] opensanctions.org
• [5] cliffordchance.com
• [6] elvingerhoss.lu
• [7] imf.org

What Changed

This is not a regulatory change but rather an enforcement action that clarifies existing obligations: Mandatory Annual Reporting: All CSSF-supervised professionals must submit an annual questionnaire on financial crime by 4 April each year, covering the preceding calendar year. Cooperation Obligation: Article 5(1) of the amended Law of 12 November 2004 on AML/CFT establishes a non-negotiable duty to cooperate with the CSSF, including timely submission of requested documentation. Enforcement Esc

What You Need To Do

• *Establish Reporting Calendars
• *Designate Responsible Personnel
• *Respond to Regulatory Requests
• *Document Justifications
• *Monitor Supervisory Communications

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] opensanctions.org
• [6] sorainen.com
• [7] ubp.com
• [8] adaptation-fund.org

What Changed

This is not a regulatory change or new requirement but an enforcement of existing obligations under the amended Law of 12 November 2004 on the fight against money laundering and terrorist financing (AML/CFT Law). Specifically, it reaffirms the mandatory annual submission of the CSSF's financial crime questionnaire ("Questionnaire") by supervised professionals, including AIFMs under Article 3(2) of the Law of 12 July 2013 on AIFMs, as part of the cooperation duty in Article 5(1). The fine was cal

What You Need To Do

• Immediately verify submission status of the 2024 Questionnaire (or any outstanding); if overdue, submit promptly with justification to mitigate further escalation
• Implement automated calendar alerts and internal workflows for all CSSF reporting deadlines, including annual AML/CFT Questionnaire
• Conduct a compliance gap analysis on cooperation obligations under Article 5(1) AML/CFT Law, documenting reminder responses and evidence retention
• Train senior managers and compliance teams on supervisory interactions, including rights to request in-person meetings before fines
• Review governance for timely escalation of CSSF reminders to decision-makers

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] fi.se
• [6] cssf.lu
• [7] africagrowthfund.org
• [8] funds-europe.com

What Changed

This is not a regulatory change or new requirement but an enforcement of existing obligations under the amended AML/CFT Law: Annual Questionnaire Submission: Supervised professionals, including AIFMs under Article 3(2) of the Law of 12 July 2013 on AIFMs, must submit an annual financial crime questionnaire ("Questionnaire") to CSSF as part of the cooperation duty in Article 5(1). Fine Provisions: Fines are imposed per Articles 8-4(1), 8-4(2)(f), and 8-4(3)(a), with amounts determined by relevant

What You Need To Do

• Immediate Review
• Remediation if Late
• Process Enhancements

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] blogs.duanemorris.com
• [6] opensanctions.org
• [7] cssf.lu
• [8] misp-project.org

What Changed

This is not a regulatory change or new requirement but an enforcement of existing obligations under the amended AML/CFT Law: Article 5(1) mandates supervised professionals, including AIFMs under Article 3(2) of the Law of 12 July 2013 on AIFMs, to cooperate fully with CSSF, including submitting the annual financial crime questionnaire ("Questionnaire"). Breach occurred due to non-submission of the 2024 year-end Questionnaire, with fine determined per Articles 8-4(1), 8-4(2)(f), 8-4(3)(a), and 8-

What You Need To Do

• Review and confirm timely submission of all pending or future CSSF financial crime questionnaires; establish automated calendar reminders for annual deadlines (e
• Implement escalation protocols for CSSF reminders, ensuring immediate response and submission within days, not weeks
• Conduct internal audit of AML/CFT cooperation obligations, documenting justifications for any delays and preparing evidence for potential CSSF hearings or meetings
• Update compliance policies to prioritize Article 5(1) duties, including training for responsible persons on fine risks under Article 8-4

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] blogs.duanemorris.com
• [6] cssf.lu
• [7] cssf.lu
• [8] cssf.lu

What Changed

This is an enforcement action, not a regulatory change; it enforces existing requirements under Article 51(1) (1st and 7th indents) and Article 51(2) (1st sub-paragraph, 3rd indent) of the amended Law of 12 July 2013 on AIFMs (AIFM Law), and related provisions like Article 92(1) of Commission Delegated Regulation (EU) No 231/2013 (CDR 231/2013). Key breaches include: failure to properly assess risks tied to AIFs' strategies and AIFMs' organization for oversight processes; lack of processes to ve

What You Need To Do

• related entities) must
• Conduct immediate gap analyses on risk assessment processes for AIF strategies and AIFM organization per Article 92(1) CDR 231/2013
• Implement robust verification processes for AIFM compliance with asset delegation rules
• Ensure availability of key documentation and evidence of controls for the depositary function, addressing pre-2022 gaps if applicable
• Develop and test oversight processes, leveraging self-identified improvements and action plans as mitigating factors, as JTC did prior to inspection

Key Dates

References

• [1] cssf.lu
• [2] cssf.lu
• [3] cssf.lu
• [4] cssf.lu
• [5] media.permira.com

What Changed

Revised LFR Structure: Comprises four parts in a single digital document: (1) yearly SAQ completed by investment firms; (2) descriptive elements verified by approved statutory auditors (REAs); (3) AML/CFT report with risk assessments, declarations on audits, and data on incomplete fund transfers; (4) REA's independent assessment of ML/FT risks and organizational aspects. Digital Format: Completion and submission via CSSF's online portal, supporting CSSF 4.0 digital strategy for efficient process

What You Need To Do

• Investment Firms
• REAs/Auditors

Key Dates

References

• [1] cssf.lu
• [2] bakermckenzie.com
• [3] cssf.lu
• [4] cssf.lu
• [5] cssf.lu
• [6] cssf.lu
• [7] cliffordchance.com
• [8] ogier.com