Investment Management in Luxembourg

Key dates

2026-05-11

European Commission published its report on the adequacy of the MMFR and identified market-resilience WLA levels of 20% for VNAV MMFs and 40% for public debt CNAV and LVNAV MMFs.

2026-06-08

CSSF launched its consultation on Guidance on Money Market Fund Weekly Liquid Asset Levels.

2026-08-03 Deadline

Deadline for stakeholders to submit responses to the CSSF consultation.

2026-10-30

CSSF published the IMMFA consultation response and final guidance, and announced a three-month implementation period.

Suggested considerations

• Firms should classify each affected MMF by VNAV, public debt CNAV or LVNAV status and map the applicable 20% or 40% WLA resilience benchmark against the existing 15% or 30% MMFR minimum.
• MMF managers should update liquidity-risk policies, escalation thresholds, management information and governance records to evidence enhanced vigilance when WLA approaches or falls below the relevant benchmark.
• Risk teams should incorporate the 20% and 40% benchmarks into Article 28 MMFR stress-testing and assess whether investor concentration, redemption behaviour, market liquidity and portfolio composition require liquidity materially above the benchmark.
• Firms should establish controls to identify periods exceeding 10 business days below the applicable benchmark and procedures for timely CSSF notification, including documented explanations, justifications and any relevant Article 28(4) or (5) remedial measures.
• Boards and senior management should review whether the three-month implementation period announced by CSSF requires changes to investment guidelines, liquidity buffers, breach escalation and reporting calendars.
• Compliance teams may wish to document that the resilience benchmarks are supervisory reference points rather than replacements for the MMFR statutory ratios, while recognising the CSSF’s stated intention to increase supervisory engagement for prolonged deviations.
• Firms should monitor cross-border consistency with the parallel supervisory approaches of the French AMF and Central Bank of Ireland, particularly where groups manage MMFs in multiple EU jurisdictions.

What changed

The CSSF has finalised guidance, following the consultation that closed on 3 August 2026, with only slight clarifications. MMF managers are expected to incorporate 20% WLA for VNAV MMFs and 40% WLA for public debt CNAV and LVNAV MMFs into liquidity-risk frameworks and Article 28 stress-testing processes. These benchmarks sit above the existing Regulation (EU) 2017/1131 minimum WLA requirements of 15% for VNAV MMFs and 30% for public debt CNAV and LVNAV MMFs.

Key dates

2026-05-11

The European Commission published its MMF adequacy report identifying market-resilience WLA benchmarks of 20% for VNAV MMFs and 40% for public debt CNAV and LVNAV MMFs, compared with MMFR minima of 15% and 30%, respectively.

2026-06-08

The CSSF launched its consultation on guidance for MMF weekly liquid asset levels.

2026-08-03 Deadline

Deadline for stakeholders to submit responses to the CSSF consultation.

2026-10-30

The CSSF published the final guidance and feedback statement and began a three-month implementation period.

2027-01-30 Deadline

Expected end of the CSSF's three-month implementation period, calculated from publication on 30 October 2026.

Suggested considerations

• Firms should identify each in-scope MMF's applicable WLA benchmark, distinguishing VNAV funds from public debt CNAV and LVNAV funds, and document the classification rationale.
• Managers should review daily liquidity, weekly liquidity, portfolio composition and liquidity-buffer targets against both the binding MMFR minima and the higher CSSF market-resilience benchmarks.
• Risk teams should enhance monitoring and escalation procedures for WLA levels approaching or falling below 20% or 40%, including ownership, management-information frequency, escalation thresholds and evidence of reinforced decision-making.
• Managers should update MMFR Article 28 stress-testing methodologies and governance to reflect the 20% VNAV and 40% public debt CNAV/LVNAV resilience levels, while retaining the existing MMFR regulatory minima and applicable ESMA stress-test requirements.
• Firms should establish a documented process for counting consecutive business days below the applicable benchmark and for notifying the CSSF after more than 10 business days or when a prolonged or substantial deviation is expected.
• Where stress testing identifies vulnerability, compliance and risk functions should assess whether Article 28(4) immediate notification, Article 28(5) reporting and an action plan are required.
• Managers should prepare records explaining any sustained deviation, including investor-liability characteristics, redemption patterns, liquidity-risk-system outputs, stress-test results and remedial measures, because the CSSF may increase supervisory scrutiny and review available information.
• Firms should assess whether prospectus disclosures, internal liquidity-risk policies, investment guidelines, delegation arrangements and board or conducting-officer reporting need updating during the three-month implementation period.

What changed

The final guidance follows the CSSF consultation launched on 8 June 2026 and contains only slight clarifications after stakeholder feedback. MMF managers are expected to treat 20% WLA for VNAV funds and 40% WLA for public debt CNAV and LVNAV funds as market-resilience reference levels within their liquidity-risk-management and stress-testing frameworks. When WLA approaches or falls below the applicable level, managers should apply enhanced vigilance, timely escalation and reinforced internal decision-making.

Key dates

2026-08-03 Deadline

Deadline for stakeholders to submit responses to the CSSF consultation on the proposed MMF WLA guidance.

2026-10-30

CSSF published the final MMF WLA guidance, feedback statement and consultation responses, including ALFI’s response.

Suggested considerations

• Firms should classify each in-scope MMF as VNAV, public debt CNAV or LVNAV and map the applicable 20% or 40% WLA resilience benchmark against the fund’s existing 15% or 30% MMFR minimum.
• MMF managers should review liquidity risk-management frameworks, redemption assumptions, escalation thresholds, governance documentation and management-information reporting to demonstrate how the relevant benchmark is considered as a risk-management reference point rather than treated automatically as a statutory minimum.
• Managers should incorporate the 20% and 40% benchmarks into Article 28 MMFR stress-testing methodology, scenario analysis and board or governing-body reporting, while documenting fund-specific reasons for maintaining lower or higher WLA levels where appropriate.
• Firms should establish reliable daily monitoring of WLA, a process for identifying periods exceeding 10 business days below the relevant benchmark, and controls for escalating prolonged or substantial deviations to senior management and the CSSF.
• Compliance teams may wish to prepare the information expected in a CSSF notification, including the duration and magnitude of the deviation, its cause, investor and redemption characteristics, stress-test results, liquidity-management actions and the rationale for the manager’s response.
• Boards and depositaries should review whether oversight records, challenge processes and valuation or liquidity controls adequately address the potential supervisory consequences of persistent benchmark breaches.
• Firms should assess the interaction with Circular CSSF 26/911 and the 2025 ESMA MMF stress-test guidelines, which apply to CSSF-supervised MMFs and Luxembourg managers from the 30 June 2026 reporting date onward.
• Managers should avoid presenting the resilience benchmarks to investors as amended legal minimums unless the fund’s governing documents, disclosures or risk limits separately require that treatment; market commentary from respondents indicated concern that the 10-business-day trigger could operate as a de facto limit in practice.

What changed

The final guidance retains the European Commission’s market-resilience WLA benchmarks: 20% for VNAV MMFs and 40% for public debt CNAV and LVNAV MMFs. These levels sit above the Money Market Funds Regulation (Regulation (EU) 2017/1131) minimum WLA requirements of 15% for VNAV MMFs and 30% for public debt CNAV and LVNAV MMFs; the existing daily liquid asset minimums remain 7.5% and 10%, respectively.

Key dates

2026-06-08

CSSF consultation on proposed guidance was published.

2026-08-03 Deadline

Deadline for stakeholder responses to the consultation.

2026-10-30

CSSF published the final guidance and confirmed a three-month implementation period.

2027-01-30 Deadline

End of the three-month implementation period calculated from publication of the final guidance; affected firms should have implemented the guidance by this date.

Suggested considerations

• Firms should identify each affected MMF's classification under Regulation (EU) 2017/1131 and map its current WLA and DLA monitoring against both the binding MMFR minima and the applicable 20% or 40% market-resilience benchmark.
• Compliance and risk teams may wish to update liquidity-risk policies, escalation thresholds, governance papers and management information to address enhanced vigilance when WLA approaches or falls below the benchmark.
• Managers should incorporate the 20% VNAV and 40% PD CNAV/LVNAV levels into Article 28 MMFR stress-testing methodology, scenarios, documentation and vulnerability-remediation processes.
• Firms should establish controls to identify a breach lasting more than 10 business days and to prepare timely CSSF notifications containing the causes, expected duration, justification and relevant Article 28(4) and (5) measures.
• Boards, conducting officers and relevant risk committees may wish to review whether internal decision-making and escalation procedures are sufficiently reinforced for prolonged or substantial deviations.
• Firms should distinguish clearly in investor, regulatory and internal reporting between binding MMFR liquidity minima and the CSSF's supervisory market-resilience benchmarks, since the latter are not new statutory minimum ratios.
• Luxembourg MMF managers should assess operational readiness during the three-month implementation period and retain evidence of implementation, monitoring and supervisory communications.

What changed

The final guidance largely confirms the consultation proposal and introduces only slight clarifications. MMF managers should incorporate market-resilience WLA levels of 20% for VNAV MMFs and 40% for PD CNAV and LVNAV MMFs into liquidity-risk management and Article 28 MMFR stress-testing processes. These levels operate as supervisory and risk-management benchmarks above the MMFR minimum WLA ratios of 15% for VNAV MMFs and 30% for PD CNAV and LVNAV MMFs; the minimum daily liquid asset ratios remain 7.5% for VNAV MMFs and 10% for PD CNAV and LVNAV MMFs.

Key dates

2026-12-07 Deadline

First phased requirements apply to investment firms and their clients for allocations and confirmations, including electronic, standardised, international-standard and machine-readable communications except during temporary technical disruptions.

2027-07-01 Deadline

Second phased implementation deadline under the amended settlement-discipline framework.

2027-10-11 Deadline

EU securities markets move from the standard T+2 settlement cycle to T+1; the final phased settlement-discipline requirements apply.

Suggested considerations

• Firms should map every allocation, confirmation, matching and settlement-instruction process affected by the amended settlement-discipline RTS and identify manual, non-standardised or non-machine-readable steps.
• Compliance teams may wish to confirm that electronic, standardised communication channels and international messaging standards are available to the firm and its professional clients before 7 December 2026.
• Firms should consider implementing trade-date controls, internal cut-offs, automated alerts, escalation procedures and exception reporting to identify transactions at risk of missing the applicable allocation and confirmation deadline.
• Investment firms may wish to review client onboarding and contractual documentation to ensure that professional clients provide complete settlement details and use compatible communication channels and formats.
• Operations and technology teams should test end-to-end connectivity, message formats, reference data, settlement instructions, matching, foreign-exchange funding, securities lending, collateral and asset-servicing workflows across the entire trading and settlement ecosystem.
• Firms should assess readiness not only within their own organisation but also across brokers, custodians, clients, fund administrators, CSDs, settlement agents and other outsourced providers.
• Firms should establish a phased implementation plan covering the 7 December 2026, 1 July 2027 and 11 October 2027 milestones, with evidence of testing, issue remediation and management oversight.
• Compliance teams may wish to monitor further ESMA and CSSF supervisory communications because ESMA and national competent authorities have indicated that they will monitor compliance with the new obligations.

What changed

Amended settlement-discipline regulatory technical standards under Commission Delegated Regulation (EU) 2018/1229 introduce phased requirements supporting the EU T+1 transition. From 7 December 2026, investment firms and their clients must use electronic, standardised communication channels and international messaging standards for allocations and confirmations, with machine-readable communication required except during temporary technical disruptions.

Key dates

2026-02-09

AMLA opened the public consultation on the draft RTS concerning business relationships, occasional and linked transactions, lower thresholds, and customer due diligence.

2026-04-16

AMLA opened the public consultation on the draft RTS concerning group-wide requirements and additional measures for subsidiaries and branches in third countries.

2026-05-08

Public consultation closed for the business-relationship, transaction and customer-due-diligence draft RTS.

2026-06-15

Public consultation closed for the group-wide arrangements and third-country legal-impediment draft RTS.

2026-10-01

AMLA announced that it had finalised the three draft RTS and submitted them to the European Commission for formal adoption.

2026-10-07

CSSF published its communiqué drawing Luxembourg professionals’ attention to the draft RTS and recommending preparatory gap analysis and control work.

Suggested considerations

• Compliance teams may wish to complete a gap analysis against the AMLA final reports, particularly for customer and beneficial-owner information, verification sources, electronic identification, non-face-to-face onboarding and PEP screening.
• Firms should consider mapping current customer journeys and transaction-monitoring logic to the proposed distinction between business relationships, occasional transactions and linked transactions.
• Firms may wish to identify products, sectors and transaction types that could be affected by lower CDD thresholds for higher-risk activities, while avoiding reliance on unfinalised monetary thresholds.
• Financial groups should consider reviewing group-wide AML/CFT governance, risk assessments, policies, internal controls, training and secure information-sharing arrangements, including structures involving common ownership, management, compliance control, networks or partnerships.
• Groups with branches or subsidiaries in third countries should consider inventorying legal impediments to applying EU AMLR and group policies and preparing escalation, risk-mitigation and supervisory-response procedures.
• IT and operations teams may wish to assess changes needed for customer-data fields, linked-transaction detection, identity-verification evidence, electronic identification and intra-group information exchange.
• Firms should monitor the European Commission’s adoption process and the Official Journal publication because the final text, effective date and any amendments remain unknown; preparatory work should be calibrated to the proposed six-month transition period rather than treated as a current binding deadline.

What changed

The draft RTS under Article 19(9) of Regulation (EU) 2024/1624 would establish criteria for distinguishing business relationships, occasional transactions and linked transactions, and would identify high-risk obliged entities, sectors or transactions for which lower CDD thresholds should apply. The draft RTS under Article 28(1) would specify information and verification requirements for standard, simplified and enhanced CDD, including reliable and independent verification sources, electronic identification means, qualified trust services, non-face-to-face verification, and relevant treatment...

Key dates

2024-09-18

The CSSF began the on-site inspection of the manager’s corporate governance framework.

2024-10-10

The CSSF completed the on-site inspection that identified persistent internal-governance and delegation-oversight deficiencies.

2026-07-09

The CSSF imposed the total administrative fine of EUR 71,500.

2026-10-05

The CSSF published the sanction decision anonymously.

Suggested considerations

• Compliance teams may wish to map every delegated portfolio manager to a documented, risk-based periodic due-diligence plan and verify that reviews are renewed at an appropriate frequency under the manager’s risk matrix.
• Firms should consider documenting assessments of each delegate’s legal and contractual compliance, control environment, best-execution procedures, broker-selection processes and relevant reporting capabilities.
• Firms should consider testing whether delegate oversight includes independent verification rather than relying exclusively on confirmations, questionnaires or representations from portfolio managers.
• Management companies may wish to establish measurable monitoring indicators, thresholds, exception escalation and evidence-retention arrangements for best-execution oversight, consistently with the applicable delegation procedures and CSSF Circular 18/698.
• Firms should consider reviewing delegation contracts, governance reporting and action plans to demonstrate that the supervisory framework protects the interests of the funds and investors and that monitoring of delegated activities remains with the manager.
• Compliance teams may wish to benchmark their controls against the CSSF’s broader thematic and enforcement messaging; independent commentary indicates that inadequate delegate supervision, weak quantitative monitoring and insufficient evidence of independent controls are recurring supervisory concerns.

What changed

This is an enforcement action rather than a new rule. The CSSF applied Article 110(1)(b) and (f), and Articles 148(2)(j) and 148(4)(e), of the amended Law of 17 December 2010 relating to undertakings for collective investment, together with Article 18(1)(e) and (f), and Article 51(1) and (2), of the amended Law of 12 July 2013 on alternative investment fund managers. The fine comprised EUR 47,320 under the 2010 Law and EUR 24,180 under the AIFM Law.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

01 January 2023

- Earliest financial year start date from which adjusted size criteria under Articles 35 and 47 LRCS may be applied to undertakings and groups, which indirectly affects categorisation and accounting obligations of entities subject to commercial‑law size criteria

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations is adopted, setting the legal basis for reclassification and annual accounts obligations

01 January 2024

- Default application date of the adjusted LRCS size criteria for undertakings and groups where early application from 01 January 2023 is not chosen

Financial year 2025

- New LRCS size thresholds start to determine the categorisation of pre‑existing Luxembourg undertakings and, by analogy, influence assessments of “medium‑sized” status relevant to associations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for not‑for‑profit associations (ASBLs) classified as small, medium‑sized and large, as well as public‑utility associations and foundations

Suggested considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

What changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Key dates

31 March 2021 Deadline

– End of the financial year referenced in the prior CSSF sanction against Transnet Soc Ltd for failure to publish its annual financial report within the required time limit

15 November 2021

– CSSF imposed an administrative fine of EUR 15,000 on Transnet Soc Ltd under Article 25(2) of the Transparency Law for late publication of the annual financial report as of 31 March 2021

21 July 2026

– CSSF publishes the administrative sanction “Administrative sanction imposed on Transnet Soc Ltd”; this enforcement notice is made public in line with the Transparency Law’s publication requirements

TBD (within 3 months of CSSF decision)

– Statutory window during which Transnet Soc Ltd (or any sanctioned issuer) may lodge a court action against the CSSF decision with the Luxembourg Administrative Court under Article 27 of the Transparency Law

Suggested considerations

• Map all Transparency Law obligations applicable to your entity, including periodic (annual and half‑yearly) reporting and ongoing disclosure of regulated information, and document them in a compliance obligations register.
• Review and, where necessary, strengthen internal processes to ensure annual and half‑yearly financial reports are prepared, approved, and published within statutory deadlines for issuers with Luxembourg as home Member State.
• Implement a formal disclosure governance framework assigning clear responsibilities to senior management and the board for oversight of regulated information, including escalation procedures where delays or issues arise.
• Establish a calendar of regulatory reporting and publication deadlines, including internal cut‑off dates and contingency plans, and ensure it is monitored by compliance and finance functions.
• Conduct a gap analysis of prior disclosures (financial reports, major holdings notifications, inside information) to confirm that all items required under the Transparency Law have been published correctly and on time; remediate any deficiencies promptly.

What changed

• As the 21 July 2026 CSSF notice is an enforcement publication (not a new rule), it does not introduce new regulatory requirements; it applies existing Transparency Law obligations.
• Issuers with Luxembourg as home Member State under the Transparency Law must publish annual financial reports within the statutory deadline, typically within four months of financial year-end, and...
• Failure to publish periodic financial information within the required time limits can result in administrative fines imposed by the CSSF under Article 25(2) of the Transparency Law.
• The CSSF will publicly disclose administrative fines imposed on issuers, including naming the issuer and the amount, in line with Article 26b of the Transparency Law.
• Issuers retain the right to challenge CSSF decisions before the Luxembourg Administrative Court within the period set by Article 27 of the Transparency Law (three months from notification), but...

Key dates

02 December 2022

- CSSF published the SFDR FAQ clarifying supervisory expectations for Article 8 and Article 9 disclosures

01 January 2023 Deadline

- UCITS and AIFs disclosing under Article 8 or Article 9 must use the SFDR RTS periodic reporting templates in annual reports issued after this date

Suggested considerations

• Review all Article 8 pre-contractual disclosures to confirm that the stated investment strategy clearly explains how the fund’s environmental or social characteristics are achieved.
• Strengthen any Article 8 exclusion-based strategy disclosures so they provide sufficient detail for investors to understand the connection between exclusions and the claimed sustainability characteristics.
• Reassess all Article 9 product classifications to confirm that the portfolio is built around qualifying sustainable investments, not only exclusions.
• Implement controls to verify that Article 9 holdings remain aligned with Article 2(17) SFDR on an ongoing basis throughout the fund lifecycle.
• Document and retain the internal methodology used to assess sustainable-investment status, including any thresholds, and ensure it can be provided to investors or supervisors upon request.

What changed

• - Article 8 funds must describe how the investment strategy actually enables the fund to meet the environmental and/or social characteristics disclosed to investors.
• If an Article 8 fund relies mainly on an exclusion strategy, the CSSF expects the exclusion policy to be detailed enough for investors to understand how the stated characteristics are being met.
• Article 9 funds cannot rely only on an exclusion strategy; they must invest in sustainable investments and use a positive selection process that demonstrates alignment with Article 2(17) SFDR.
• For Article 9 funds, the CSSF expects sustainable-investment status to be maintained at all times, including on an ongoing basis during the life cycle of the fund.
• Financial market participants should make available the methodology used to determine whether an investment is a sustainable investment, including any thresholds used for a pass-fail approach.

Key dates

02 March 2026

- Most revised MiFIR transparency requirements under the MiFID II/MiFIR review (amending Delegated Regulation) apply at EU level, influencing the content and focus of national FAQs and supervisory guidance, including CSSF’s

13 July 2026 Deadline

- CSSF publishes/updates the MiFID II/MiFIR FAQ version dated 13 July 2026, which becomes the current reference point for CSSF supervisory expectations on MiFID II/MiFIR compliance

Suggested considerations

• Review the latest CSSF MiFID II/MiFIR FAQ (13 July 2026 version) in full, comparing it against existing internal MiFID II/MiFIR policies, procedures, and controls to identify gaps or misalignments.
• Confirm and, where necessary, update client‑facing disclosures to clearly state whether investment services (especially advice and portfolio management) are provided on an independent or non‑independent basis, and ensure that inducement arrangements are consistent with this classification.
• Reassess inducement frameworks (commissions, fees, non‑monetary benefits) for investment advice and portfolio management to ensure that no prohibited inducements are received or retained where services are independent or involve portfolio management.
• Review and update product governance frameworks, including target market definition processes and product approval procedures, to ensure that each instrument’s intended target market is properly documented and consistently used by distributors.
• Examine best execution policies to confirm they are clear, detailed, and understandable to clients, and implement or enhance ongoing monitoring mechanisms (e.g. execution quality reports, periodic reviews) to evidence compliance with best execution obligations.

What changed

• Because the visible page content provided is limited to technical and cookie‑related information, the key points below focus on the regulatory substance of the CSSF MiFID II/MiFIR FAQ (Q&A) as the...
• The CSSF confirms the application of MiFID II investor protection rules to Luxembourg investment service providers, including obligations on inducements, suitability, product governance, and best...
• The FAQ reiterates that investment services providers must inform clients clearly whether their investment advice or services are provided on an independent or non‑independent basis, and explains the...
• The FAQ clarifies that inducements are expressly prohibited when investment advice is provided on an independent basis and for portfolio management services, requiring firms to structure their...
• The CSSF guidance reflects product governance obligations: manufacturers must define a target market for each financial instrument based on clients’ knowledge and experience, financial situation,...

Key dates

01 July 2026

- ESMA launches its public consultation on simplifying the EU Taxonomy disclosure framework and technical advice on selected KPIs under the Taxonomy Disclosures Delegated Act

22 July 2026

- ESMA holds a public hearing to present its proposals and engage with stakeholders on the consultation

12 August 2026 Deadline

- Deadline for stakeholders to submit responses to ESMA’s consultation on Taxonomy disclosure simplification

By October 2026

- ESMA (and other ESAs) are expected to deliver final technical advice on the Taxonomy Disclosures Delegated Act KPIs to the European Commission

Q1 2027

- Target date for the European Commission to complete its review of the Taxonomy Disclosures Delegated Act based on ESAs’ advice

Suggested considerations

• Conduct an internal impact assessment of current Taxonomy Article 8 KPI calculation and reporting processes, focusing on OpEx, Commissions and Fees, Trading Book, and Underwriting KPIs, to identify pain points and simplification priorities.
• Prepare and submit a response to ESMA’s consultation by 12 August 2026, either directly or via industry associations, articulating specific operational, data, and system challenges and concrete proposals for simplification.
• Register for and attend ESMA’s public hearing on 22 July 2026 to understand the detailed proposals, ask clarifying questions, and align internal positions ahead of submission.
• Coordinate with regulatory affairs, sustainability, risk, and finance functions to develop a unified institutional position on the desired design of revised KPIs and group‑level reporting under the Taxonomy Disclosures Delegated Act.
• Map dependencies between Taxonomy Article 8 data and other ESG reporting (including SFDR product disclosures and CSRD/ESRS reporting) to anticipate how changes to KPIs may affect cross‑framework consistency and data architecture.

What changed

• - ESMA is consulting on technical advice to the European Commission specifically targeting selected KPIs under the Taxonomy Disclosures Delegated Act (Article 8 of the Taxonomy Regulation), including...
• The stated policy objective is simplification of the EU Taxonomy disclosure framework while preserving decision‑useful information for investors and supervisors.
• ESMA aims to reduce reporting burdens for market participants, notably corporates and financial institutions subject to Taxonomy Article 8 disclosures.
• The consultation covers selected KPIs under the Taxonomy Disclosures Delegated Act, with the European Commission having requested focused advice on: OpEx KPI of non‑financial firms; Commissions and...
• ESMA is proposing more pragmatic approaches to group‑level reporting for mixed groups, including reporting at parent‑undertaking level to reduce complexity for conglomerates.

Key dates

2025

- CSSF’s supervisory disclosure covers **measures and administrative penalties for the year 2025**

23 July 2025

- CSSF published the prior year’s supervisory disclosure page referencing the **2024** measures and penalties, showing the annual disclosure cycle

28 July 2025 Deadline

- CSSF issued an **administrative sanction** in an AML/CFT case, imposing a reprimand for non-compliance with the AML/CFT Law

Suggested considerations

• Review the firm’s AML/CFT control framework against the Luxembourg AML/CFT Law provisions that can trigger CSSF reprimands or sanctions, including governance, monitoring, and escalation controls.
• Verify that suspicious activity detection, investigation, and escalation procedures are documented, implemented, and tested for effectiveness.
• Reassess whether internal controls are sufficient to demonstrate timely compliance with professional AML/CFT obligations under CSSF supervision.
• Update remediation tracking to ensure supervisory findings are closed out promptly and supported by evidence of corrective action.
• Brief senior management on the reputational impact of public supervisory disclosures and ensure that recurring weaknesses are escalated to the board.

What changed

• - CSSF has published its 2025 supervisory disclosure covering supervisory measures and administrative penalties taken during the year.
• The publication serves as a public register-style disclosure of enforcement outcomes, increasing transparency around CSSF supervision and sanctioning activity.
• A related 2025 CSSF administrative sanction shows that AML/CFT non-compliance can result in a reprimand under the amended Luxembourg AML/CFT Law.
• The 28 July 2025 sanction confirms that CSSF can act where firms fail to maintain adequate professional AML/CFT obligations and related internal controls.

Key dates

27 October 2022

- Circular CSSF 22/822 was issued, establishing the framework for using FATF statements on high-risk jurisdictions and jurisdictions under increased monitoring

19 June 2026

- The annex was updated to this version date, reflecting the current FATF jurisdiction lists and associated risk posture

22 June 2026

- CSSF published the annex on its website, making the updated reference document operationally relevant for supervised firms

Suggested considerations

• Review your AML/CFT country-risk methodology and update it to reflect the 19 June 2026 FATF/CSSF jurisdiction list.
• Re-screen customers, beneficial owners, counterparties, and transactions against the updated high-risk and monitored jurisdiction lists.
• Apply enhanced due diligence for relationships and transactions involving high-risk jurisdictions, and escalate where counter-measures may be required.
• Reassess risk ratings for customers linked to jurisdictions under increased monitoring and document the rationale for any continued onboarding, retention, or exit decisions.
• Update automated screening rules, transaction-monitoring scenarios, and onboarding checklists so they use the current CSSF annex version.

What changed

• - CSSF republished the annex to Circular CSSF 22/822 in a Version of 19 June 2026, meaning firms should treat this as the current Luxembourg reference point for FATF jurisdiction screening and...
• The annex distinguishes between high-risk jurisdictions subject to enhanced due diligence and, where appropriate, counter-measures, and jurisdictions under increased monitoring that require...
• The publication incorporates the FATF’s current statements on jurisdictions with strategic AML/CFT/CPF deficiencies, which is the basis for operational country-risk controls used by...
• The related Circular CSSF 22/822 remains the framework document that instructs professionals to use FATF statements when assessing jurisdictional ML/TF/PF risk.

Key dates

19 June 2026

- CSSF communiqué published announcing the two new merger authorisation forms for UCITS domestic mergers and UCITS outbound cross‑border mergers

19 June 2026 Deadline

- **Start of mandatory use of the new forms** for all **new merger authorisation applications** filed with the CSSF; applications submitted from this date must use the new templates and be sent to [email protected]

Suggested considerations

• Identify all current and planned UCITS domestic and outbound cross‑border merger projects and determine which will have CSSF authorisation requests submitted on or after 19 June 2026 so that the new forms are used.
• Download and review in detail the “Application form for authorisation of a UCITS domestic merger” and “Application form for authorisation of a UCITS outbound cross‑border merger” and map each field of the forms to existing internal data sources and documents.
• Update internal UCITS merger procedures and checklists to replace any existing CSSF filing templates with the new standardised forms and to include the requirement that all merger authorisation applications are submitted to [email protected].
• Train legal, product, operations and compliance staff involved in UCITS mergers on how to complete the new forms accurately, including coordination of information across the prospectus, KIIDs/KIDs, common draft merger terms, depositary statements and shareholder communications.
• Review and, where necessary, update board and governance templates (board minutes, resolutions approving merger terms) to ensure they produce all information that the new forms require to be confirmed or attached.

What changed

• - The CSSF has created a standardised “Application form for authorisation of a UCITS domestic merger” specifically for merger authorisation requests where both merging and receiving UCITS are...
• The CSSF has created a standardised “Application form for authorisation of a UCITS outbound cross‑border merger” for mergers where the merging UCITS is Luxembourg‑authorised and the receiving UCITS...
• Use of the two new forms is mandatory for all new merger authorisation applications submitted to the CSSF from 19 June 2026 onwards; legacy formats (ad‑hoc letters or bespoke templates) may no longer...
• Each application form must be “duly completed” and accompanied by all documents required under the applicable UCITS merger regulations, including the common draft terms of merger, updated prospectus...
• The CSSF has specified a centralised submission channel for these applications: completed forms and supporting documentation must be sent to [email protected], aligning merger filings with the...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be overhauled

15 June 2026

– CSSF press release published, drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview and signaling supervisory expectations that entities consider this doctrine when preparing annual accounts

Suggested considerations

• Obtain and review the full CNC Q&A 26/037 and the CNC chairman’s interview (French‑language originals), ensuring that finance, accounting, and compliance teams understand the clarified distinctions between statutory and contractual/voluntary annual accounts.
• Map all sets of financial statements prepared by each Luxembourg entity (statutory accounts, covenant‑based or lender‑specific accounts, group reporting packages, management accounts, etc.) and classify each set as statutory or contractual/voluntary in line with CNC Q&A 26/037 definitions.
• Update internal accounting policies and manuals to explicitly define statutory versus contractual/voluntary annual accounts, specify the applicable accounting principles and disclosures for each, and describe any differences in measurement, presentation, or scope.
• Assess current practices for communicating financial information to lenders, investors, regulators, and other stakeholders to confirm that non‑statutory accounts are not labeled or presented in a way that could be misinterpreted as statutory accounts approved under Luxembourg company law.
• Implement clear labeling and disclosure conventions on the face of financial statements and in accompanying notes (e.g., in engagement reports, board minutes, and management communications) to distinguish statutory annual accounts from any contractual or voluntary accounts.

What changed

• - The CSSF formally draws regulated entities’ attention to CNC Q&A 26/037, elevating it as a key interpretative reference on the concepts of annual accounts prepared for legal/statutory purposes...
• The CNC Q&A 26/037 provides clarified definitions of “comptes annuels établis à fins légales” (statutory annual accounts) and “comptes annuels établis à des fins contractuelles ou sur base...
• The Q&A gives practical answers to frequently asked questions from preparers about when accounts qualify as statutory versus merely contractual or voluntary, and how this affects applicable...
• The Q&A addresses related issues, such as the extent to which CNC doctrine and Luxembourg GAAP must be followed for contractual or voluntary accounts, and the risks of presenting non‑statutory...
• The CSSF also highlights an interview with the CNC chairman announcing that Luxembourg accounting legislation will undergo a refonte (major overhaul), signaling that current CNC doctrine, including...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be subject to a comprehensive overhaul

15 June 2026

– CSSF communiqué published, formally drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview, and thereby activating supervisory expectations that firms take these clarifications into account

TBD (post‑2026)

– Effective dates for the planned overhaul of Luxembourg accounting legislation remain to be defined; firms should anticipate consultation and transition periods once draft law is published

Suggested considerations

• Identify all sets of financial statements prepared by the firm or its Luxembourg entities (statutory, covenant/banking, shareholder/management, group‑reporting, voluntary) and map which are statutory annual accounts under Luxembourg law and which are contractual or voluntary.
• Review the CNC Q&A 26/037 in detail and update internal accounting manuals and group reporting policies to embed the CNC’s definitions, terminology and criteria for statutory versus non‑statutory annual accounts.
• Implement a clear labelling and disclosure convention so that all non‑statutory financial statements explicitly state their nature (contractual or voluntary) and are not presented or communicated as statutory annual accounts.
• Update templates for board and shareholder approvals, minutes and resolutions to ensure that the correct set of statutory annual accounts is approved for legal purposes such as profit appropriation, dividend distribution, capital reduction and regulatory filings.
• Review all contractual arrangements (loan agreements, bond indentures, shareholder agreements, management incentive plans and service contracts) to determine whether they require statutory annual accounts or allow contractual/adjusted accounts, and align documentation and practice accordingly.

What changed

• - The CSSF endorses and promotes CNC Q&A 26/037 as the reference clarification on the concept of “comptes annuels établis à fins légales” (statutory annual accounts) versus annual accounts prepared...
• The Q&A provides clear criteria to distinguish statutory accounts from non‑statutory accounts, including their legal basis, approval process, filing and publication obligations, and permissible use...
• The CNC guidance clarifies that statutory annual accounts must fully comply with Luxembourg accounting law (including mandatory layouts, valuation rules and disclosures), whereas...
• The CNC addresses frequent practical questions from preparers, including whether financial statements prepared for banks, covenants, shareholders’ agreements, management incentive plans or...
• The CSSF communicates that misunderstandings between statutory and contractual accounts remain common, implicitly warning against the risk of using non‑statutory statements in contexts where...

Key dates

05 March 2026

- CSSF imposes the administrative sanction on Stonehage Fleming Luxembourg S.A. (date of decision)

09 June 2026

- CSSF publicly announces the administrative sanction and the existence of a PDF decision (date of publication on CSSF website)

Suggested considerations

• Monitor the CSSF website for publication of the detailed PDF decision relating to the administrative sanction of 5 March 2026 against Stonehage Fleming Luxembourg S.A.
• Once available, review the full decision to identify the specific legal bases (e.g. LFS, Law of 2010, Law of 2013, AML/CFT Law) and control failures cited by the CSSF.
• Map the identified weaknesses from the decision against your firm’s governance, internal control, delegate oversight and AML/CFT frameworks to identify any similar risk areas.
• Update internal compliance risk assessments to reflect the enforcement themes highlighted in this and recent CSSF sanctions, including the weighting of enforcement risk for organisational and AML/CFT deficiencies.
• Review and, where necessary, strengthen board and senior management oversight arrangements, including the documentation of decisions, challenge and escalation processes, in anticipation of CSSF expectations evidenced in the forthcoming decision.

What changed

• At this stage, based on the CSSF notice alone, no new legal or regulatory requirements are introduced; the publication is a transparency notice that a sanction decision exists.
• the Law of 5 April 1993 on the financial sector (LFS), the Law of 17 December 2010 on undertakings for collective investment, the Law of 12 July 2013 on AIFMs, and the Law of 12 November 2004 on the...
• the CSSF’s established practice of publishing individual sanction decisions, which typically detail shortcomings in organisational requirements, internal controls, oversight of delegates, conduct of...
• the legal provisions breached (for example, Articles 109–111 and 148 of the Law of 2010 or Articles 2-2, 3 and 8-4 of the AML/CFT Law, by analogy with other CSSF sanctions),
• the factual deficiencies identified (e.g., weaknesses in governance, delegate oversight, AML risk assessment, customer due diligence), and