Reporting & Disclosure in Luxembourg

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA began applying to in-scope financial entities supervised by the CSSF.

2025-12-17

The European Commission confirmed through DORA Q&A 102 that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF’s extended best-efforts deadline for the first register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2026-08-27

Circular CSSF 26/915 was published and took effect immediately; the listed CSSF circulars were amended to include or remove qualifying third-country branches as applicable.

2027-03-31 Deadline

Target date identified by CSSF for the required-quality register-of-information submission by third-country branches of credit institutions headquartered in a third country.

2027-01-11

Relevant CRD VI third-country-branch provisions are scheduled to take effect, subject to national transposition and applicable transitional rules.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the counterfactual test in Circular 26/915: whether the head-office undertaking would qualify under Article 2(1)(a) to (t) of DORA if established in the relevant third country.
• Affected branches should update their regulatory-perimeter inventories, governance documents, ICT-risk policies, outsourcing inventories, incident-classification procedures and DORA control testing to reflect immediate inclusion in the DORA-specific CSSF circulars.
• Compliance teams may wish to separate non-ICT outsourcing, which remains subject to Part I of Circular CSSF 22/806, from ICT outsourcing, which is governed by DORA and Circular CSSF 25/882 rather than the legacy Part II framework.
• Affected entities should validate their register-of-information process under DORA and Circular CSSF 25/882, including branch-level data, ICT third-party contracts, intra-group arrangements and submission ownership. The 30 June 2026 best-efforts deadline for third-country branches of credit institutions has passed, and firms should prepare for the 31 March 2027 collection and any CSSF remediation requests.
• Incident-response teams should test access to the CSSF eDesk procedure and S3 API and document an escalation process for emailing [email protected] when technical impossibility prevents electronic submission.
• Firms should assess whether they qualify for the microenterprise exclusion in Circular CSSF 25/892; the exclusion applies to entities employing fewer than 10 persons with annual turnover and/or annual balance-sheet total not exceeding EUR 2 million, subject to the DORA definition and exclusions for specified market infrastructures.
• Third-country banking groups should coordinate DORA implementation with the CRD VI third-country-branch analysis, including the 11 January 2027 effective date for relevant CRD VI provisions, rather than assuming that the two regimes have identical scope or timing.

What changed

Qualifying third-country branches are added to the scope of Circulars CSSF 25/882, 25/892 and 25/893, covering DORA ICT third-party-service information and reporting, estimation of aggregated annual costs and losses from major ICT-related incidents under Article 11(11) of DORA and the Joint ESA Guidelines JC/GL/2024/34, and reporting of major ICT-related incidents and significant cyber threats.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2026-08-21

CSSF published the administrative sanction imposed on BigRep SE.

Suggested considerations

• Firms should confirm whether each Luxembourg-home-State issuer in scope has published its annual financial report no later than four months after the end of the financial year under Article 3 of the Transparency Law.
• Firms should verify that half-yearly financial reports are published no later than three months after the end of the first six months of the financial year under Article 4 of the Transparency Law.
• Compliance teams may wish to test evidence of effective dissemination, filing with the CSSF and storage with the Officially Appointed Mechanism for each periodic report.
• Issuer boards and senior management may wish to review escalation procedures for missed reporting deadlines and CSSF orders, including documented ownership, contingency arrangements and prompt remediation.
• Firms should consider maintaining an auditable reporting calendar that captures statutory deadlines, CSSF correspondence, publication timestamps, CSSF filings and Officially Appointed Mechanism confirmations.
• Issuers subject to a CSSF order should consider treating the order as a separately tracked remediation obligation rather than relying solely on completion of the underlying publication.

What changed

The CSSF imposed an administrative sanction on BigRep SE under the amended Luxembourg law of 11 January 2008 on transparency requirements for issuers. The decision concerns BigRep SE's failure to comply with the applicable requirement to publish periodic financial information and with related obligations concerning effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism. The sanction is an enforcement action against a specific issuer rather than a new rule or general regulatory amendment.

Key dates

2026-08-21

CSSF publication of the administrative sanction against Corestate Capital Holding S.A.

Suggested considerations

• Compliance teams of Luxembourg-home-State issuers should obtain and review both PDFs linked to the CSSF publication to confirm the sanction amount, affected report, breached provision, reasoning and any required remediation.
• Issuers should consider testing their annual and half-yearly financial-reporting calendars against the applicable deadlines in Articles 3 and 4 of the Transparency Law, including controls for effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism.
• Boards and senior management may wish to document ownership, escalation and evidence-retention arrangements for periodic-reporting deliverables, particularly where audits, restructuring, going-concern issues or delayed financial close could affect publication timing.
• Groups with repeated or historic reporting delays should consider a targeted review of prior CSSF correspondence, compliance with supervisory orders and the completeness of issuer disclosure controls.
• Legal and compliance teams should assess whether any appeal or procedural response is relevant after reviewing the decision; the publication page supplied does not state an appeal period.

What changed

The CSSF imposed an administrative sanction on Corestate Capital Holding S.A. The supplied publication page does not disclose the sanction amount, the precise reporting failure, the legal provision breached, or any remedial order; those details should be taken from the linked PDF decision before relying on them operationally. The publication does not itself introduce a new general obligation: the relevant existing framework is the Luxembourg Transparency Law of 11 January 2008, including its periodic-reporting, dissemination, storage and CSSF-filing requirements where applicable.

Key dates

2026-08-21

CSSF imposed and published the €10,000 administrative fine against Gaz Capital S.A. for non-compliance concerning the annual financial report for the year ended 31 December 2025.

Suggested considerations

• Compliance teams may wish to identify every security for which the firm has Luxembourg as its home Member State and confirm whether any Article 7 exemption applies.
• Issuers with a 31 December financial year-end should consider scheduling publication of the annual financial report no later than 30 April of the following year, subject to the applicable reporting-period and instrument requirements.
• Firms should consider maintaining evidence of timely publication, effective dissemination, submission to the CSSF and storage on the Officially Appointed Mechanism, including timestamps, responsible persons and vendor confirmations.
• Reporting calendars may be reviewed to ensure that audited financial statements, the management report and responsible-person statements are complete and approved sufficiently before the four-month deadline.
• Where a delay is possible, issuers may wish to escalate promptly to senior management, legal counsel and the CSSF and document the cause, remediation and communications plan; the sanction indicates that failure across multiple disclosure channels can be treated as non-compliance even where the underlying report is subsequently produced.
• The issuer may wish to assess whether to challenge the decision before the Tribunal administratif within the statutory three-month period.

What changed

No new regulatory obligation was introduced; this is an enforcement action applying existing requirements. An issuer for which Luxembourg is the home Member State must make its annual financial report public no later than four months after the end of each financial year under Article 3 of the Transparency Law, keep it publicly available for at least 10 years, effectively disseminate it, store it on the Officially Appointed Mechanism and file it with the CSSF.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

01 January 2023

- Earliest financial year start date from which adjusted size criteria under Articles 35 and 47 LRCS may be applied to undertakings and groups, which indirectly affects categorisation and accounting obligations of entities subject to commercial‑law size criteria

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations is adopted, setting the legal basis for reclassification and annual accounts obligations

01 January 2024

- Default application date of the adjusted LRCS size criteria for undertakings and groups where early application from 01 January 2023 is not chosen

Financial year 2025

- New LRCS size thresholds start to determine the categorisation of pre‑existing Luxembourg undertakings and, by analogy, influence assessments of “medium‑sized” status relevant to associations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for not‑for‑profit associations (ASBLs) classified as small, medium‑sized and large, as well as public‑utility associations and foundations

Suggested considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

What changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Key dates

12 June 2025

- Commission Delegated Regulation (EU) 2025/1156 is adopted, supplementing MiFIR with RTS on the obligation to make market data available to the public on a reasonable commercial basis

23 August 2026

- ESMA Guidelines on MiFID II/MiFIR market data obligations are withdrawn; CSSF Circular 21/783, which incorporated these Guidelines into CSSF administrative practice, becomes outdated from this date

Suggested considerations

• Identify and catalogue all internal policies, procedures, contractual templates, and pricing frameworks that reference CSSF Circular 21/783 or ESMA’s MiFID II/MiFIR market data Guidelines.
• Review Commission Delegated Regulation (EU) 2025/1156 in detail and map its RTS requirements (e.g. cost-based pricing, non-discriminatory access, data unbundling, publication formats) against current market data practices.
• Update market data pricing policies to ensure that fees are demonstrably based on reasonable commercial basis criteria defined in Delegated Regulation (EU) 2025/1156, including documentation of cost allocation and margin methodology.
• Revise market data access policies and client terms to ensure non‑discriminatory conditions and appropriate unbundling of pre‑trade and post‑trade data, in line with the RTS.
• Amend compliance manuals, MiFID/MiFIR control frameworks, and training materials to remove references to CSSF Circular 21/783 and ESMA Guidelines, replacing them with references to Delegated Regulation (EU) 2025/1156.

What changed

• - CSSF Circular 21/783, which applied ESMA’s Guidelines on MiFID II/MiFIR obligations on market data in Luxembourg, will cease to be applicable as of 23 August 2026 and is formally classified as...
• The supervisory reference framework for market data obligations in Luxembourg shifts from ESMA soft-law Guidelines to binding regulatory technical standards contained in Commission Delegated...
• Requirements on making market data available to the public on a “reasonable commercial basis” are now set out in directly applicable EU law, including detailed RTS criteria on cost-based pricing,...
• ESMA’s interpretative role via Guidelines is replaced by binding RTS, which reduces reliance on national circulars and increases harmonisation of market data rules across EU trading venues and data...
• Luxembourg firms can no longer rely on Circular 21/783 as the primary interpretative document for market data obligations; instead, their compliance frameworks must directly reference Delegated...

Key dates

31 March 2021 Deadline

– End of the financial year referenced in the prior CSSF sanction against Transnet Soc Ltd for failure to publish its annual financial report within the required time limit

15 November 2021

– CSSF imposed an administrative fine of EUR 15,000 on Transnet Soc Ltd under Article 25(2) of the Transparency Law for late publication of the annual financial report as of 31 March 2021

21 July 2026

– CSSF publishes the administrative sanction “Administrative sanction imposed on Transnet Soc Ltd”; this enforcement notice is made public in line with the Transparency Law’s publication requirements

TBD (within 3 months of CSSF decision)

– Statutory window during which Transnet Soc Ltd (or any sanctioned issuer) may lodge a court action against the CSSF decision with the Luxembourg Administrative Court under Article 27 of the Transparency Law

Suggested considerations

• Map all Transparency Law obligations applicable to your entity, including periodic (annual and half‑yearly) reporting and ongoing disclosure of regulated information, and document them in a compliance obligations register.
• Review and, where necessary, strengthen internal processes to ensure annual and half‑yearly financial reports are prepared, approved, and published within statutory deadlines for issuers with Luxembourg as home Member State.
• Implement a formal disclosure governance framework assigning clear responsibilities to senior management and the board for oversight of regulated information, including escalation procedures where delays or issues arise.
• Establish a calendar of regulatory reporting and publication deadlines, including internal cut‑off dates and contingency plans, and ensure it is monitored by compliance and finance functions.
• Conduct a gap analysis of prior disclosures (financial reports, major holdings notifications, inside information) to confirm that all items required under the Transparency Law have been published correctly and on time; remediate any deficiencies promptly.

What changed

• As the 21 July 2026 CSSF notice is an enforcement publication (not a new rule), it does not introduce new regulatory requirements; it applies existing Transparency Law obligations.
• Issuers with Luxembourg as home Member State under the Transparency Law must publish annual financial reports within the statutory deadline, typically within four months of financial year-end, and...
• Failure to publish periodic financial information within the required time limits can result in administrative fines imposed by the CSSF under Article 25(2) of the Transparency Law.
• The CSSF will publicly disclose administrative fines imposed on issuers, including naming the issuer and the amount, in line with Article 26b of the Transparency Law.
• Issuers retain the right to challenge CSSF decisions before the Luxembourg Administrative Court within the period set by Article 27 of the Transparency Law (three months from notification), but...

Key dates

02 December 2022

- CSSF published the SFDR FAQ clarifying supervisory expectations for Article 8 and Article 9 disclosures

01 January 2023 Deadline

- UCITS and AIFs disclosing under Article 8 or Article 9 must use the SFDR RTS periodic reporting templates in annual reports issued after this date

Suggested considerations

• Review all Article 8 pre-contractual disclosures to confirm that the stated investment strategy clearly explains how the fund’s environmental or social characteristics are achieved.
• Strengthen any Article 8 exclusion-based strategy disclosures so they provide sufficient detail for investors to understand the connection between exclusions and the claimed sustainability characteristics.
• Reassess all Article 9 product classifications to confirm that the portfolio is built around qualifying sustainable investments, not only exclusions.
• Implement controls to verify that Article 9 holdings remain aligned with Article 2(17) SFDR on an ongoing basis throughout the fund lifecycle.
• Document and retain the internal methodology used to assess sustainable-investment status, including any thresholds, and ensure it can be provided to investors or supervisors upon request.

What changed

• - Article 8 funds must describe how the investment strategy actually enables the fund to meet the environmental and/or social characteristics disclosed to investors.
• If an Article 8 fund relies mainly on an exclusion strategy, the CSSF expects the exclusion policy to be detailed enough for investors to understand how the stated characteristics are being met.
• Article 9 funds cannot rely only on an exclusion strategy; they must invest in sustainable investments and use a positive selection process that demonstrates alignment with Article 2(17) SFDR.
• For Article 9 funds, the CSSF expects sustainable-investment status to be maintained at all times, including on an ongoing basis during the life cycle of the fund.
• Financial market participants should make available the methodology used to determine whether an investment is a sustainable investment, including any thresholds used for a pass-fail approach.

Key dates

02 March 2026

- Most revised MiFIR transparency requirements under the MiFID II/MiFIR review (amending Delegated Regulation) apply at EU level, influencing the content and focus of national FAQs and supervisory guidance, including CSSF’s

13 July 2026 Deadline

- CSSF publishes/updates the MiFID II/MiFIR FAQ version dated 13 July 2026, which becomes the current reference point for CSSF supervisory expectations on MiFID II/MiFIR compliance

Suggested considerations

• Review the latest CSSF MiFID II/MiFIR FAQ (13 July 2026 version) in full, comparing it against existing internal MiFID II/MiFIR policies, procedures, and controls to identify gaps or misalignments.
• Confirm and, where necessary, update client‑facing disclosures to clearly state whether investment services (especially advice and portfolio management) are provided on an independent or non‑independent basis, and ensure that inducement arrangements are consistent with this classification.
• Reassess inducement frameworks (commissions, fees, non‑monetary benefits) for investment advice and portfolio management to ensure that no prohibited inducements are received or retained where services are independent or involve portfolio management.
• Review and update product governance frameworks, including target market definition processes and product approval procedures, to ensure that each instrument’s intended target market is properly documented and consistently used by distributors.
• Examine best execution policies to confirm they are clear, detailed, and understandable to clients, and implement or enhance ongoing monitoring mechanisms (e.g. execution quality reports, periodic reviews) to evidence compliance with best execution obligations.

What changed

• Because the visible page content provided is limited to technical and cookie‑related information, the key points below focus on the regulatory substance of the CSSF MiFID II/MiFIR FAQ (Q&A) as the...
• The CSSF confirms the application of MiFID II investor protection rules to Luxembourg investment service providers, including obligations on inducements, suitability, product governance, and best...
• The FAQ reiterates that investment services providers must inform clients clearly whether their investment advice or services are provided on an independent or non‑independent basis, and explains the...
• The FAQ clarifies that inducements are expressly prohibited when investment advice is provided on an independent basis and for portfolio management services, requiring firms to structure their...
• The CSSF guidance reflects product governance obligations: manufacturers must define a target market for each financial instrument based on clients’ knowledge and experience, financial situation,...

Key dates

20 January 2026

– CSSF publishes Circular 26/906 on central administration, internal governance and risk management for payment and e‑money institutions, raising supervisory expectations for the sector

2 March 2026

– CSSF issues the administrative sanction decision imposing an administrative fine of EUR 12,000 on PingPong Europe S.A. as an electronic money institution

30 June 2026

– Effective date of CSSF Circular 26/906, from which strengthened governance, risk management and safeguarding requirements apply to payment and e‑money institutions

8 July 2026

– CSSF publicly publishes the administrative sanction of 2 March 2026, formally informing the market and stakeholders

Suggested considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

What changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...

Key dates

01 July 2026

- ESMA launches its public consultation on simplifying the EU Taxonomy disclosure framework and technical advice on selected KPIs under the Taxonomy Disclosures Delegated Act

22 July 2026

- ESMA holds a public hearing to present its proposals and engage with stakeholders on the consultation

12 August 2026 Deadline

- Deadline for stakeholders to submit responses to ESMA’s consultation on Taxonomy disclosure simplification

By October 2026

- ESMA (and other ESAs) are expected to deliver final technical advice on the Taxonomy Disclosures Delegated Act KPIs to the European Commission

Q1 2027

- Target date for the European Commission to complete its review of the Taxonomy Disclosures Delegated Act based on ESAs’ advice

Suggested considerations

• Conduct an internal impact assessment of current Taxonomy Article 8 KPI calculation and reporting processes, focusing on OpEx, Commissions and Fees, Trading Book, and Underwriting KPIs, to identify pain points and simplification priorities.
• Prepare and submit a response to ESMA’s consultation by 12 August 2026, either directly or via industry associations, articulating specific operational, data, and system challenges and concrete proposals for simplification.
• Register for and attend ESMA’s public hearing on 22 July 2026 to understand the detailed proposals, ask clarifying questions, and align internal positions ahead of submission.
• Coordinate with regulatory affairs, sustainability, risk, and finance functions to develop a unified institutional position on the desired design of revised KPIs and group‑level reporting under the Taxonomy Disclosures Delegated Act.
• Map dependencies between Taxonomy Article 8 data and other ESG reporting (including SFDR product disclosures and CSRD/ESRS reporting) to anticipate how changes to KPIs may affect cross‑framework consistency and data architecture.

What changed

• - ESMA is consulting on technical advice to the European Commission specifically targeting selected KPIs under the Taxonomy Disclosures Delegated Act (Article 8 of the Taxonomy Regulation), including...
• The stated policy objective is simplification of the EU Taxonomy disclosure framework while preserving decision‑useful information for investors and supervisors.
• ESMA aims to reduce reporting burdens for market participants, notably corporates and financial institutions subject to Taxonomy Article 8 disclosures.
• The consultation covers selected KPIs under the Taxonomy Disclosures Delegated Act, with the European Commission having requested focused advice on: OpEx KPI of non‑financial firms; Commissions and...
• ESMA is proposing more pragmatic approaches to group‑level reporting for mixed groups, including reporting at parent‑undertaking level to reduce complexity for conglomerates.

Key dates

30 June 2026 Deadline

– Reference date for the covered deposits snapshot; all figures in the survey must reflect the amount of covered deposits outstanding at close of business on this date

Early July 2026 (TBD by CSSF circular text and technical annex)

– Expected opening of the reporting window for uploading the 30 June 2026 covered deposits survey via CSSF eDesk or other specified channels, in line with the timetable used in prior CPDI surveys

Mid–Late July 2026 (TBD by CSSF/CSSI reporting instructions)

– Likely cut-off date for submission of the 30 June 2026 survey, consistent with prior CPDI quarterly survey practices that require prompt post‑quarter reporting for FGDL purposes

Suggested considerations

• Apply the EUR 100,000 coverage cap per depositor for the survey and ensure that non‑eligible deposits (such as certain financial sector deposits or specific categories excluded under the 2015 Law) are correctly filtered out of the covered deposits figures.
• Reconcile the 30 June 2026 covered deposits data with internal finance, risk, and regulatory reporting systems to ensure consistency with other prudential data and FGDL contribution calculations.
• Arrange for the survey report to be reviewed and formally approved by the institution’s governing body or the designated senior manager responsible for deposit guarantee scheme reporting, documenting the approval and any key assumptions or methodological choices.
• Submit the completed 30 June 2026 covered deposits survey through the CSSF eDesk platform or other specified reporting channel within the deadline set by CSSF-CPDI 26/51 and any accompanying CPDI instructions.
• Retain detailed working papers, data extracts, and methodology documentation supporting the 30 June 2026 survey in order to evidence compliance to CSSF, facilitate internal audit review, and support future FGDL ex‑ante contribution calculations.

What changed

• - CSSF launches a new covered deposits data survey with reference date 30 June 2026, continuing the established quarterly reporting cycle used for FGDL funding and risk-based contribution...
• Credit institutions incorporated under Luxembourg law, POST Luxembourg (for postal financial services), and Luxembourg branches of credit institutions from third countries must report the stock of...
• The survey must be submitted via the CSSF reporting channels (CSSF eDesk platform or other specified electronic means), using the data templates and technical specifications communicated by the CPDI,...
• Institutions that are members of the FGDL must ensure alignment between the survey data and the definition of “covered deposits” under the Law of 18 December 2015 on the failure of credit...
• The circular reaffirms that data reported for the survey feed into the risk‑based ex‑ante contribution mechanism set out in CPDI circulars on FGDL contributions (e.g.

Key dates

2025

- CSSF’s supervisory disclosure covers **measures and administrative penalties for the year 2025**

23 July 2025

- CSSF published the prior year’s supervisory disclosure page referencing the **2024** measures and penalties, showing the annual disclosure cycle

28 July 2025 Deadline

- CSSF issued an **administrative sanction** in an AML/CFT case, imposing a reprimand for non-compliance with the AML/CFT Law

Suggested considerations

• Review the firm’s AML/CFT control framework against the Luxembourg AML/CFT Law provisions that can trigger CSSF reprimands or sanctions, including governance, monitoring, and escalation controls.
• Verify that suspicious activity detection, investigation, and escalation procedures are documented, implemented, and tested for effectiveness.
• Reassess whether internal controls are sufficient to demonstrate timely compliance with professional AML/CFT obligations under CSSF supervision.
• Update remediation tracking to ensure supervisory findings are closed out promptly and supported by evidence of corrective action.
• Brief senior management on the reputational impact of public supervisory disclosures and ensure that recurring weaknesses are escalated to the board.

What changed

• - CSSF has published its 2025 supervisory disclosure covering supervisory measures and administrative penalties taken during the year.
• The publication serves as a public register-style disclosure of enforcement outcomes, increasing transparency around CSSF supervision and sanctioning activity.
• A related 2025 CSSF administrative sanction shows that AML/CFT non-compliance can result in a reprimand under the amended Luxembourg AML/CFT Law.
• The 28 July 2025 sanction confirms that CSSF can act where firms fail to maintain adequate professional AML/CFT obligations and related internal controls.

Key dates

18 June 2025

- FATF adopts modifications to Recommendation 16 to enhance payment transparency, including strengthened travel‑rule standards

24 June 2026

- FATF launches public consultation on guidance for the implementation of the updated Recommendation 16

21 August 2026 Deadline

- FATF public consultation period closes; this is the deadline for private‑sector contributions highlighted by the CSSF

End 2030

- FATF’s revised Recommendation 16 framework is expected to be fully effective, with jurisdictions having implemented the standard into national law or regulation by this date

Suggested considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

What changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Key dates

TBD (from AMLA operational go‑live date in 2025–2026)

- AMLA formally designates its first batch of directly supervised obliged entities at EU level, potentially including entities identified under this circular

25 June 2026

- CSSF publishes Circular 26/914 identifying obliged entities eligible for direct supervision by AMLA and setting the framework for Luxembourg’s contribution to AMLA’s selection and supervisory process

TBD (periodic, post‑AMLA go‑live)

- Periodic reviews by AMLA and the CSSF of eligible entities’ status and updates to the list of entities subject to, or proposed for, direct AMLA supervision

Suggested considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

What changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Key dates

27 October 2022

- Circular CSSF 22/822 was issued, establishing the framework for using FATF statements on high-risk jurisdictions and jurisdictions under increased monitoring

19 June 2026

- The annex was updated to this version date, reflecting the current FATF jurisdiction lists and associated risk posture

22 June 2026

- CSSF published the annex on its website, making the updated reference document operationally relevant for supervised firms

Suggested considerations

• Review your AML/CFT country-risk methodology and update it to reflect the 19 June 2026 FATF/CSSF jurisdiction list.
• Re-screen customers, beneficial owners, counterparties, and transactions against the updated high-risk and monitored jurisdiction lists.
• Apply enhanced due diligence for relationships and transactions involving high-risk jurisdictions, and escalate where counter-measures may be required.
• Reassess risk ratings for customers linked to jurisdictions under increased monitoring and document the rationale for any continued onboarding, retention, or exit decisions.
• Update automated screening rules, transaction-monitoring scenarios, and onboarding checklists so they use the current CSSF annex version.

What changed

• - CSSF republished the annex to Circular CSSF 22/822 in a Version of 19 June 2026, meaning firms should treat this as the current Luxembourg reference point for FATF jurisdiction screening and...
• The annex distinguishes between high-risk jurisdictions subject to enhanced due diligence and, where appropriate, counter-measures, and jurisdictions under increased monitoring that require...
• The publication incorporates the FATF’s current statements on jurisdictions with strategic AML/CFT/CPF deficiencies, which is the basis for operational country-risk controls used by...
• The related Circular CSSF 22/822 remains the framework document that instructs professionals to use FATF statements when assessing jurisdictional ML/TF/PF risk.

Key dates

22 June 2026

- Circular CSSF 26/913 is published and the CSSF confirms application of EBA/GL/2026/01

TBD (effective date not stated in the publication)

- Firms should apply the CSSF’s expectations from the date the circular becomes applicable, if that date is specified in the full circular text or accompanying CSSF notice

TBD (implementation date not stated in the publication)

- Affected firms should complete internal perimeter reviews and any resulting governance or reporting updates by the first supervisory reporting cycle after application

Suggested considerations

• Review all group entities and business lines to identify activities that may fall within the definition of an ancillary services undertaking under Article 4(1)(18) CRR.
• Document a formal assessment methodology for classifying activities against the EBA/GL/2026/01 criteria.
• Reconfirm the prudential consolidation perimeter and ensure all ancillary service entities are correctly included or excluded, with the reasoning retained for supervisory review.
• Update legal entity inventories, regulatory mapping, and governance documents so they align with the CSSF’s adopted EBA framework.
• Test whether existing internal reporting, risk management, and control frameworks capture any newly identified ancillary services undertakings.

What changed

• - The CSSF has formally applied the EBA Guidelines on ancillary services undertakings specified in EBA/GL/2026/01 for identifying activities under Article 4(1)(18) of Regulation (EU) No 575/2013.
• Firms must assess whether a non-bank activity or group entity qualifies as an ancillary services undertaking under the EBA criteria, rather than relying on internal labels or informal business...
• The regulatory perimeter analysis now needs to consider whether relevant activities are performed within a banking group in a way that affects prudential consolidation and supervisory treatment.
• Institutions should expect the CSSF to use the EBA framework as the benchmark for determining whether an activity is sufficiently connected to banking support functions to fall within the ancillary...
• Compliance evidence will need to show a documented, reproducible assessment of each potentially relevant activity against the EBA identification criteria.

Key dates

19 June 2026

- CSSF communiqué published announcing the two new merger authorisation forms for UCITS domestic mergers and UCITS outbound cross‑border mergers

19 June 2026 Deadline

- **Start of mandatory use of the new forms** for all **new merger authorisation applications** filed with the CSSF; applications submitted from this date must use the new templates and be sent to [email protected]

Suggested considerations

• Identify all current and planned UCITS domestic and outbound cross‑border merger projects and determine which will have CSSF authorisation requests submitted on or after 19 June 2026 so that the new forms are used.
• Download and review in detail the “Application form for authorisation of a UCITS domestic merger” and “Application form for authorisation of a UCITS outbound cross‑border merger” and map each field of the forms to existing internal data sources and documents.
• Update internal UCITS merger procedures and checklists to replace any existing CSSF filing templates with the new standardised forms and to include the requirement that all merger authorisation applications are submitted to [email protected].
• Train legal, product, operations and compliance staff involved in UCITS mergers on how to complete the new forms accurately, including coordination of information across the prospectus, KIIDs/KIDs, common draft merger terms, depositary statements and shareholder communications.
• Review and, where necessary, update board and governance templates (board minutes, resolutions approving merger terms) to ensure they produce all information that the new forms require to be confirmed or attached.

What changed

• - The CSSF has created a standardised “Application form for authorisation of a UCITS domestic merger” specifically for merger authorisation requests where both merging and receiving UCITS are...
• The CSSF has created a standardised “Application form for authorisation of a UCITS outbound cross‑border merger” for mergers where the merging UCITS is Luxembourg‑authorised and the receiving UCITS...
• Use of the two new forms is mandatory for all new merger authorisation applications submitted to the CSSF from 19 June 2026 onwards; legacy formats (ad‑hoc letters or bespoke templates) may no longer...
• Each application form must be “duly completed” and accompanied by all documents required under the applicable UCITS merger regulations, including the common draft terms of merger, updated prospectus...
• The CSSF has specified a centralised submission channel for these applications: completed forms and supporting documentation must be sent to [email protected], aligning merger filings with the...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be overhauled

15 June 2026

– CSSF press release published, drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview and signaling supervisory expectations that entities consider this doctrine when preparing annual accounts

Suggested considerations

• Obtain and review the full CNC Q&A 26/037 and the CNC chairman’s interview (French‑language originals), ensuring that finance, accounting, and compliance teams understand the clarified distinctions between statutory and contractual/voluntary annual accounts.
• Map all sets of financial statements prepared by each Luxembourg entity (statutory accounts, covenant‑based or lender‑specific accounts, group reporting packages, management accounts, etc.) and classify each set as statutory or contractual/voluntary in line with CNC Q&A 26/037 definitions.
• Update internal accounting policies and manuals to explicitly define statutory versus contractual/voluntary annual accounts, specify the applicable accounting principles and disclosures for each, and describe any differences in measurement, presentation, or scope.
• Assess current practices for communicating financial information to lenders, investors, regulators, and other stakeholders to confirm that non‑statutory accounts are not labeled or presented in a way that could be misinterpreted as statutory accounts approved under Luxembourg company law.
• Implement clear labeling and disclosure conventions on the face of financial statements and in accompanying notes (e.g., in engagement reports, board minutes, and management communications) to distinguish statutory annual accounts from any contractual or voluntary accounts.

What changed

• - The CSSF formally draws regulated entities’ attention to CNC Q&A 26/037, elevating it as a key interpretative reference on the concepts of annual accounts prepared for legal/statutory purposes...
• The CNC Q&A 26/037 provides clarified definitions of “comptes annuels établis à fins légales” (statutory annual accounts) and “comptes annuels établis à des fins contractuelles ou sur base...
• The Q&A gives practical answers to frequently asked questions from preparers about when accounts qualify as statutory versus merely contractual or voluntary, and how this affects applicable...
• The Q&A addresses related issues, such as the extent to which CNC doctrine and Luxembourg GAAP must be followed for contractual or voluntary accounts, and the risks of presenting non‑statutory...
• The CSSF also highlights an interview with the CNC chairman announcing that Luxembourg accounting legislation will undergo a refonte (major overhaul), signaling that current CNC doctrine, including...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be subject to a comprehensive overhaul

15 June 2026

– CSSF communiqué published, formally drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview, and thereby activating supervisory expectations that firms take these clarifications into account

TBD (post‑2026)

– Effective dates for the planned overhaul of Luxembourg accounting legislation remain to be defined; firms should anticipate consultation and transition periods once draft law is published

Suggested considerations

• Identify all sets of financial statements prepared by the firm or its Luxembourg entities (statutory, covenant/banking, shareholder/management, group‑reporting, voluntary) and map which are statutory annual accounts under Luxembourg law and which are contractual or voluntary.
• Review the CNC Q&A 26/037 in detail and update internal accounting manuals and group reporting policies to embed the CNC’s definitions, terminology and criteria for statutory versus non‑statutory annual accounts.
• Implement a clear labelling and disclosure convention so that all non‑statutory financial statements explicitly state their nature (contractual or voluntary) and are not presented or communicated as statutory annual accounts.
• Update templates for board and shareholder approvals, minutes and resolutions to ensure that the correct set of statutory annual accounts is approved for legal purposes such as profit appropriation, dividend distribution, capital reduction and regulatory filings.
• Review all contractual arrangements (loan agreements, bond indentures, shareholder agreements, management incentive plans and service contracts) to determine whether they require statutory annual accounts or allow contractual/adjusted accounts, and align documentation and practice accordingly.

What changed

• - The CSSF endorses and promotes CNC Q&A 26/037 as the reference clarification on the concept of “comptes annuels établis à fins légales” (statutory annual accounts) versus annual accounts prepared...
• The Q&A provides clear criteria to distinguish statutory accounts from non‑statutory accounts, including their legal basis, approval process, filing and publication obligations, and permissible use...
• The CNC guidance clarifies that statutory annual accounts must fully comply with Luxembourg accounting law (including mandatory layouts, valuation rules and disclosures), whereas...
• The CNC addresses frequent practical questions from preparers, including whether financial statements prepared for banks, covenants, shareholders’ agreements, management incentive plans or...
• The CSSF communicates that misunderstandings between statutory and contractual accounts remain common, implicitly warning against the risk of using non‑statutory statements in contexts where...

Key dates

11 May 2026

– European Commission publishes its report on the adequacy of the MMFR and FAQs, identifying market resilience WLA levels for VNAV and CNAV/LVNAV MMFs

15 May 2026

– CSSF informs the market of the Commission’s MMF report and FAQs and flags the identified WLA “market resilience” benchmarks

8 June 2026

– CSSF publishes the communiqué launching the consultation on “Guidance on Money Market Fund Weekly Liquid Asset Levels.”

3 August 2026 Deadline

– Deadline for stakeholders to submit electronic responses on the consultation to the CSSF at [email protected]

Suggested considerations

• Review the CSSF consultation paper “Guidance on Money Market Fund Weekly Liquid Asset Levels” in detail and map the proposed WLA resilience benchmarks against existing MMF liquidity policies, procedures and internal limits.
• Perform a quantitative impact analysis comparing each MMF’s historical and current WLA levels against both MMFR minimum requirements and the Commission’s market resilience benchmarks (20% for VNAV; 40% for LVNAV and CNAV) to identify potential shortfalls or pressure points.
• Assess and, where necessary, update MMF liquidity risk management frameworks to incorporate explicit internal WLA targets, triggers and escalation procedures linked to the new resilience benchmarks, including governance oversight and board reporting.
• Integrate the proposed WLA resilience levels into stress testing programmes under Article 28 MMFR, ensuring scenarios reflect the ability of funds to maintain or restore WLA around the benchmark levels under severe but plausible market stress.
• Revisit know‑your‑investor / liability profile analysis under Article 27 MMFR to ensure that internal WLA targets adequately reflect investor concentration, redemption behaviour, dealing frequency and distribution channels.

What changed

• - The CSSF, in coordination with the European Commission, AMF (France) and Central Bank of Ireland, is consulting on national guidance that operationalises the Commission’s “market resilience” levels...
• The guidance will introduce non-binding but supervisory‑relevant WLA benchmarks designed to indicate when an MMF’s liquidity profile may warrant closer scrutiny and additional supervisory engagement.
• The consultation builds on the European Commission’s 11 May 2026 report, which identifies WLA benchmarks of 20% for VNAV MMFs and 40% for LVNAV and CNAV MMFs, compared with the MMFR regulatory minima...
• The guidance is intended to support more consistent and well‑calibrated supervision of MMFs across the EU, specifically on liquidity resilience under stress.
• MMFs that fall below the identified “market resilience” WLA levels, even while remaining compliant with the MMFR minimum percentages, can expect increased supervisory scrutiny, closer monitoring and...

Key dates

TBD (final guidance – est. late 2026)

– Expected date for CSSF to publish final guidance on MMF weekly liquid asset levels, following review of consultation feedback

08 June 2026

– CSSF publishes consultation communiqué “Guidance on Money Market Fund Weekly Liquid Asset Levels” and opens consultation on its proposed guidance

TBD (consultation deadline – likely mid‑2026) Deadline

– Expected closing date for industry comments on the consultation (to be confirmed once the full consultation paper and response deadline are made available by CSSF)

Suggested considerations

• Review the CSSF consultation paper in full as soon as it is available and identify all proposed expectations relating to weekly liquid asset levels, monitoring, and escalation.
• Map the proposed CSSF guidance against current MMF liquidity policies, prospectus disclosures, and internal procedures to identify gaps and potential areas needing enhancement.
• Assess whether existing MMF weekly liquidity monitoring tools, dashboards, and reporting are sufficient to meet anticipated CSSF expectations on frequency, granularity, and early warning indicators.
• Evaluate the current escalation framework for declining WLA levels, including board and senior management involvement, and update governance documentation to align with the likely CSSF approach to thresholds and decision‑making.
• Review MMF stress‑testing methodologies to ensure that scenarios adequately capture severe but plausible redemption and market stress in relation to WLA levels and that results are integrated into risk appetite and contingency planning.

What changed

• Given the consultation nature and the absence of a published consultation text in the extract, the following points reflect what compliance teams should reasonably anticipate and prepare for, based...
• The CSSF is consulting on formal guidance that will specify how MMFs domiciled in Luxembourg should determine, monitor, and maintain weekly liquid asset levels under the EU Money Market Funds...
• The guidance is expected to operationalise the MMFR WLA requirements (for example, minimum weekly liquidity levels and interaction with redemption activity) by setting out supervisory expectations on...
• The consultation will likely address the interaction between WLA levels and the use of liquidity management tools (such as gates, fees, or suspensions), including expectations on when and how...
• The CSSF is expected to clarify how MMFs should incorporate WLA targets and thresholds into their internal risk management policies, including stress-testing assumptions, early warning indicators,...

Key dates

17 April 2026

- CSSF adopts an administrative sanction decision against a registered alternative investment fund manager

05 June 2026

- CSSF publishes the administrative sanction notice on its website, including links to the detailed sanction decision in PDF form

Suggested considerations

• Obtain and review the full CSSF sanction decision PDFs published with the 17 April 2026 administrative sanction to identify the specific legal provisions, facts and control failures cited.
• Map the identified breaches (e.g. governance, risk management, reporting, valuation, delegation, marketing, or conduct of business) against your firm’s current policies and procedures under the Law of 12 July 2013 on AIFMs and the AIFMD framework.
• Perform a targeted gap analysis for registered AIFMs, focusing on whether “light” registration has led to under‑resourced compliance, risk, valuation, or reporting functions that could attract similar enforcement.
• Review and, where necessary, update internal governance arrangements, including board oversight, documented decision‑making, and escalation processes for regulatory issues, to align with CSSF expectations evidenced in recent sanctions against AIFMs and management companies.
• Test the effectiveness of regulatory reporting and disclosure processes (including Annex IV reporting, investor disclosures, periodic reporting, and prospectus/issuing document accuracy) to ensure they are complete, timely and consistent with CSSF rules.

What changed

• There are no formal rule changes announced in the short notice itself; however, the enforcement action reinforces several practical expectations that compliance teams should treat as de‑facto...
• CSSF confirms that registered alternative investment fund managers are fully subject to Luxembourg’s AIFM framework, including the Law of 12 July 2013 on alternative investment fund managers and the...
• CSSF reiterates, through enforcement practice, that registration status (sub‑threshold AIFM) does not shield managers from administrative sanctions where organisational, conduct, reporting, or...
• CSSF continues its policy of public naming and shaming through publication of administrative sanctions, signalling that reputational impact is a key component of its deterrence strategy.
• The sanction underscores the CSSF’s readiness to use its full sanctioning toolkit under the AIFM Law, which can include monetary fines, public statements, and prohibitions or restrictions on...