Senior Managers / Governance in Luxembourg

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

2026-08-21

CSSF published the administrative sanction imposed on BigRep SE.

Suggested considerations

• Firms should confirm whether each Luxembourg-home-State issuer in scope has published its annual financial report no later than four months after the end of the financial year under Article 3 of the Transparency Law.
• Firms should verify that half-yearly financial reports are published no later than three months after the end of the first six months of the financial year under Article 4 of the Transparency Law.
• Compliance teams may wish to test evidence of effective dissemination, filing with the CSSF and storage with the Officially Appointed Mechanism for each periodic report.
• Issuer boards and senior management may wish to review escalation procedures for missed reporting deadlines and CSSF orders, including documented ownership, contingency arrangements and prompt remediation.
• Firms should consider maintaining an auditable reporting calendar that captures statutory deadlines, CSSF correspondence, publication timestamps, CSSF filings and Officially Appointed Mechanism confirmations.
• Issuers subject to a CSSF order should consider treating the order as a separately tracked remediation obligation rather than relying solely on completion of the underlying publication.

What changed

The CSSF imposed an administrative sanction on BigRep SE under the amended Luxembourg law of 11 January 2008 on transparency requirements for issuers. The decision concerns BigRep SE's failure to comply with the applicable requirement to publish periodic financial information and with related obligations concerning effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism. The sanction is an enforcement action against a specific issuer rather than a new rule or general regulatory amendment.

Key dates

2026-08-21

CSSF publication of the administrative sanction against Corestate Capital Holding S.A.

Suggested considerations

• Compliance teams of Luxembourg-home-State issuers should obtain and review both PDFs linked to the CSSF publication to confirm the sanction amount, affected report, breached provision, reasoning and any required remediation.
• Issuers should consider testing their annual and half-yearly financial-reporting calendars against the applicable deadlines in Articles 3 and 4 of the Transparency Law, including controls for effective dissemination, filing with the CSSF and storage through the Officially Appointed Mechanism.
• Boards and senior management may wish to document ownership, escalation and evidence-retention arrangements for periodic-reporting deliverables, particularly where audits, restructuring, going-concern issues or delayed financial close could affect publication timing.
• Groups with repeated or historic reporting delays should consider a targeted review of prior CSSF correspondence, compliance with supervisory orders and the completeness of issuer disclosure controls.
• Legal and compliance teams should assess whether any appeal or procedural response is relevant after reviewing the decision; the publication page supplied does not state an appeal period.

What changed

The CSSF imposed an administrative sanction on Corestate Capital Holding S.A. The supplied publication page does not disclose the sanction amount, the precise reporting failure, the legal provision breached, or any remedial order; those details should be taken from the linked PDF decision before relying on them operationally. The publication does not itself introduce a new general obligation: the relevant existing framework is the Luxembourg Transparency Law of 11 January 2008, including its periodic-reporting, dissemination, storage and CSSF-filing requirements where applicable.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

01 January 2023

- Earliest financial year start date from which adjusted size criteria under Articles 35 and 47 LRCS may be applied to undertakings and groups, which indirectly affects categorisation and accounting obligations of entities subject to commercial‑law size criteria

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations is adopted, setting the legal basis for reclassification and annual accounts obligations

01 January 2024

- Default application date of the adjusted LRCS size criteria for undertakings and groups where early application from 01 January 2023 is not chosen

Financial year 2025

- New LRCS size thresholds start to determine the categorisation of pre‑existing Luxembourg undertakings and, by analogy, influence assessments of “medium‑sized” status relevant to associations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for not‑for‑profit associations (ASBLs) classified as small, medium‑sized and large, as well as public‑utility associations and foundations

Suggested considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

What changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Key dates

31 March 2021 Deadline

– End of the financial year referenced in the prior CSSF sanction against Transnet Soc Ltd for failure to publish its annual financial report within the required time limit

15 November 2021

– CSSF imposed an administrative fine of EUR 15,000 on Transnet Soc Ltd under Article 25(2) of the Transparency Law for late publication of the annual financial report as of 31 March 2021

21 July 2026

– CSSF publishes the administrative sanction “Administrative sanction imposed on Transnet Soc Ltd”; this enforcement notice is made public in line with the Transparency Law’s publication requirements

TBD (within 3 months of CSSF decision)

– Statutory window during which Transnet Soc Ltd (or any sanctioned issuer) may lodge a court action against the CSSF decision with the Luxembourg Administrative Court under Article 27 of the Transparency Law

Suggested considerations

• Map all Transparency Law obligations applicable to your entity, including periodic (annual and half‑yearly) reporting and ongoing disclosure of regulated information, and document them in a compliance obligations register.
• Review and, where necessary, strengthen internal processes to ensure annual and half‑yearly financial reports are prepared, approved, and published within statutory deadlines for issuers with Luxembourg as home Member State.
• Implement a formal disclosure governance framework assigning clear responsibilities to senior management and the board for oversight of regulated information, including escalation procedures where delays or issues arise.
• Establish a calendar of regulatory reporting and publication deadlines, including internal cut‑off dates and contingency plans, and ensure it is monitored by compliance and finance functions.
• Conduct a gap analysis of prior disclosures (financial reports, major holdings notifications, inside information) to confirm that all items required under the Transparency Law have been published correctly and on time; remediate any deficiencies promptly.

What changed

• As the 21 July 2026 CSSF notice is an enforcement publication (not a new rule), it does not introduce new regulatory requirements; it applies existing Transparency Law obligations.
• Issuers with Luxembourg as home Member State under the Transparency Law must publish annual financial reports within the statutory deadline, typically within four months of financial year-end, and...
• Failure to publish periodic financial information within the required time limits can result in administrative fines imposed by the CSSF under Article 25(2) of the Transparency Law.
• The CSSF will publicly disclose administrative fines imposed on issuers, including naming the issuer and the amount, in line with Article 26b of the Transparency Law.
• Issuers retain the right to challenge CSSF decisions before the Luxembourg Administrative Court within the period set by Article 27 of the Transparency Law (three months from notification), but...

Key dates

20 January 2026

– CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions, electronic money institutions and account information service providers is published

23 March 2026

– Decision date of the administrative sanction imposed on members of the board of directors of an electronic money institution

30 June 2026

– Application date of CSSF Circular 26/906, from which its governance and risk‑management requirements formally apply to payment institutions and electronic money institutions

21 July 2026

– CSSF publicly releases the notice “Administrative sanction of 23 March 2026 – Administrative sanction imposed on the members of the board of directors of an electronic money institution.”

Suggested considerations

• Review and map the institution’s current governance framework, board charter and committee mandates against the detailed requirements of CSSF Circular 26/906, including central administration, board composition, responsibilities and functioning.
• Ensure that the board of directors collectively has the required expertise, independence, diversity and time commitment, and that this is documented and periodically reassessed in line with CSSF expectations.
• Update board policies to explicitly assign responsibility for strategy, risk appetite, safeguarding of client funds, information security, outsourcing, conflicts of interest and AML/CFT, and ensure these responsibilities are effectively discharged and evidenced.
• Confirm that the institution’s central administration, decision‑making centre and administrative centre are physically located in Luxembourg and that members of the management body are sufficiently present on site, as required under the governance framework.
• Establish or reinforce the “three lines of defence” model by clearly separating business units, control functions (compliance and risk) and internal audit, and ensure reporting lines to the board are independent and robust.

What changed

• - The CSSF demonstrates that it is prepared to impose administrative sanctions directly on members of the board of directors of electronic money institutions, not just on the institution as a legal...
• Board members of Luxembourg‑authorised electronic money institutions are now clearly exposed to personal regulatory liability for governance, risk management and safeguarding failures under the CSSF...
• This enforcement confirms that CSSF Circular 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions is not only a formal...
• The sanction underscores CSSF expectations that the supervisory body (board of directors) must ensure sound and prudent management, continuity of the institution and protection of its reputation, and...
• The case signals a stricter enforcement posture by the CSSF towards the payments and e‑money sector, aligning its expectations and enforcement intensity more closely with bank‑equivalent governance...

Key dates

02 December 2022

- CSSF published the SFDR FAQ clarifying supervisory expectations for Article 8 and Article 9 disclosures

01 January 2023 Deadline

- UCITS and AIFs disclosing under Article 8 or Article 9 must use the SFDR RTS periodic reporting templates in annual reports issued after this date

Suggested considerations

• Review all Article 8 pre-contractual disclosures to confirm that the stated investment strategy clearly explains how the fund’s environmental or social characteristics are achieved.
• Strengthen any Article 8 exclusion-based strategy disclosures so they provide sufficient detail for investors to understand the connection between exclusions and the claimed sustainability characteristics.
• Reassess all Article 9 product classifications to confirm that the portfolio is built around qualifying sustainable investments, not only exclusions.
• Implement controls to verify that Article 9 holdings remain aligned with Article 2(17) SFDR on an ongoing basis throughout the fund lifecycle.
• Document and retain the internal methodology used to assess sustainable-investment status, including any thresholds, and ensure it can be provided to investors or supervisors upon request.

What changed

• - Article 8 funds must describe how the investment strategy actually enables the fund to meet the environmental and/or social characteristics disclosed to investors.
• If an Article 8 fund relies mainly on an exclusion strategy, the CSSF expects the exclusion policy to be detailed enough for investors to understand how the stated characteristics are being met.
• Article 9 funds cannot rely only on an exclusion strategy; they must invest in sustainable investments and use a positive selection process that demonstrates alignment with Article 2(17) SFDR.
• For Article 9 funds, the CSSF expects sustainable-investment status to be maintained at all times, including on an ongoing basis during the life cycle of the fund.
• Financial market participants should make available the methodology used to determine whether an investment is a sustainable investment, including any thresholds used for a pass-fail approach.

Key dates

02 March 2026

- Most revised MiFIR transparency requirements under the MiFID II/MiFIR review (amending Delegated Regulation) apply at EU level, influencing the content and focus of national FAQs and supervisory guidance, including CSSF’s

13 July 2026 Deadline

- CSSF publishes/updates the MiFID II/MiFIR FAQ version dated 13 July 2026, which becomes the current reference point for CSSF supervisory expectations on MiFID II/MiFIR compliance

Suggested considerations

• Review the latest CSSF MiFID II/MiFIR FAQ (13 July 2026 version) in full, comparing it against existing internal MiFID II/MiFIR policies, procedures, and controls to identify gaps or misalignments.
• Confirm and, where necessary, update client‑facing disclosures to clearly state whether investment services (especially advice and portfolio management) are provided on an independent or non‑independent basis, and ensure that inducement arrangements are consistent with this classification.
• Reassess inducement frameworks (commissions, fees, non‑monetary benefits) for investment advice and portfolio management to ensure that no prohibited inducements are received or retained where services are independent or involve portfolio management.
• Review and update product governance frameworks, including target market definition processes and product approval procedures, to ensure that each instrument’s intended target market is properly documented and consistently used by distributors.
• Examine best execution policies to confirm they are clear, detailed, and understandable to clients, and implement or enhance ongoing monitoring mechanisms (e.g. execution quality reports, periodic reviews) to evidence compliance with best execution obligations.

What changed

• Because the visible page content provided is limited to technical and cookie‑related information, the key points below focus on the regulatory substance of the CSSF MiFID II/MiFIR FAQ (Q&A) as the...
• The CSSF confirms the application of MiFID II investor protection rules to Luxembourg investment service providers, including obligations on inducements, suitability, product governance, and best...
• The FAQ reiterates that investment services providers must inform clients clearly whether their investment advice or services are provided on an independent or non‑independent basis, and explains the...
• The FAQ clarifies that inducements are expressly prohibited when investment advice is provided on an independent basis and for portfolio management services, requiring firms to structure their...
• The CSSF guidance reflects product governance obligations: manufacturers must define a target market for each financial instrument based on clients’ knowledge and experience, financial situation,...

Key dates

20 January 2026

– CSSF publishes Circular 26/906 on central administration, internal governance and risk management for payment and e‑money institutions, raising supervisory expectations for the sector

2 March 2026

– CSSF issues the administrative sanction decision imposing an administrative fine of EUR 12,000 on PingPong Europe S.A. as an electronic money institution

30 June 2026

– Effective date of CSSF Circular 26/906, from which strengthened governance, risk management and safeguarding requirements apply to payment and e‑money institutions

8 July 2026

– CSSF publicly publishes the administrative sanction of 2 March 2026, formally informing the market and stakeholders

Suggested considerations

• Review the CSSF sanction against PingPong Europe S.A. and identify which categories of requirements (e.g. governance, safeguarding of client funds, reporting, outsourcing, internal controls) were implicated, then map these to your own control framework.
• Conduct a gap analysis against CSSF Circular 26/906, focusing on central administration, internal governance, risk management, and safeguarding of client funds for payment and e‑money institutions.
• Update policies, procedures and internal control documentation governing payment services, e‑money issuance, safeguarding (segregation, reconciliations), outsourcing and IT connectivity to ensure alignment with CSSF Circular 26/906.
• Ensure that a clearly designated member of the management body holds documented responsibility for oversight of safeguarding arrangements and compliance with CSSF requirements for payment and e‑money institutions.
• Implement or enhance daily reconciliations and robust segregation of client funds accounts, supported by periodic internal reviews and testing of safeguarding controls.

What changed

• (From the enforcement notice itself, there are no new rules; the impact is interpretative and enforcement‑related.)
• CSSF confirms that authorised electronic money institutions are subject to active supervisory and enforcement scrutiny, including public administrative sanctions for regulatory breaches.
• The sanction demonstrates that failures which may appear operational or procedural can nonetheless result in monetary fines and public naming, reinforcing the need for robust compliance frameworks in...
• The case is likely to be assessed by CSSF in light of the new governance, risk management and safeguarding expectations introduced under CSSF Circular 26/906 for payment and e‑money institutions,...
• The public nature of the sanction underscores CSSF’s use of transparency as a deterrent tool, increasing reputational risk for firms that do not comply with licensing, governance, reporting or...

Key dates

2025

- CSSF’s supervisory disclosure covers **measures and administrative penalties for the year 2025**

23 July 2025

- CSSF published the prior year’s supervisory disclosure page referencing the **2024** measures and penalties, showing the annual disclosure cycle

28 July 2025 Deadline

- CSSF issued an **administrative sanction** in an AML/CFT case, imposing a reprimand for non-compliance with the AML/CFT Law

Suggested considerations

• Review the firm’s AML/CFT control framework against the Luxembourg AML/CFT Law provisions that can trigger CSSF reprimands or sanctions, including governance, monitoring, and escalation controls.
• Verify that suspicious activity detection, investigation, and escalation procedures are documented, implemented, and tested for effectiveness.
• Reassess whether internal controls are sufficient to demonstrate timely compliance with professional AML/CFT obligations under CSSF supervision.
• Update remediation tracking to ensure supervisory findings are closed out promptly and supported by evidence of corrective action.
• Brief senior management on the reputational impact of public supervisory disclosures and ensure that recurring weaknesses are escalated to the board.

What changed

• - CSSF has published its 2025 supervisory disclosure covering supervisory measures and administrative penalties taken during the year.
• The publication serves as a public register-style disclosure of enforcement outcomes, increasing transparency around CSSF supervision and sanctioning activity.
• A related 2025 CSSF administrative sanction shows that AML/CFT non-compliance can result in a reprimand under the amended Luxembourg AML/CFT Law.
• The 28 July 2025 sanction confirms that CSSF can act where firms fail to maintain adequate professional AML/CFT obligations and related internal controls.

Key dates

TBD (from AMLA operational go‑live date in 2025–2026)

- AMLA formally designates its first batch of directly supervised obliged entities at EU level, potentially including entities identified under this circular

25 June 2026

- CSSF publishes Circular 26/914 identifying obliged entities eligible for direct supervision by AMLA and setting the framework for Luxembourg’s contribution to AMLA’s selection and supervisory process

TBD (periodic, post‑AMLA go‑live)

- Periodic reviews by AMLA and the CSSF of eligible entities’ status and updates to the list of entities subject to, or proposed for, direct AMLA supervision

Suggested considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

What changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Key dates

22 June 2026

- Circular CSSF 26/913 is published and the CSSF confirms application of EBA/GL/2026/01

TBD (effective date not stated in the publication)

- Firms should apply the CSSF’s expectations from the date the circular becomes applicable, if that date is specified in the full circular text or accompanying CSSF notice

TBD (implementation date not stated in the publication)

- Affected firms should complete internal perimeter reviews and any resulting governance or reporting updates by the first supervisory reporting cycle after application

Suggested considerations

• Review all group entities and business lines to identify activities that may fall within the definition of an ancillary services undertaking under Article 4(1)(18) CRR.
• Document a formal assessment methodology for classifying activities against the EBA/GL/2026/01 criteria.
• Reconfirm the prudential consolidation perimeter and ensure all ancillary service entities are correctly included or excluded, with the reasoning retained for supervisory review.
• Update legal entity inventories, regulatory mapping, and governance documents so they align with the CSSF’s adopted EBA framework.
• Test whether existing internal reporting, risk management, and control frameworks capture any newly identified ancillary services undertakings.

What changed

• - The CSSF has formally applied the EBA Guidelines on ancillary services undertakings specified in EBA/GL/2026/01 for identifying activities under Article 4(1)(18) of Regulation (EU) No 575/2013.
• Firms must assess whether a non-bank activity or group entity qualifies as an ancillary services undertaking under the EBA criteria, rather than relying on internal labels or informal business...
• The regulatory perimeter analysis now needs to consider whether relevant activities are performed within a banking group in a way that affects prudential consolidation and supervisory treatment.
• Institutions should expect the CSSF to use the EBA framework as the benchmark for determining whether an activity is sufficiently connected to banking support functions to fall within the ancillary...
• Compliance evidence will need to show a documented, reproducible assessment of each potentially relevant activity against the EBA identification criteria.

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be overhauled

15 June 2026

– CSSF press release published, drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview and signaling supervisory expectations that entities consider this doctrine when preparing annual accounts

Suggested considerations

• Obtain and review the full CNC Q&A 26/037 and the CNC chairman’s interview (French‑language originals), ensuring that finance, accounting, and compliance teams understand the clarified distinctions between statutory and contractual/voluntary annual accounts.
• Map all sets of financial statements prepared by each Luxembourg entity (statutory accounts, covenant‑based or lender‑specific accounts, group reporting packages, management accounts, etc.) and classify each set as statutory or contractual/voluntary in line with CNC Q&A 26/037 definitions.
• Update internal accounting policies and manuals to explicitly define statutory versus contractual/voluntary annual accounts, specify the applicable accounting principles and disclosures for each, and describe any differences in measurement, presentation, or scope.
• Assess current practices for communicating financial information to lenders, investors, regulators, and other stakeholders to confirm that non‑statutory accounts are not labeled or presented in a way that could be misinterpreted as statutory accounts approved under Luxembourg company law.
• Implement clear labeling and disclosure conventions on the face of financial statements and in accompanying notes (e.g., in engagement reports, board minutes, and management communications) to distinguish statutory annual accounts from any contractual or voluntary accounts.

What changed

• - The CSSF formally draws regulated entities’ attention to CNC Q&A 26/037, elevating it as a key interpretative reference on the concepts of annual accounts prepared for legal/statutory purposes...
• The CNC Q&A 26/037 provides clarified definitions of “comptes annuels établis à fins légales” (statutory annual accounts) and “comptes annuels établis à des fins contractuelles ou sur base...
• The Q&A gives practical answers to frequently asked questions from preparers about when accounts qualify as statutory versus merely contractual or voluntary, and how this affects applicable...
• The Q&A addresses related issues, such as the extent to which CNC doctrine and Luxembourg GAAP must be followed for contractual or voluntary accounts, and the risks of presenting non‑statutory...
• The CSSF also highlights an interview with the CNC chairman announcing that Luxembourg accounting legislation will undergo a refonte (major overhaul), signaling that current CNC doctrine, including...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be subject to a comprehensive overhaul

15 June 2026

– CSSF communiqué published, formally drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview, and thereby activating supervisory expectations that firms take these clarifications into account

TBD (post‑2026)

– Effective dates for the planned overhaul of Luxembourg accounting legislation remain to be defined; firms should anticipate consultation and transition periods once draft law is published

Suggested considerations

• Identify all sets of financial statements prepared by the firm or its Luxembourg entities (statutory, covenant/banking, shareholder/management, group‑reporting, voluntary) and map which are statutory annual accounts under Luxembourg law and which are contractual or voluntary.
• Review the CNC Q&A 26/037 in detail and update internal accounting manuals and group reporting policies to embed the CNC’s definitions, terminology and criteria for statutory versus non‑statutory annual accounts.
• Implement a clear labelling and disclosure convention so that all non‑statutory financial statements explicitly state their nature (contractual or voluntary) and are not presented or communicated as statutory annual accounts.
• Update templates for board and shareholder approvals, minutes and resolutions to ensure that the correct set of statutory annual accounts is approved for legal purposes such as profit appropriation, dividend distribution, capital reduction and regulatory filings.
• Review all contractual arrangements (loan agreements, bond indentures, shareholder agreements, management incentive plans and service contracts) to determine whether they require statutory annual accounts or allow contractual/adjusted accounts, and align documentation and practice accordingly.

What changed

• - The CSSF endorses and promotes CNC Q&A 26/037 as the reference clarification on the concept of “comptes annuels établis à fins légales” (statutory annual accounts) versus annual accounts prepared...
• The Q&A provides clear criteria to distinguish statutory accounts from non‑statutory accounts, including their legal basis, approval process, filing and publication obligations, and permissible use...
• The CNC guidance clarifies that statutory annual accounts must fully comply with Luxembourg accounting law (including mandatory layouts, valuation rules and disclosures), whereas...
• The CNC addresses frequent practical questions from preparers, including whether financial statements prepared for banks, covenants, shareholders’ agreements, management incentive plans or...
• The CSSF communicates that misunderstandings between statutory and contractual accounts remain common, implicitly warning against the risk of using non‑statutory statements in contexts where...

Key dates

05 March 2026

- CSSF imposes the administrative sanction on Stonehage Fleming Luxembourg S.A. (date of decision)

09 June 2026

- CSSF publicly announces the administrative sanction and the existence of a PDF decision (date of publication on CSSF website)

Suggested considerations

• Monitor the CSSF website for publication of the detailed PDF decision relating to the administrative sanction of 5 March 2026 against Stonehage Fleming Luxembourg S.A.
• Once available, review the full decision to identify the specific legal bases (e.g. LFS, Law of 2010, Law of 2013, AML/CFT Law) and control failures cited by the CSSF.
• Map the identified weaknesses from the decision against your firm’s governance, internal control, delegate oversight and AML/CFT frameworks to identify any similar risk areas.
• Update internal compliance risk assessments to reflect the enforcement themes highlighted in this and recent CSSF sanctions, including the weighting of enforcement risk for organisational and AML/CFT deficiencies.
• Review and, where necessary, strengthen board and senior management oversight arrangements, including the documentation of decisions, challenge and escalation processes, in anticipation of CSSF expectations evidenced in the forthcoming decision.

What changed

• At this stage, based on the CSSF notice alone, no new legal or regulatory requirements are introduced; the publication is a transparency notice that a sanction decision exists.
• the Law of 5 April 1993 on the financial sector (LFS), the Law of 17 December 2010 on undertakings for collective investment, the Law of 12 July 2013 on AIFMs, and the Law of 12 November 2004 on the...
• the CSSF’s established practice of publishing individual sanction decisions, which typically detail shortcomings in organisational requirements, internal controls, oversight of delegates, conduct of...
• the legal provisions breached (for example, Articles 109–111 and 148 of the Law of 2010 or Articles 2-2, 3 and 8-4 of the AML/CFT Law, by analogy with other CSSF sanctions),
• the factual deficiencies identified (e.g., weaknesses in governance, delegate oversight, AML risk assessment, customer due diligence), and

Key dates

TBD (final guidance – est. late 2026)

– Expected date for CSSF to publish final guidance on MMF weekly liquid asset levels, following review of consultation feedback

08 June 2026

– CSSF publishes consultation communiqué “Guidance on Money Market Fund Weekly Liquid Asset Levels” and opens consultation on its proposed guidance

TBD (consultation deadline – likely mid‑2026) Deadline

– Expected closing date for industry comments on the consultation (to be confirmed once the full consultation paper and response deadline are made available by CSSF)

Suggested considerations

• Review the CSSF consultation paper in full as soon as it is available and identify all proposed expectations relating to weekly liquid asset levels, monitoring, and escalation.
• Map the proposed CSSF guidance against current MMF liquidity policies, prospectus disclosures, and internal procedures to identify gaps and potential areas needing enhancement.
• Assess whether existing MMF weekly liquidity monitoring tools, dashboards, and reporting are sufficient to meet anticipated CSSF expectations on frequency, granularity, and early warning indicators.
• Evaluate the current escalation framework for declining WLA levels, including board and senior management involvement, and update governance documentation to align with the likely CSSF approach to thresholds and decision‑making.
• Review MMF stress‑testing methodologies to ensure that scenarios adequately capture severe but plausible redemption and market stress in relation to WLA levels and that results are integrated into risk appetite and contingency planning.

What changed

• Given the consultation nature and the absence of a published consultation text in the extract, the following points reflect what compliance teams should reasonably anticipate and prepare for, based...
• The CSSF is consulting on formal guidance that will specify how MMFs domiciled in Luxembourg should determine, monitor, and maintain weekly liquid asset levels under the EU Money Market Funds...
• The guidance is expected to operationalise the MMFR WLA requirements (for example, minimum weekly liquidity levels and interaction with redemption activity) by setting out supervisory expectations on...
• The consultation will likely address the interaction between WLA levels and the use of liquidity management tools (such as gates, fees, or suspensions), including expectations on when and how...
• The CSSF is expected to clarify how MMFs should incorporate WLA targets and thresholds into their internal risk management policies, including stress-testing assumptions, early warning indicators,...

Key dates

17 April 2026

- CSSF adopts an administrative sanction decision against a registered alternative investment fund manager

05 June 2026

- CSSF publishes the administrative sanction notice on its website, including links to the detailed sanction decision in PDF form

Suggested considerations

• Obtain and review the full CSSF sanction decision PDFs published with the 17 April 2026 administrative sanction to identify the specific legal provisions, facts and control failures cited.
• Map the identified breaches (e.g. governance, risk management, reporting, valuation, delegation, marketing, or conduct of business) against your firm’s current policies and procedures under the Law of 12 July 2013 on AIFMs and the AIFMD framework.
• Perform a targeted gap analysis for registered AIFMs, focusing on whether “light” registration has led to under‑resourced compliance, risk, valuation, or reporting functions that could attract similar enforcement.
• Review and, where necessary, update internal governance arrangements, including board oversight, documented decision‑making, and escalation processes for regulatory issues, to align with CSSF expectations evidenced in recent sanctions against AIFMs and management companies.
• Test the effectiveness of regulatory reporting and disclosure processes (including Annex IV reporting, investor disclosures, periodic reporting, and prospectus/issuing document accuracy) to ensure they are complete, timely and consistent with CSSF rules.

What changed

• There are no formal rule changes announced in the short notice itself; however, the enforcement action reinforces several practical expectations that compliance teams should treat as de‑facto...
• CSSF confirms that registered alternative investment fund managers are fully subject to Luxembourg’s AIFM framework, including the Law of 12 July 2013 on alternative investment fund managers and the...
• CSSF reiterates, through enforcement practice, that registration status (sub‑threshold AIFM) does not shield managers from administrative sanctions where organisational, conduct, reporting, or...
• CSSF continues its policy of public naming and shaming through publication of administrative sanctions, signalling that reputational impact is a key component of its deterrence strategy.
• The sanction underscores the CSSF’s readiness to use its full sanctioning toolkit under the AIFM Law, which can include monetary fines, public statements, and prohibitions or restrictions on...

Key dates

End 2023

– CSSF thematic review launched by dedicated questionnaire to IFMs, with work conducted through 2024 and 2025 (contextual start of the current thematic exercise)

Throughout 2024 and 2025

– CSSF conducts off‑site and on‑site work as part of the dedicated thematic review on valuation frameworks for less liquid and illiquid assets

2026 Deadline

– Valuation risk for less liquid and illiquid assets is confirmed as a key supervisory priority, implying heightened supervisory focus and potential follow‑up actions during the year; no hard implementation deadline is set but prompt action is implicitly expected

04 June 2026

– CSSF publishes the Communication and Feedback Report on the thematic review and formally expects IFMs to perform a benchmarking exercise and implement corrective measures as needed

Suggested considerations

• Perform a structured benchmarking of existing valuation policies, procedures, methodologies and controls against the detailed observations and recommendations in the CSSF Feedback Report on valuation frameworks for less liquid and illiquid assets.
• Document, at IFM and fund level, all identified gaps or weaknesses in the current valuation framework, including for AIFs in illiquid strategies and UCITS Article 41(2) trash ratio positions.
• Develop and approve a remediation plan with clear owners, milestones and target dates to address identified shortcomings in valuation governance, methodologies, model validation, data sources and control processes.
• Review and, where necessary, update valuation policies and procedures to ensure they explicitly cover less liquid and illiquid assets, stressed market conditions, use of external valuers, and documentation standards across the investment lifecycle.
• Enhance valuation governance by clearly defining roles and responsibilities (including segregation from portfolio management where applicable), escalation procedures, and oversight by the board/senior management.

What changed

• - The CSSF publishes a dedicated Feedback Report on the thematic review of valuation frameworks for less liquid and illiquid assets and formally expects IFMs to use it as guidance for implementing...
• All Luxembourg IFMs are required to conduct a benchmarking exercise of their valuation frameworks against the CSSF’s observations and recommendations set out in the new Feedback Report.
• Where gaps or weaknesses are identified through this benchmarking, IFMs are expected to implement corrective measures to strengthen their valuation policies, procedures and lifecycle controls for...
• The thematic review scope formally covers AIFMs of AIFs investing in less liquid and illiquid assets (including private equity, real estate, infrastructure, private debt and fund of funds), and, on...
• The CSSF explicitly links this thematic work to previous supervisory exercises (ESMA CSA on valuation, CSSF self‑assessment questionnaires, and on‑site inspection feedback) and consolidates...

Key dates

18 July 2023

– CSSF publishes its Feedback Report on the ESMA Common Supervisory Action (CSA) on Valuation, setting out broad expectations for valuation frameworks, including for less liquid assets

31 December 2023 Deadline

– Deadline by which all IFMs managing UCITS and/or AIFs were required to complete a comprehensive assessment of their valuation frameworks and implement necessary corrective measures in line with the 2023 CSSF Feedback Report on valuation

Early 2026

– CSSF identifies valuation as an ongoing key supervisory priority for the investment fund sector in its 2026 priorities, with specific focus on IFM valuation organisation and processes

04 June 2026

– CSSF publishes the new Feedback Report on the thematic review of valuation frameworks for less liquid and illiquid assets, signalling renewed and more granular supervisory scrutiny of this area

TBD (2026–2027)

– CSSF is expected to conduct follow‑up supervisory work (off‑site reviews and on‑site inspections) to test implementation of its expectations on valuation of less liquid and illiquid assets; firms should plan remediation programmes within months rather than years

Suggested considerations

• Conduct a comprehensive gap analysis of existing valuation policies and procedures against the CSSF’s feedback on valuation, with specific attention to less liquid and illiquid assets, and document all identified weaknesses and remediation actions.
• Update and formally approve valuation policies and procedures to clearly define methodologies, model hierarchies, and data source selection for less liquid and illiquid assets, including explicit provisions for stressed market conditions.
• Implement or enhance a formal valuation model governance framework for illiquid asset models, including independent model validation, periodic back‑testing, documentation of assumptions, and at least annual model reviews.
• Review and, where necessary, redesign organisational arrangements to ensure the operational and hierarchical independence of the valuation function from portfolio management, and adjust remuneration policies to avoid performance‑linked incentives for valuation staff.
• Strengthen controls over external pricing providers and external valuers by documenting selection criteria, performing initial and ongoing due diligence, challenging methodologies, and periodically back‑testing third‑party valuations of illiquid assets.

What changed

• Based on the prior CSSF feedback on valuation and the indicated thematic focus, compliance teams should expect the following concrete expectations to apply specifically to less liquid and illiquid...
• Investment fund managers must maintain concise, centralised, and comprehensive valuation policies and procedures that explicitly cover all asset types, including less liquid and illiquid instruments,...
• Valuation policies must define and justify the valuation methodologies and models used for less liquid and illiquid assets, including the hierarchy of methods, model selection criteria, and...
• Firms must perform robust model governance for valuation models used on less liquid and illiquid assets, including independent model review (by staff not involved in model development), back‑testing,...
• Valuation frameworks must explicitly address stressed market conditions for illiquid and thinly traded assets, including triggers for stress conditions, alternative valuation methodologies under...

Key dates

02 June 2026

- CSSF publishes the reminder on T+1 readiness, survey participation, and ESMA’s consultation work

09 June 2026 Deadline

- Deadline to complete the CSSF national competent authorities’ T+1 readiness survey

07 December 2026

- Expected application date of the revised ESMA guidelines on standardised procedures and messaging protocols

11 October 2027

- T+1 settlement cycle becomes effective under CSDR

Suggested considerations

• Complete the CSSF T+1 readiness survey before 9 June 2026 and ensure the submission accurately reflects the firm’s current operational readiness.
• Participate in the EU T+1 Industry Committee second readiness survey to demonstrate engagement with the EU-wide readiness process.
• Review the firm’s allocation and confirmation workflows to ensure they can operate within T+1 timeframes.
• Replace any reliance on oral, manual, or non-machine-readable communications with electronic, standardised messaging channels unless a temporary technical disruption justifies an exception.
• Align internal messaging standards with international messaging protocols used for post-trade communication.

What changed

• - CSSF is requiring market participants to complete the national competent authorities’ T+1 readiness survey by 9 June 2026, with responses visible only to CSSF and ESMA.
• CSSF is strongly encouraging participation in the EU T+1 Industry Committee second readiness survey to support a Union-wide assessment of market preparedness.
• CSSF is flagging that the transition to T+1 settlement on 11 October 2027 under CSDR will require coordinated changes across the trading and post-trading chain.
• CSSF is warning that forthcoming amendments to the RTS on Settlement Discipline are expected to be endorsed by the European Commission and will further define operational requirements for the T+1...
• ESMA’s revised guidelines on standardised procedures and messaging protocols are intended to make post-trade communication faster, clearer, and more consistent across the EU.

Key dates

09 June 2026 Deadline

- Deadline for Luxembourg market participants to complete the CSSF national competent authorities’ T+1 readiness survey

07 December 2026

- Expected application date of revised ESMA guidelines on standardised procedures and messaging protocols and the aligned new RTS on Settlement Discipline requirements on allocations and confirmations

11 October 2027

- Effective date for the transition to a T+1 settlement cycle in the EU under CSDR

Suggested considerations

• Identify all group entities and business lines in Luxembourg that are in scope of CSDR T+1 (trading, clearing, settlement, custody, collateral, fund dealing) and formally designate a T+1 programme owner at senior management level.
• Complete the CSSF T+1 national competent authorities’ survey in full and by 9 June 2026, ensuring that responses accurately reflect current readiness, key risks, dependencies on third parties, and planned remediation milestones.
• Arrange for appropriate internal review and sign‑off (e.g. by Compliance and relevant senior management) of the responses to both the CSSF survey and the EUIC second readiness survey before submission.
• Participate in the EU T+1 Industry Committee second readiness survey and ensure the firm’s answers are consistent with the information provided to CSSF and with internal T+1 project documentation.
• Perform a comprehensive T+1 impact assessment of front‑to‑back trade flows, covering trade execution, allocation, confirmation, affirmation, clearing, settlement, collateral movements, cash and liquidity management, and corporate actions.

What changed

• - The EU settlement cycle for in‑scope financial instruments under CSDR will shorten from T+2 to T+1 with effect from 11 October 2027, materially reducing the time to complete front‑to‑back trade,...
• CSSF has launched a national competent authorities’ T+1 readiness survey and sets a firm completion deadline of 9 June 2026 for Luxembourg market participants, treating it as a critical supervisory...
• In parallel, CSSF strongly encourages Luxembourg firms to complete the EU T+1 Industry Committee (EUIC) second readiness survey to support an EU‑wide view of T+1 readiness and potential systemic...
• ESMA’s final draft amendments to the CSDR RTS on Settlement Discipline will introduce additional operational requirements specifically designed to support T+1 (e.g.
• ESMA has launched a consultation on updated guidelines on standardised procedures and messaging protocols for allocations, confirmations and affirmations, explicitly aimed at facilitating the T+1...

Key dates

21 July 2018

- Article 36(2) transparency requirements apply to MMFs authorised under MMFR as of this date, excluding MMFs benefiting from the transitional provision in article 44(1)

28 August 2018

- CSSF first published the MMFR FAQ, establishing the supervisory clarification framework for MMF questions

18 March 2024

- The CSSF MMF page shows Version 4 of the FAQ and references updated related MMF materials, including ESMA stress test scenario guidance

05 June 2025

- The CSSF webpage shows Version 4 as updated on this date, before the current Version 5 publication

Version 5 / current publication date not stated in the provided extract

- The updated FAQ is now the current CSSF guidance version on the public webpage

Suggested considerations

• Review the MMF prospectus and website disclosure architecture to ensure that maturity breakdown and credit profile information are presented in a manner consistent with the CSSF’s current FAQ interpretation.
• Confirm that weekly article 36(2) disclosures are scheduled on a controlled and documented day of the week, with escalation procedures for missed or late publication.
• Verify that internal credit quality assessment methodology, evidence, and sign-off are documented and available for disclosure or supervisory review.
• Reassess whether each MMF in scope is subject to article 36(2) based on its authorisation status and whether any transitional article 44(1) treatment applies.
• Align reporting and disclosure controls with the broader CSSF MMF framework, including recurring financial reporting expectations for CSSF-supervised MMF managers.

What changed

• - The CSSF has published an updated MMFR FAQ and the current public version is Version 5, indicating that supervisory clarifications have been refreshed since the prior Version 4 publication.
• The FAQ continues to address key MMFR transparency topics, including maturity breakdown, credit profile disclosure, and the ability to provide some information via a website link in the prospectus.
• The guidance confirms that the manager may choose the day of the week for the weekly disclosure required under article 36(2), which is operationally important for recurring disclosure controls.
• The FAQ states that information on internal credit quality assessment must be provided, reinforcing the expectation that the assessment is documented and made available as required.
• The FAQ clarifies that article 36(2) applies only to MMFs authorised in accordance with MMFR as at 21 July 2018, and not to MMFs benefiting from the transitional provision in article 44(1).

Key dates

21 January 1991

- Original Circular IML 91/75 on revision and remodelling of rules applicable to UCIs under the Law of 30 March 1988 is issued (subsequently amended by later circulars)

22 May 2026

- Circular CSSF 26/912 is published and Circular IML 91/75 (as amended by Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901) is repealed and archived

Suggested considerations

• Update your regulatory inventory and obligation registers to reflect that Circular IML 91/75 and its amending circulars (CSSF 05/177, 18/697, 21/790, 22/811 and 25/901) have been repealed by Circular CSSF 26/912 as of 22 May 2026.
• Verify that your compliance monitoring programmes and internal audit test plans do not rely on requirements sourced from Circular IML 91/75, and re-align any such tests to the currently applicable legal and regulatory standards.
• Communicate the repeal of Circular IML 91/75 internally to legal, compliance, risk, product, and fund administration teams to prevent continued reliance on obsolete rules in ongoing or future projects.
• For any ongoing remediation, authorisation or approval processes that previously cited IML 91/75 as justification for a control design, reassess and document those controls against the current CSSF requirements that have effectively replaced or superseded the 1991 framework.
• Maintain an audit trail evidencing the update of documentation and registers in response to Circular CSSF 26/912, including board or senior management notification where your governance framework requires it for changes in regulatory obligations.

What changed

• - Circular IML 91/75, including its amendments by Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901, is formally repealed by Circular CSSF 26/912.
• The rules on “revision and remodelling of the rules to which Luxembourg undertakings governed by the Law of 30 March 1988 on undertakings for collective investment are subject” no longer form part of...
• Supervisory expectations for Luxembourg UCIs are now to be derived exclusively from the current UCI regime (notably the Law of 17 December 2010 relating to undertakings for collective investment and...
• Any internal compliance mappings, policy references, or control frameworks that still cite Circular IML 91/75 or its amending circulars must be treated as referencing repealed guidance and should be...

Suggested considerations

• Register for 20 May 2026 public hearing to engage directly on practical application across group structures.[https://www.amla.europa.eu/events/public-hearing-draft-rts-group-wide-minimum-requirements-and-additional-measures-subsidiaries-and-2026-05-20_en]
• Assess current group-wide AML/CFT frameworks against proposed minimums, identifying gaps in third-country controls, risk consolidation, and data sharing protocols.

What changed

• - Group-wide AML/CFT frameworks: Establishes minimum standards for design and implementation across groups, including cross-border structures and third-country operations, to enable consolidated...
• Third-country subsidiaries and branches: Introduces additional measures for entities in non-EU countries, extending requirements beyond traditional groups to other...
• Information sharing and parent identification: Defines provisions for intra-group data sharing and criteria to identify the EU parent undertaking when multiple entities report to a third-country head...
• Interlinked mandates: Cross-references obligations between Articles 16(4) and 17(3) for complementary requirements on organizational...

Key dates

Later in 2026

- Final adoption of guidelines and technical standards

16 April 2026

- Consultation launched

20 May 2026, 10:00–12:00 CET

- Public hearing on draft RTS on group-wide requirements

28 May 2026, 10:00–12:00 CET

- Public hearing on draft Guidelines on business-wide risk assessment

15 July 2026 Deadline

- Consultation deadline for submissions

Suggested considerations

• *Immediate (by 15 July 2026):
• Review draft Guidelines and assess alignment with current BWRA practices
• Identify gaps between existing risk assessment frameworks and proposed minimum requirements
• Prepare formal consultation responses, particularly if your organization operates in non-financial sectors
• Register for relevant public hearings (28 May for BWRA Guidelines; 20 May for group-wide RTS) to engage directly with AMLA

What changed

• The draft Guidelines introduce four minimum requirements for conducting adequate business-wide risk assessments applicable to all obliged entities. The framework mandates that entities:
• Identify risk exposure across their business model, customers, products, services, transactions, delivery channels, and geographical exposure
• Maintain consolidated risk views across group structures, eliminating silos between branches and subsidiaries
• Utilize internal and external data sources to build comprehensive risk landscapes, including monitoring customer behavior changes and tracking international typologies
• Apply proportionality based on entity size, business model, and risk profile, while ensuring consistent application of policies across the organization The guidelines specifically address evaluation...

Key dates

1 April 2026

Circular CSSF 26/909 published; immediate application of ESMA competence guidelines.; [User-provided content]

Suggested considerations

• Assess Staff Competence: Implement ESMA-guided evaluations (e.g., exams, certifications) for all relevant personnel handling crypto services; document results in governance frameworks.
• Update Policies and Training: Integrate competence criteria into HR, onboarding, and annual reviews; roll out MiCA-specific training on reporting, breaches, and governance.
• Licensing Dossier Enhancement: Include competence attestations in CSSF applications; appoint dedicated compliance/risk officers with verified qualifications.
• Ongoing Monitoring: Conduct regular audits, penetration tests, and incident planning; confirm compliance annually via management body statements.
• Early CSSF Engagement: Schedule dialogues and info sessions; create MiCA readiness scorecards for board and regulator discussions.

What changed

• - Adoption of ESMA Guidelines: CSSF mandates application of ESMA's criteria for evaluating staff knowledge and competence in crypto-asset services, including roles in custody, trading, portfolio...
• Assessment Framework: Firms must implement standardized tests and processes to verify staff qualifications, aligning with MiCA Article 62 on CASP authorization, focusing on technical crypto...
• No New Standalone Rules: This circular builds on prior CSSF MiCA circulars (e.g., 25/890 on crypto-asset classification), integrating competence checks into licensing dossiers and ongoing supervision.

Key dates

23 August 2018

- Publication of underlying Circular CSSF 18/698, setting baseline requirements

14 January 2019

- Original publication of the list

12 March 2026

- Latest update to the list, requiring immediate review and integration into reporting processes[Source URL]

End of May (post Deadline

financial year); - Compliance deadline for Circular 18/698 obligations, including governance reporting (e.g., 5 months after year-end)

Suggested considerations

• Download and use the XLSX table: Incorporate the exact list of activities/mandates into internal templates for reporting management body and conducting officer roles[Source URL].
• Update authorization and notification files: Include detailed CVs, criminal record extracts, wealth declarations, and organization charts for relevant personnel/shareholders; notify CSSF of changes (e.g., qualifying holdings, guarantees).
• Conduct fit-and-proper assessments: Ensure declarations cover all listed mandates, demonstrating no conflicts and adequate resources; perform initial/ongoing due diligence on delegates.
• Annual compliance review: Document roles in compliance monitoring plans, training, and reporting to senior management/CSSF; align with delegate oversight (e.g., risk-based monitoring of compliance, audit functions).
• Policy updates: Revise governance policies to reflect the updated list, including AML/CFT officer designations and own funds proofs.

What changed

• The document was originally published on 14 January 2019 and updated on 12 March 2026, reflecting revisions to the predefined list of professional activities and mandates[Source URL].
• Alignment with Circular CSSF 18/698 requirements for IFMs (management companies for UCIs and AIFs), specifying reportable roles like those in collective portfolio management, risk management,...
• Emphasis on detailed documentation of mandates to demonstrate fitness, properness, and avoidance of conflicts, including for shareholders with qualifying holdings.
• No entirely new requirements introduced, but the update likely incorporates evolving governance expectations, such as enhanced delegate oversight and AML/CFT compliance officer designations.

Key dates

31 December 2024 Deadline

- Likely reference period end for continuing education non-compliance (inferred from identical prior case)

2 December 2025

- Date of administrative sanction imposition by CSSF

6 March 2026

- Publication date of the sanction notice (today's date, aligning with CSSF practice for transparency under Article 48(2) of the Audit Law)

Suggested considerations

• Immediate self-audit: Statutory auditors must verify personal compliance with continuing education hours under CSSF Regulation N°16-10, documenting hours against Article 3(1) requirements and submitting evidence if requested.
• Remediation plan: If shortfalls identified, complete deficit training promptly and notify CSSF of corrective measures, as seen in related governance cases where entities implemented remediation.
• Internal training programs: Audit firms should enhance monitoring of auditor CPE (continuing professional education) logs, integrating CSSF controls akin to Article 10 of the Audit Law.
• Fit-and-proper reviews: Boards and compliance officers assess auditor qualifications, escalating any gaps to CSSF per professional obligations.
• Record retention: Maintain verifiable CPE records for at least the reference period plus CSSF inspection windows (typically 3-5 years).

What changed

This is not a regulatory change or new requirement but an enforcement action applying existing rules under point f) of Article 43(1) read with point a) of Article 43(2) and Article 44 of the Law of 23 July 2016 on the audit profession (Audit Law), alongside CSSF Regulation N°16-10 on continuing education.

Key dates

31 December 2024 Deadline

- Reference period end for continuing education compliance (inferred from similar case)

2 December 2025

- Date of administrative sanction imposition by CSSF

6 March 2026

- Publication date of the sanction notice

Suggested considerations

• Statutory auditors must immediately verify compliance with Article 3(1) of CSSF Regulation N°16-10, ensuring minimum continuing education hours are met for relevant periods.
• Audit firms should conduct internal audits of training logs and implement remediation plans, including supplementary training if deficits exist.
• All affected parties must report any identified breaches to CSSF proactively and retain evidence of corrective actions, as CSSF controls under Article 10 of the Audit Law can trigger fines.

What changed

No new regulatory changes are introduced; this is an enforcement action applying existing rules under point f) of Article 43(1) read with point a) of Article 43(2) and Article 44 of the Law of 23 July 2016 concerning the audit profession (Audit Law), alongside CSSF Regulation N°16-10 on continuing education for statutory auditors. Breaches typically involve failing to meet the minimum total hours of continuing education by the reference period end (e.g., December 31, 2024, as in a comparable August 2025 case).

Key dates

10 January 2025

- Date of prior depositary oversight fine

4 April 2025 Deadline

- Deadline for submitting CSSF AML/CFT Questionnaire (breach example from similar case)

16 July 2025

- Date of fine imposition for UCITS investment policy breaches

11 September 2025

- Date of fine imposition in comparable AIFM non-cooperation case

8 October 2025

- Date of the sanction in question

Suggested considerations

• Enhance cooperation protocols: Implement automated tracking for CSSF requests (e.g., questionnaires) with escalations for reminders; document all responses.
• Review investment compliance: Audit broker exposures, valuation processes, and subscription/redemption controls against UCI Law Articles 41-43, 109; suspend dealings if uncertainties arise.
• Strengthen governance: Conduct gap analyses on internal controls, risk assessments, and reporting for depositary/oversight functions per AIFM Law Article 19(9) and CDR 231/2013.
• Training and monitoring: Roll out firm-wide training on AML/CFT obligations (Article 5(1)) and perform reconciliations of assets/records; prepare for on-site/off-site CSSF inspections.
• Self-reporting: Proactively disclose prior breaches to mitigate fine severity.

What changed

• No new regulatory changes or requirements are introduced; this is an enforcement action applying existing rules.
• Failure to cooperate with CSSF requests, e.g., not submitting required AML/CFT questionnaires by deadlines, violating Article 5(1) of the amended Law of 12 November 2004 on AML/CFT.
• Non-compliance with investment policies, organizational requirements, or conduct rules under the UCI Law (e.g., Articles 41, 43, 109), including improper broker exposures or valuation failures.
• These reflect ongoing enforcement of established frameworks like the AIFM Law, UCI Law, and AML/CFT Law, with fines calibrated by factors like breach duration, firm size, cooperation level, and prior...

Key dates

2 March 2026

Publication and effective date; Guidance applies immediately; incomplete applications received on/after this date will not start processing until complete

Suggested considerations

• Review Guidance: Download and study the XLSX document (Version 1.0) detailing per-shareholder/per-change requirements.
• Prepare Complete Packages: For initial authorisation or amendments, compile minimum docs (e.g., IDs for beneficial owners/PEPs, group charts, financing details, MEF, fees); use *MEF templates where noted.
• Submit Fully: Ensure all minimums included in future filings to avoid delays; anticipate CSSF requests for extras.
• Internal Processes: Update compliance checklists, train teams on shareholder due diligence, and integrate into authorisation workflows.

What changed

• - Minimum Document Requirements: Establishes a mandatory list of documents for each new shareholder candidate, differentiated by type (e.g., natural person, legal person, beneficial owner,...
• Additional Mandatory Submissions: For changes involving qualified holdings (entry, increase/decrease, removal), requires updated group structure charts, MEF (in some cases), financing information,...
• Enforcement Mechanism: From 2 March 2026, applications lacking these minimums are deemed incomplete, halting analysis until fully submitted.
• No prior formalised list existed in this detail for IFMs, shifting from case-by-case to standardised requirements.

Key dates

2 March 2026

Publication and immediate applicability; New guidance effective; incomplete applications received on/after this date not processed until complete

Suggested considerations

• Prepare Complete Packages: For each new shareholder candidate, compile type-specific docs (e.g., ID/CV/DH/CR for direct unqualified shareholders; financing proof if indirect qualified lacks resources).
• Submit Core Items: Always include updated group structure chart, MEF (template available), acquisition financing details, fee form; classify request type (e.g., prior authorisation for qualified changes).
• Initial/Modification Filings: Use XLSX guidance as checklist; ensure beneficial owner verification per Circular CSSF 19/732.
• Ongoing: Notify CSSF of changes; anticipate ad-hoc requests for extras like PEP declarations.

What changed

• - Minimum Document Lists: Introduces detailed checklists in an XLSX format covering candidate shareholder documents (e.g., ID, CV, declarations of honour (DH), criminal records (CR) for natural...
• Differentiation by Shareholder Type: Requirements vary by natural/legal person, beneficial owner, direct/indirect qualified/unqualified shareholders, and involvement in financing (e.g., "Yes, if PEP...
• Other Mandatory Submissions: For qualified holding changes (entry, increase/decrease, removal), requires updated group structure charts, Market Entry Forms (MEF), financing details, and fee forms;...
• Enforcement Mechanism: From 2 March 2026, incomplete submissions halt analysis until remedied; CSSF may request additional info.

Key dates

18 February 2026

- Circular CSSF 26/907 published

No specific implementation deadline provided Deadline

in available search results; firms should consult the full French text for any transition periods or effective dates

Suggested considerations

• *Obtain and review the full French text of Circular CSSF 26/907 from the CSSF website
• *Assess current auditor qualifications against the new requirements for approved special statutory auditors
• *Update audit engagement letters and terms to reflect any new standards or responsibilities
• *Document compliance with the circular's requirements in governance and audit files
• *Communicate with appointed auditors to ensure alignment with the new framework

What changed

• The search results provided do not contain the full text of Circular CSSF 26/907, as it is available only in French and the PDF content was not included in the available materials.
• Statutory auditor qualifications and requirements for the specialized role of approving auditors (réviseurs agréés spéciaux) overseeing credit institutions that issue mortgage bonds
• Governance standards for auditors in this specialized capacity
• Audit and oversight responsibilities specific to mortgage bond issuance activities The circular aligns with broader Luxembourg regulatory modernization efforts evident in concurrent CSSF guidance,...

Key dates

2026 (exact date TBD) Deadline

AML/CFT standardised data collection exercise; Firms must submit required data during this period; preparation recommended immediately given today's date (12 February 2026)

20 January 2026 Deadline

Issuance of related Circular 26/906; Establishes governance baselines (e.g., compliance independence, risk proportionality) informing data collection expectations

26 January 2026

CSSF AML/CFT Conference for Specialised PFS; Provided updates on sub-sector risks, terrorist financing reviews, and FIU insights relevant to data preparation

28 January 2026 Deadline

Conference materials published; Available for download to guide compliance alignment

Suggested considerations

• Assess and document AML/CFT data readiness: Inventory current risk assessments, transaction monitoring logs, KYC processes, SAR filings, and third-party oversight records in standardized formats; map to proportionality factors (e.g., transaction volumes, outsourcing).
• Update governance and controls: Ensure compliance functions have independence, direct board reporting, and audit coverage of AML/CFT; test ICT resilience for monitoring continuity.
• Conduct internal reviews: Perform gap analyses against Circular 26/906 (e.g., fund safeguarding, escalation protocols) and recent conference topics (e.g., terrorist financing, tax indicators); remediate deficiencies with board-approved plans.
• Prepare for submission: Designate resources for data compilation; cooperate fully with CSSF/FIU requests, including transfer-of-funds information under EU 2015/847.
• Engage auditors: Leverage approved auditors for validation of AML/CFT effectiveness ahead of collection.

What changed

• - Introduction of standardized AML/CFT data collection: CSSF mandates uniform reporting formats for collecting data on AML/CFT risks, controls, and practices across supervised sectors, building on...
• Alignment with ongoing AML/CFT enhancements: Complements recent governance-focused circulars (e.g., Circular 26/906 on central administration and risk management for payment/e-money institutions) by...
• No explicit new obligations beyond preparation for data submission, but implies deeper integration of tax-related AML indicators and sub-sector risk updates, as seen in related CSSF activities.

Key dates

9 February 2026

Reports (SAQ, SR, ML) made available on eDesk CISERO for year-ends 31 January, 28 February, 31 March, 30 April 2026

16 April 2026

Entry into application of AIFM/UCITS Review Directive LMT requirements

Financial year Deadline

end +5 months (UCITS/Part II UCIs); SAQ/SR submission deadline

Financial year Deadline

end +6 months (SIFs/SICARs); SAQ/SR submission deadline

Three months before year

end (post-30 April 2026); Future Reports availability

Suggested considerations

• Access updated Reports on eDesk CISERO module immediately and review changes vs. 31 December 2025 versions.
• Update valuation policies/procedures to explicitly cover stressed conditions, new sub-funds/strategies, model validations, and backtesting; document compliance.
• Revise NAV processes for LMT alignment with Directive (EU) 2024/927 Annexes and ESMA performance fee guidelines; confirm for open-ended UCIs.
• Dirigeants/management: Complete/validate SAQ addressing new/clarified questions; prepare for REA SR/ML review.
• REAs: Perform streamlined SR procedures; issue ML on prior weaknesses with remediation timelines.

What changed

• - SAQ Updates (Valuation Section): New questions on valuation policies for stressed market conditions/exceptional circumstances; coverage for new sub-funds/strategies; independent validation of...
• SAQ Simplifications and Clarifications: Removed questions on sub-funds with significant non-standard OTC derivatives, unquoted assets, or external valuer OTC FDIs (including NAV proportions); refined...
• SAQ NAV Determination: Updated Liquidity Management Tools (LMTs) sub-section to align with Annexes of AIFM/UCITS Review Directive (Directive (EU) 2024/927); added question on compliance with ESMA...
• SR Streamlining: Removed procedures in investment compliance (e.g., eligibility assessments for closed-ended funds, structured instruments, non-plain vanilla OTC derivatives; credit quality for money...
• Reports for year-ends after 30 April 2026 available three months prior.

Key dates

20 June 2025 Deadline

- Prior administrative sanction imposed on Corestate Capital Holding S.A., indicating ongoing non-compliance issues

6 February 2026

- Publication date of the current administrative sanction on Corestate Capital Holding S.A., effective immediately as a public enforcement notice

Suggested considerations

• Conduct immediate gap analysis: Review safekeeping processes for ownership verification (Article 19(8)(b) AIFM Law), ensuring transaction documentation, segregated account proofs, and full holding chain records are available at transaction points.
• Enhance oversight duties: Implement risk assessments per Article 92(1) CDR 231/2013, valuation compliance checks (Article 94), and cash remittance monitoring (Article 96); appoint delegates with due diligence.
• Strengthen governance: Update internal controls, procedures, and conflict-of-interest policies (e.g., director overlaps); ensure key documentation availability and evidence of controls.
• Firm-wide audit: For repeat offenders like Corestate, perform root-cause analysis on prior sanctions and submit remediation plans to CSSF if inspected.
• Training and reporting: Train staff on CSSF expectations; improve cooperation mechanisms to avoid AML/CFT fines for non-submission of requests.

What changed

No new regulatory changes or requirements are introduced; this is an enforcement action enforcing existing obligations under laws like the AIFM Law of 12 July 2013 (e.g., Articles 19(8), 19(9), 19(11) on safekeeping and oversight duties), the Law of 5 April 1993 on the financial sector, and Commission Delegated Regulation (EU) No 231/2013 (CDR 231/2013, e.g., Articles 92, 94, 96 on risk assessment, valuation verification, and cash flow monitoring).

Key dates

20 June 2025

- Prior administrative sanction imposed on Corestate Capital Holding S.A

6 February 2026

- Publication date of the current administrative sanction on Corestate Capital Holding S.A

Suggested considerations

• Conduct immediate gap analysis on depositary functions: Verify ownership chains, transaction documentation, segregated account reconciliations, and custodian delegations per AIFM Law Articles 19(8) and 19(11).
• Enhance oversight processes: Implement risk assessments for AIF strategies, valuation policy checks, and cashflow monitoring per CDR 231/2013 Articles 92, 94, and 96.
• Strengthen governance: Review internal controls, procedures, and conflicts (e.g., director overlaps with affiliates); ensure availability of control evidence.
• For issuers like Corestate: Confirm compliance with half-yearly financial reporting and dissemination under Transparency Law Article 4.
• Firm-wide: Perform mock CSSF on-site inspections focusing on 2022-2025 periods, given inspection timelines in recent cases.

What changed

No new regulatory changes or requirements are introduced; this is an enforcement action highlighting non-compliance with existing obligations under Luxembourg's AIFM Law (notably Articles 19(8), 19(9), 19(11), and 51) and related delegated regulations like CDR 231/2013. Key breaches from analogous recent CSSF sanctions include inadequate safekeeping of assets (e.g., missing ownership verification and records), failure to oversee AIFM valuation policies and cash remittance timelines, improper delegation to custodians without due diligence, and weak internal governance such as conflicts of...

Key dates

23 July 2025

- Date of administrative sanction imposition on Genève Invest (Europe) S.A

4 February 2026

- Publication date of the sanction document by CSSF

Suggested considerations

• Immediate review of counterparty due diligence: Verify licenses and financial stability of brokers/prime brokers; cease deposits with unauthorized or suspended entities per UCI Law Article 41.
• Enhance valuation and accounting controls: Ensure assets (e.g., cash deposits) are valued at probable realization value per Article 28(4) UCI Law and prospectus terms; implement automated monitoring for ongoing compliance.
• Conduct internal audits: Assess organizational requirements, investment policies, and conduct rules (CSSF Regulation 10-04); remediate gaps proactively, as seen in mitigated sanctions for cooperative firms.
• Update governance and reporting: Document risk assessments and report prior breaches to CSSF to demonstrate cooperation, potentially reducing fine severity.

What changed

This is not a regulatory change or new requirement but an enforcement action highlighting existing obligations under Luxembourg law. Key breaches likely mirror patterns in recent CSSF sanctions, such as non-compliance with UCI Law provisions on investment policies (e.g., Articles 41, 43), sound accounting procedures (Article 109), and rules of conduct (Articles 111, CSSF Regulation 10-04), including improper cash deposits with unauthorized brokers and inaccurate asset valuation.

Key dates

20 January 2026

- Publication date of Circular CSSF 26/906

30 June 2026 Deadline

- Compliance deadline: Institutions must assess/review central administration, internal governance, and risk management frameworks to ensure full compliance

Suggested considerations

• Gap analysis: Assess current frameworks against circular requirements on management bodies, internal controls, conflicts of interest, product approval, and fund safeguarding.
• Updates and notifications: Review/revise governance arrangements (e.g., policies, structures); notify CSSF of management body members, compliance officers, and internal auditors with required documentation (professional experience, police records, etc.).
• Implementation: Establish robust risk identification/management/monitoring/reporting processes, internal controls, and proportional arrangements (e.g., IT, outsourcing).
• Documentation: Develop conflicts policy, new product approval procedures, and safeguarding rules; ensure management body authorization.
• Ongoing: Maintain sound/prudent management amid growth; integrate with Law of 10 November 2009 requirements.

What changed

• The circular consolidates and updates governance rules, focusing on:
• Management bodies: Responsibilities, composition, qualifications, organization, and functioning, including CSSF authorization of members based on professional experience, standing (e.g., police...
• Internal control functions: Responsibilities, characteristics, organization, and execution of work for compliance officers and internal auditors, with notifications to CSSF including detailed...
• Conflicts of interest: Key requirements for a management policy applicable to all staff and management body members.
• New product approval: Defined key steps in the process.

Key dates

20 January 2026

Publication date of Circular CSSF 26/906

30 June 2026 Deadline

Compliance deadline; Institutions must assess, review, and ensure their central administration, internal governance, and risk management frameworks fully comply with the circular

Suggested considerations

• Assess and update governance frameworks: Review central administration location, board/management responsibilities, risk strategy, AML/CFT policies, compliance charter, and funds safeguarding principles to align with the circular.
• Confirm control functions: Ensure compliance function (CCO) has independence, resources, direct board access, and authority for investigations; justify/secure CSSF approval for part-time/dual roles.
• Implement operational safeguards: Establish daily reconciliations (or justified weekly), segregation/insurance for client funds, system access controls (4-eyes, board validation for significant movements), and third-party due diligence/monitoring.
• Document proportionality: Tailor governance to business risks (staff, volumes, products, outsourcing); update new product approval, conflicts policies, and business continuity/incident reporting.
• Retain records and report: Board-approve all key policies; prepare for CSSF inspections on outsourcing (per Circular CSSF 22/806) and ICT risks.

What changed

• - Consolidation and repeal: Replaces outdated circulars with unified requirements under the amended Law of 10 November 2009 on payment services, covering central administration (decision-making must...
• Governance enhancements: Board approves strategy, risk appetite, AML/CFT policies, outsourcing, and information security; management implements via procedures; proportionality based on business...
• Operational controls: Strict access to systems (need-to-know, least-privilege, 4-eyes validation); counterparty due diligence for custodians/insurers; full responsibility for agents, distributors,...
• AML/CFT focus: Elevates compliance function independence, direct board reporting, risk-based resourcing, and oversight of third parties/opaque structures to close gaps exploited by criminals.

Key dates

20 January 2026

- Circular published by CSSF

1 April 2026

- Application date for Less Significant Institutions (other than SNCIs)

11 January 2027

- Application date for SNCIs (dependent on CRD transposition)

Suggested considerations

• Map and integrate ESG risks into governance, risk management frameworks, and business strategies, proportionate to scale/risk exposure.
• Develop and document ESG risk management plans with quantifiable targets, milestones, timelines, and scenario analyses (broad requirements now; detailed later).
• Conduct assessments of ESG risks in portfolios, including sustainability products, transition finance, and loan origination policies, for SREP submission.
• Embed in internal processes per Articles 74, 76, 87a CRD: identify/measure ESG risks (minimum standards), monitor over time horizons, and report to CSSF.
• Review and update existing policies/systems for compliance by applicable dates; prepare for CSSF supervisory evaluation of plan robustness.

What changed

• - Institutions must establish proportionate strategies, policies, processes, and systems for ESG risk management, covering short-, medium-, and long-term horizons, including transition and physical...
• Develop plans per Article 76(2) CRD with specific timelines, intermediate quantifiable targets, and milestones to address ESG financial risks, consistent with EU objectives (e.g., 55% GHG reduction...
• Incorporate ESG into internal governance, risk appetite, and supervisory review processes (SREP), with scenario analysis requirements (to be detailed in future EBA guidelines).
• Applies minimum standards and methodologies for ESG risk identification, measurement, monitoring, and impact assessment on institutions' exposures.
• No requirement for full alignment with specific sustainability trajectories, but plans must consider transition risks and institutions' ESG product offerings, loan policies, and targets.

Key dates

4 April 2025 Deadline

- Deadline for submission of financial crime questionnaire for the year ending 31 December 2024

Before 11 September 2025 Deadline

- CSSF issued two reminders to Max Gain Capital after the missed deadline

11 September 2025

- CSSF imposed the €10,000 administrative fine

9 January 2026

- CSSF published the administrative sanction decision

Suggested considerations

• regulated entities must:
• *Identify Reporting Obligations: Confirm whether your firm is subject to the annual financial crime questionnaire requirement under Article 5(1) of the AML/CFT Law
• *Calendar Management: Establish internal processes to ensure questionnaires are submitted by 4 April each year for the preceding calendar year
• *Documentation: Maintain records demonstrating timely submission and preserve evidence of compliance
• *Escalation Protocol: If unable to meet deadlines, proactively contact the CSSF to request extensions or clarification rather than ignoring reminders

What changed

• This is not a regulatory change but rather an enforcement action clarifying existing obligations:
• Mandatory Annual Questionnaire Requirement: All CSSF-supervised professionals must submit an annual questionnaire on financial crime covering the preceding calendar year.
• Cooperation Obligation: Article 5(1) of the amended Law of 12 November 2004 on AML/CFT imposes a non-negotiable duty to cooperate with CSSF supervisory requests.
• Enforcement Escalation: The CSSF will issue reminders before imposing sanctions, but continued non-compliance triggers administrative fines under Article 8-4 of the AML/CFT Law.

Key dates

February 2023

January 2024; Period of CSSF on-site inspection on depositary obligations, covering activities up to December 2022

23 July 2025

Date CSSF imposed the €102,000 administrative fine on JTC (Luxembourg) S.A

9 January 2026

Date of official CSSF publication announcing the sanction

Suggested considerations

• related entities) must:
• Conduct immediate gap analyses on risk assessment processes for AIF strategies and AIFM organization per Article 92(1) CDR 231/2013.
• Implement robust verification processes for AIFM compliance with asset delegation rules.
• Ensure availability of key documentation and evidence of controls for the depositary function, addressing pre-2022 gaps if applicable.
• Develop and test oversight processes, leveraging self-identified improvements and action plans as mitigating factors, as JTC did prior to inspection.

What changed

This is an enforcement action, not a regulatory change; it enforces existing requirements under Article 51(1) (1st and 7th indents) and Article 51(2) (1st sub-paragraph, 3rd indent) of the amended Law of 12 July 2013 on AIFMs (AIFM Law), and related provisions like Article 92(1) of Commission Delegated Regulation (EU) No 231/2013 (CDR 231/2013).

Key dates

Financial year ending 31 December 2024

- Applicability of revised LFR to all investment firms; submissions begin for this period onward on a yearly basis

No specific submission deadline stated Deadline

- Yearly production required via CSSF portal; firms should align with existing annual reporting cycles for auditors (typically post-year-end)

Suggested considerations

• Investment Firms: Complete and submit the digital SAQ yearly via CSSF portal, providing descriptions of business model, ML/FT risks, commercial policy, monitoring, AML/CFT roles, and entity-level compliance; ensure data on fund transfers (e.g., missing payer/payee info) is included.
• REAs/Auditors: Verify SAQ adequacy, assess descriptions, perform corroborative controls, supplement with findings (e.g., AML/CFT audit declarations), independently assess ML/FT risks/organization, and integrate into single LFR document.
• General: Review existing processes for proportionality (focus on incremental info); update AML/CFT policies/documentation for branches/subsidiaries/tied agents; prepare for digital submission; document risk assessments thoroughly.
• Ongoing: Monitor compliance with related regs like Regulation (EU) 2023/1113 (effective 30 December 2024, per draft bill 8387).

What changed

• - Revised LFR Structure: Comprises four parts in a single digital document: (1) yearly SAQ completed by investment firms; (2) descriptive elements verified by approved statutory auditors (REAs); (3)...
• Digital Format: Completion and submission via CSSF's online portal, supporting CSSF 4.0 digital strategy for efficient processing.
• Proportionality and Scope: Applies individually to investment firms (no consolidated LFR if under CSSF consolidated supervision); focuses on incremental, relevant information tied to business models,...
• Enhanced AML/CFT Focus: Requires descriptions of commercial policy, ML/FT risk management, roles/responsibilities, branch/subsidiary/tied agent compliance; REA must assess adequacy of...
• REA Responsibilities: Verify/ensure adequacy of SAQ elements, assess descriptions, perform control procedures, and provide assessments on AML/CFT policy implementation across entities.