CSSF Guidance

Key dates

2026-05-11

The European Commission published its MMF adequacy report identifying market-resilience WLA benchmarks of 20% for VNAV MMFs and 40% for public debt CNAV and LVNAV MMFs, compared with MMFR minima of 15% and 30%, respectively.

2026-06-08

The CSSF launched its consultation on guidance for MMF weekly liquid asset levels.

2026-08-03 Deadline

Deadline for stakeholders to submit responses to the CSSF consultation.

2026-10-30

The CSSF published the final guidance and feedback statement and began a three-month implementation period.

2027-01-30 Deadline

Expected end of the CSSF's three-month implementation period, calculated from publication on 30 October 2026.

Suggested considerations

• Firms should identify each in-scope MMF's applicable WLA benchmark, distinguishing VNAV funds from public debt CNAV and LVNAV funds, and document the classification rationale.
• Managers should review daily liquidity, weekly liquidity, portfolio composition and liquidity-buffer targets against both the binding MMFR minima and the higher CSSF market-resilience benchmarks.
• Risk teams should enhance monitoring and escalation procedures for WLA levels approaching or falling below 20% or 40%, including ownership, management-information frequency, escalation thresholds and evidence of reinforced decision-making.
• Managers should update MMFR Article 28 stress-testing methodologies and governance to reflect the 20% VNAV and 40% public debt CNAV/LVNAV resilience levels, while retaining the existing MMFR regulatory minima and applicable ESMA stress-test requirements.
• Firms should establish a documented process for counting consecutive business days below the applicable benchmark and for notifying the CSSF after more than 10 business days or when a prolonged or substantial deviation is expected.
• Where stress testing identifies vulnerability, compliance and risk functions should assess whether Article 28(4) immediate notification, Article 28(5) reporting and an action plan are required.
• Managers should prepare records explaining any sustained deviation, including investor-liability characteristics, redemption patterns, liquidity-risk-system outputs, stress-test results and remedial measures, because the CSSF may increase supervisory scrutiny and review available information.
• Firms should assess whether prospectus disclosures, internal liquidity-risk policies, investment guidelines, delegation arrangements and board or conducting-officer reporting need updating during the three-month implementation period.

What changed

The final guidance follows the CSSF consultation launched on 8 June 2026 and contains only slight clarifications after stakeholder feedback. MMF managers are expected to treat 20% WLA for VNAV funds and 40% WLA for public debt CNAV and LVNAV funds as market-resilience reference levels within their liquidity-risk-management and stress-testing frameworks. When WLA approaches or falls below the applicable level, managers should apply enhanced vigilance, timely escalation and reinforced internal decision-making.

Key dates

2017-06-30

CSSF originally published the prudential procedure for appointments to the management body and key function-holder roles in credit institutions.

2026-05-05

Luxembourg enacted the Law implementing CRD VI and related EU requirements, including tightened fit-and-proper provisions.

2026-05-06

The Law of 5 May 2026 was published in Memorial A n° 227 and its directly amended provisions became relevant from entry into force.

2026-10-15

CSSF updated the procedure publication and the related management-body and key-function-holder fit-and-proper declaration forms; the procedure is marked as being updated.

Suggested considerations

• Firms should compare their current appointment and fit-and-proper processes with the refreshed CSSF declaration forms and identify changes to information, attestations and supporting evidence.
• Compliance teams may wish to map each management-body and key-function-holder appointment to the applicable CSSF, ECB or IMAS Portal submission route, including whether the entity is significant or less significant.
• Firms should consider building a minimum 30-working-day pre-appointment submission period into planning for appointments covered by the CRD VI and Luxembourg implementation requirements, subject to confirmation in the final CSSF procedure.
• Institutions should refresh internal suitability assessments to address reputation, knowledge, skills and experience, time commitment, independence, conflicts of interest, diversity and collective suitability, and should retain evidence of the board’s assessment.
• Firms should review role descriptions, responsibility maps, reporting lines and individual statements for management-body members, senior management and key function holders, as these are identified in market commentary as areas reinforced by the CRD VI implementation framework.
• Existing appointees should be included in periodic or event-driven reassessment processes so that continuing suitability and the institution’s ability to notify material changes can be demonstrated.
• Firms should monitor the forthcoming amended EBA internal-governance guidelines and subsequent CSSF revision of Circular 12/552 and the prudential procedure before finalising policy changes.

What changed

The CSSF has refreshed the prudential-procedure publication and four related declaration templates: appointee and institution declarations for management-body members and key function holders. The page does not disclose the substantive text of the revised procedure, so it does not establish a new standalone deadline or approval requirement by itself.

Key dates

2025-01-17

DORA became applicable to financial entities within the CSSF supervisory perimeter.

2025-12-17

The European Commission confirmed through DORA Q&A DORA102-3097 that DORA applies to qualifying third-country branches in an EU country.

2026-08-27

Circular CSSF 26/915 was published and its amendments took effect immediately.

2027-02-27 Deadline

The six-month transition period for PSPs not otherwise subject to DORA under Circular CSSF 25/893 is expected to end; the DORA incident-reporting framework then applies to those PSPs and Circular CSSF 21/787 is repealed for them.

2027-03-31 Deadline

Latest date in the annual CSSF register-of-information submission window for arrangements contracted during 2026, subject to the applicable CSSF collection process.

Suggested considerations

• Firms should map each Luxembourg third-country branch against the DORA Article 2(1)(a) to (t) categories as the undertaking would be classified in the third country, documenting the legal-entity and regulatory-status analysis.
• Compliance teams may wish to update the branch's regulatory inventory, DORA applicability assessment, governance documentation and responsibility matrices to reflect immediate inclusion where the qualifying test is met.
• Affected branches should review ICT third-party-service contracts, the register of information and planned arrangements supporting critical or important functions, including whether CSSF notification was made at least three months before implementation or one month where the specified Luxembourg support-PFS exception applies.
• Firms should distinguish ICT outsourcing from other outsourcing: ICT outsourcing should be managed under the DORA framework and Circular CSSF 25/882, while non-ICT outsourcing remains subject to Circular CSSF 22/806 Part I.
• Incident-response teams should test the CSSF eDesk Portal and S3 API reporting channels and maintain a contingency process for notifying [email protected] by the applicable deadline if technical failure prevents use of the primary channel.
• Firms should confirm that major ICT incidents are reported individually and that outsourced reporting arrangements preserve the firm's responsibility for timing, completeness and notification content.
• Affected branches should assess whether they are microenterprises under DORA Article 3(60), since Circular CSSF 25/892 excludes microenterprises from its aggregated-cost estimation framework, except for trading venues, central counterparties, trade repositories and central securities depositories.
• Where the branch is an EU branch rather than a third-country branch, firms should verify the home-Member-State allocation rules because the CSSF circulars generally exclude EU branches from the relevant Luxembourg reporting chapters.

What changed

The circular implements the European Commission's 17 December 2025 DORA Q&A position and includes qualifying third-country branches in the scope of Circulars CSSF 25/882 on ICT third-party services, 25/892 on aggregated annual costs and losses from major ICT incidents, and 25/893 on major ICT-related incident and significant cyber-threat reporting.

Key dates

2025-01-17

DORA became applicable to financial entities within its scope, subject to the specific DORA provisions and technical standards applicable to each entity.

2025-04-09

Circular CSSF 25/881 was published and took effect, removing DORA financial entities from Circular 20/750 and retaining 20/750 for entities outside DORA; PSP-specific provisions were reorganised under Circular 25/880.

2026-06-30 Deadline

CSSF extended the first Register of Information submission for Luxembourg branches of third-country credit institutions to this date on a best-efforts basis; the CSSF indicated that the required level of quality should be achieved for the 2027 submission.

2026-08-27

Circular CSSF 26/915 was published, confirming the DORA treatment of qualifying third-country branches and removing them from the full scope of Circular 20/750 and related overlapping circular provisions.

2027-03-31 Deadline

Target date identified by the CSSF for the required-quality Register of Information submission by Luxembourg branches of third-country credit institutions.

Suggested considerations

• Firms should classify each Luxembourg entity and branch against DORA Article 2 and the amended scope of Circular 20/750, including an assessment of whether a third-country head office would qualify under DORA Article 2(1)(a) to (t).
• Compliance teams may wish to determine whether the entity should operate under DORA rather than 20/750, and document the rationale, legal-entity perimeter and treatment of any Luxembourg branch.
• Firms remaining within Circular 20/750 should consider reviewing their ICT and security-risk-management framework, governance approvals, risk assessments, incident processes, business-continuity arrangements and control testing against the continuing requirements.
• Payment service providers should consider replacing references to the PSP provisions formerly contained in Circular 20/750 with the applicable requirements in Circular CSSF 25/880 and EBA/GL/2025/02.
• Third-country branches treated as DORA entities should consider validating their DORA governance, ICT-risk framework, incident-reporting arrangements, ICT contractual inventory and Register of Information processes, taking account of CSSF reporting communications.
• Firms should update policies, regulatory inventories, outsourcing and ICT-third-party registers, training materials and regulatory mapping to distinguish DORA obligations from the residual Circular 20/750 obligations.
• Compliance teams may wish to retain evidence of the scope assessment and implementation date, because the 2025 amendment was effective immediately and the 2026 amendment changes the treatment of a previously identified 20/750 population.

What changed

Circular 25/881 provides that DORA financial entities supervised by the CSSF no longer fall within Circular 20/750; for entities covered by 20/750 but outside DORA, the circular continues to apply in full. Payment-service-provider-specific ICT and security-risk provisions were removed from 20/750 and regrouped in Circular CSSF 25/880, reflecting the revised EBA Guidelines on ICT and security risk management for payment service providers, including EBA/GL/2025/02.

Key dates

2025-01-17

DORA became applicable to in-scope financial entities, according to the CSSF implementation communication referenced by Circular CSSF 25/882.

2025-04-09

Circular CSSF 25/882 was published and applied with immediate effect.

2025-04-01 Deadline

The first exceptional CSSF register submission window opened for arrangements contracted up to 31 March 2025.

2025-04-15 Deadline

The first exceptional CSSF register submission window closed.

2026-08-27

Circular CSSF 26/915 was published and immediately amended Circular CSSF 25/882 to include qualifying third-country branches in Luxembourg.

2027-03-31 Deadline

Latest date for submission of the register covering arrangements contracted through the end of 2026, under the recurring annual window running from 28 February to 31 March of the following year.

Suggested considerations

• Firms should assess whether Luxembourg third-country branches now fall within the amended scope by comparing the branch’s undertaking and head-office activities with the DORA categories in Article 2(1)(a) to (t) and documenting the conclusion.
• Compliance teams may wish to inventory all ICT third-party arrangements, including digital, data, cloud, infrastructure and operational services that may not qualify as outsourcing under prior CSSF terminology.
• Firms should consider updating ICT third-party approval workflows so arrangements supporting critical or important functions are notified through the CSSF-prescribed form at least three months before commencement, or one month before commencement where the provider is an eligible Luxembourg support PFS.
• Firms should maintain an accurate register of information at individual, sub-consolidated and consolidated levels, with controls for prompt correction when requested by the CSSF and the ability to provide the register outside the annual submission window.
• Compliance and outsourcing teams may wish to reassess contractual access to professional-secrecy data against Article 41(2a) LFS or Article 30(2a) LPS and verify that Luxembourg ICT management or operations providers hold the required Article 29-3 LFS authorisation or qualify for an applicable exception.
• Firms using cloud services should confirm that the resource operator has designated a suitably qualified cloud officer and that internal cloud, information-security and third-party oversight responsibilities are clearly allocated.
• Third-country branches should consider implementing the requirements immediately because Circular CSSF 26/915 provides no transition period, while preserving evidence of governance, notification and register controls for supervisory review.

What changed

Circular CSSF 26/915 includes in Circular CSSF 25/882’s scope all Luxembourg third-country branches of undertakings covered by the specified DORA financial-entity categories where the head office would qualify as a DORA entity under Article 2(1)(a) to (t) in the relevant third country. The requirements apply to ICT services broadly, not only arrangements that meet a traditional outsourcing definition.

Key dates

2025-01-17

DORA began applying to financial entities within its scope, subject to the relevant provisions and transitional arrangements.

2025-04-09

Circular CSSF 25/883 was published and applied with immediate effect, amending Circular CSSF 22/806 and introducing the DORA-based division between ICT and business-process outsourcing.

2025-12-17

The European Commission confirmed through a DORA Q&A that DORA applies to qualifying third-country branches in an EU Member State.

2026-06-30 Deadline

CSSF-extended submission date for the 2026 DORA register of information for third-country branches of credit institutions headquartered in a third country; entities were invited to submit on a best-efforts basis.

2026-08-27

Circular CSSF 26/915 was published and applied with immediate effect, confirming the DORA treatment of qualifying Luxembourg third-country branches and updating Circular CSSF 22/806 accordingly.

2027-03-31 Deadline

Target CSSF submission deadline for the DORA register of information for affected third-country branches following the initial 2026 collection.

Suggested considerations

• Firms should classify each outsourcing arrangement as ICT or non-ICT and determine whether the entity and arrangement fall within DORA, Circular 22/806, or both regimes in their respective areas of application.
• DORA entities should consider moving ICT arrangements from their Circular 22/806 outsourcing inventory and controls into the DORA ICT third-party register, while retaining Circular 22/806 controls for business-process outsourcing.
• Non-DORA entities should consider continuing to apply the full Circular 22/806 framework to ICT and business-process outsourcing, including due diligence, governance, critical-or-important assessments, monitoring, sub-outsourcing and exit planning.
• Third-country branches should assess whether their head office would qualify under Article 2(1)(a) to (t) of DORA and, if so, align ICT governance, contractual arrangements, registers and reporting with DORA rather than relying solely on Circular 22/806.
• Compliance teams may wish to review cloud contracts and avoid carrying forward legacy EEA governing-law or hosting clauses where DORA now provides the applicable framework, while preserving enforceable audit, access, cooperation, security, business-continuity and exit rights.
• Firms should use the revised CSSF notification form for new critical or important ICT outsourcing arrangements and preserve evidence supporting the three-month notification period, or the one-month period for arrangements involving a support PSF.
• Firms should consider validating that existing ICT outsourcing notifications remain complete under the applicable DORA register-of-information requirements, even though Circular 25/883 does not require their re-submission.
• Affected third-country branches should consider submitting and maintaining the DORA register of information through the CSSF process, with the 2027 collection requiring data quality suitable for the 31 March 2027 submission deadline.

What changed

From 9 April 2025, DORA entities generally no longer apply the ICT-outsourcing provisions of Circular CSSF 22/806 to ICT arrangements; those arrangements are governed by DORA, including its ICT third-party risk-management, contractual, register-of-information and oversight requirements, together with Circular CSSF 25/882. Circular 22/806 continues to apply to business-process outsourcing by DORA entities, and continues to apply in full to non-DORA entities, including their ICT outsourcing. Chapter 16 management companies remain subject to Circular 22/806 for ICT outsourcing.

Key dates

2025-05-19

The Joint ESA Guidelines JC/GL/2024/34 apply at ESA level.

2025-05-31

Circular CSSF 25/892 applies to its original in-scope Luxembourg entities, excluding DORA microenterprises.

2026-08-27

Circular CSSF 26/915 is issued and applies with immediate effect, bringing qualifying Luxembourg third-country branches into the scope of Circular CSSF 25/892.

Suggested considerations

• Compliance teams may wish to determine whether each Luxembourg entity or third-country branch falls within the amended scope, including whether a third-country head-office undertaking would qualify under DORA Article 2(1)(a) to (t).
• Firms should consider documenting their microenterprise analysis against DORA Article 3(60), including the fewer-than-10-employees and EUR 2 million annual turnover and/or balance-sheet-total thresholds, while noting that the DORA definition excludes trading venues, central counterparties, trade repositories and central securities depositories from the microenterprise exemption.
• Firms should consider maintaining an incident-level ledger linking major ICT-related incidents, DORA final-report reference codes, gross costs, losses, provisions, recoveries and subsequent adjustments.
• Finance, operational-risk and ICT-incident teams may wish to agree whether the firm will use a completed calendar year or completed accounting year as its reference basis and establish controls to apply that basis consistently.
• Firms should consider reconciling estimates to financial-statement or supervisory-reporting data where available, while retaining documented estimation methodology and assumptions where accurate data is unavailable.
• Firms should consider tracking quantifiable financial impacts from prior-year major incidents because those impacts may need to be included in a later reference year without reopening the original final incident report.
• Third-country branches may wish to confirm reporting ownership and data availability with their head office, because the amended CSSF scope is at branch level but the required cost and loss information may arise across the undertaking.
• Compliance teams may wish to monitor CSSF communications for a specific request, reporting channel and submission deadline; the circular itself establishes an upon-request obligation rather than a fixed automatic annual filing deadline.

What changed

From 2025-05-31, in-scope Luxembourg financial entities other than DORA microenterprises must be able, upon CSSF request, to provide an entity-level estimate of aggregated annual costs and losses arising from major ICT-related incidents. The estimate must use the ESA common template and identify each relevant incident by the same reference code used in its DORA final incident report.

Key dates

2025-01-17

DORA provisions became applicable to financial entities in scope and supervised by the CSSF.

2025-05-28

Circular CSSF 25/893 was published and established the Luxembourg DORA incident and significant cyber-threat reporting modalities.

2025-11-28 Deadline

End of the six-month transition period granted to payment service providers outside DORA for implementation of the Circular 25/893 framework.

2026-08-27

Circular CSSF 26/915 was published and the 25/893 page was updated to clarify DORA applicability to qualifying third-country branches in Luxembourg; the amendment applies immediately.

Suggested considerations

• Compliance teams may wish to confirm the entity-by-entity scope analysis against DORA Article 2, including whether a Luxembourg third-country branch is covered following the 27 August 2026 clarification.
• Firms should consider documenting incident-classification criteria and decision records against Commission Delegated Regulation (EU) 2024/1772, including the quantitative thresholds for clients, transactions, duration, geographical spread, data loss, economic impact and reputational impact.
• Firms should consider testing an escalation timetable that supports classification, initial notification within four hours and no later than 24 hours after awareness, the 72-hour intermediate report and the one-month final report.
• PSPs outside DORA may wish to update policies so that all ICT-related incidents, rather than only payment-service incidents, are assessed under the DORA framework and to verify that the six-month transition requirements were completed by 28 November 2025.
• Firms should consider ensuring that eDesk access, authorised users, templates, internal approvals and S3 API connectivity are operational before an incident occurs.
• Incident-response procedures may wish to prohibit aggregation of separate major incidents where the CSSF reporting process requires event-specific submissions and should assign ownership even where reporting support is outsourced.
• Third-country branches may wish to align their Luxembourg reporting playbooks, head-office escalation arrangements and local CSSF contacts with the immediate-effect scope clarification.
• Firms should consider retaining evidence of classification, notification times, report versions, management approvals and communications with ICT third parties to demonstrate timely compliance.

What changed

DORA financial entities supervised by the CSSF must classify ICT-related incidents using the criteria and thresholds in Commission Delegated Regulation (EU) 2024/1772 and report each major ICT-related incident using the DORA reporting templates and procedures. Reporting is phased: an initial notification is generally due within four hours after classification as major and in any event no later than 24 hours after the entity becomes aware of the incident; an intermediate report is generally due within 72 hours after the initial notification; and a final report is generally due within one month...

Key dates

2022-04-22

Circular CSSF 22/806 was published and replaced or amended specified earlier CSSF and IML outsourcing, governance and control circulars.

2022-06-30

Circular CSSF 22/806 became applicable according to the CSSF implementation framework.

2025-01-17

DORA Regulation (EU) 2022/2554 became applicable to in-scope financial entities, creating the primary EU framework for ICT third-party risk management.

2025-04-09

Circular CSSF 25/883 was published; the amended Circular 22/806 applies to outsourcing arrangements entered into, reviewed or amended on or after this date.

2025-12-17

The European Commission confirmed that DORA also applies to qualifying third-country branches in an EU Member State where the third-country head-office entity would fall within DORA Article 2(1)(a) to (t).

2026-08-27

Circular CSSF 26/915 was published and the CSSF webpage consolidated the amended version of Circular 22/806, confirming the DORA treatment of qualifying Luxembourg third-country branches.

Suggested considerations

• Firms should map each outsourcing and third-party technology arrangement against the applicable regime: DORA, Circular 22/806 business-process outsourcing requirements, or the full Circular 22/806 framework for non-DORA entities.
• Compliance teams may wish to review whether Luxembourg third-country branches have a head-office activity that corresponds to a DORA Article 2(1)(a) to (t) financial entity and document the resulting DORA scope assessment.
• Firms should update outsourcing policies, risk assessments, governance approvals, materiality or criticality assessments, due-diligence files, monitoring controls and exit strategies to reflect the split between DORA ICT third-party risk management and Circular 22/806 business-process outsourcing.
• Firms should maintain or update the DORA register of information for ICT third-party arrangements where DORA applies, and reconcile it with the outsourcing inventory and CSSF notification processes.
• Firms should review legacy cloud contracts and remove reliance on the repealed Circular 22/806 EEA-law and EEA-resilience clauses where DORA is the applicable ICT third-party regime, while retaining contract terms needed to satisfy DORA and any applicable national requirements.
• Non-DORA entities should consider whether their existing contracts still address Circular 22/806 requirements for access and audit rights, sub-outsourcing, confidentiality, data location, business continuity, termination and exit.
• Management companies authorised solely under Article 125-1 should consider retaining the full Circular 22/806 control framework for ICT outsourcing rather than assuming that DORA displaces it.
• Firms should assess whether outsourcing arrangements entered into, reviewed or amended from 9 April 2025 require remediation or re-papering under the amended framework.

What changed

Circular 25/883 amended Circular 22/806 following DORA Regulation (EU) 2022/2554 becoming applicable on 17 January 2025. For entities subject to DORA, the ICT-outsourcing provisions of Circular 22/806 were largely repealed or displaced by DORA's ICT third-party risk-management requirements, while Circular 22/806 remains applicable to business-process outsourcing.

Key dates

2020-08-25

Circular CSSF 20/750 was originally published, establishing CSSF expectations for ICT and security risk management.

2025-01-17

Regulation (EU) 2022/2554 on digital operational resilience for the financial sector became applicable to DORA-defined financial entities supervised by the CSSF.

2025-04-09

Circular CSSF 25/881 amended Circular 20/750, narrowing it primarily to non-DORA entities and moving PSP-specific requirements to Circular CSSF 25/880.

2026-08-27

Circular CSSF 26/915 was published and applies with immediate effect; DORA-equivalent third-country branches are removed from Circular 20/750 and addressed through the DORA-related CSSF framework.

Suggested considerations

• Firms with Luxembourg third-country branches should document an entity-by-entity DORA scoping analysis, including the classification of the non-EU head-office undertaking under Article 2(1)(a) to (t) of Regulation (EU) 2022/2554 and the relevance of Article 2(2).
• Affected branches should consider retiring Circular 20/750 as their primary ICT framework and mapping controls instead to DORA and the applicable CSSF circulars, including Circular CSSF 25/882 on ICT third-party services and Circular CSSF 25/893 on major ICT-related incidents and significant cyber threats.
• Firms should review ICT third-party inventories, contracts, due diligence files, exit strategies and, where relevant, the DORA Register of Information so that all ICT services are captured regardless of whether the arrangement is formally classified as outsourcing.
• Entities remaining within Circular 20/750 should consider confirming that the management body has approved the ICT and security risk-management framework and that it is reviewed at least annually.
• Remaining in-scope entities should consider refreshing their annual ICT and security risk assessment, critical-function and information-asset mapping, threat and vulnerability monitoring, access controls, patching, backup, recovery, incident-response and business-continuity documentation.
• Compliance teams may wish to verify that critical ICT systems undergo security testing at least annually, non-critical systems are tested regularly and at least every three years, and critical business continuity arrangements are tested at least annually.
• Branches and PSP-related entities should consider validating incident-reporting channels and escalation procedures, including the CSSF alternative email channel for exceptional technical failures where the prescribed DORA reporting channel cannot be used.
• Firms should consider preserving evidence of proportionality assessments, control testing, audit findings, remediation, management-body reporting and staff security training for CSSF supervisory review.

What changed

Circular 26/915 applies with immediate effect and removes DORA-equivalent third-country branches from the scope of Circular 20/750. A third-country branch is treated as DORA-relevant where, in the jurisdiction of its head office, the undertaking would qualify as an entity listed in Article 2(1)(a) to (t) of Regulation (EU) 2022/2554, subject to the applicable exclusions and Article 2(2) conditions.

Key dates

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations enters into force and defines classification as “small associations”, “medium‑sized associations” and “large associations” with corresponding accounting obligations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for ASBLs classified as small, medium‑sized and large associations, and associations recognised as being of public utility

04 August 2026

- CSSF press release is published, formally drawing supervisory attention to CNC Q&A 26/038 and the related upcoming CNC accounting guide

Suggested considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

What changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Key dates

01 January 2023

- Earliest financial year start date from which adjusted size criteria under Articles 35 and 47 LRCS may be applied to undertakings and groups, which indirectly affects categorisation and accounting obligations of entities subject to commercial‑law size criteria

07 August 2023

- Law of 7 August 2023 introducing the new accounting regime for associations and foundations is adopted, setting the legal basis for reclassification and annual accounts obligations

01 January 2024

- Default application date of the adjusted LRCS size criteria for undertakings and groups where early application from 01 January 2023 is not chosen

Financial year 2025

- New LRCS size thresholds start to determine the categorisation of pre‑existing Luxembourg undertakings and, by analogy, influence assessments of “medium‑sized” status relevant to associations

Autumn 2026

- CNC plans to publish an accounting guide dedicated to the new accounting regime for not‑for‑profit associations (ASBLs) classified as small, medium‑sized and large, as well as public‑utility associations and foundations

Suggested considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

What changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Key dates

12 June 2025

- Commission Delegated Regulation (EU) 2025/1156 is adopted, supplementing MiFIR with RTS on the obligation to make market data available to the public on a reasonable commercial basis

23 August 2026

- ESMA Guidelines on MiFID II/MiFIR market data obligations are withdrawn; CSSF Circular 21/783, which incorporated these Guidelines into CSSF administrative practice, becomes outdated from this date

Suggested considerations

• Identify and catalogue all internal policies, procedures, contractual templates, and pricing frameworks that reference CSSF Circular 21/783 or ESMA’s MiFID II/MiFIR market data Guidelines.
• Review Commission Delegated Regulation (EU) 2025/1156 in detail and map its RTS requirements (e.g. cost-based pricing, non-discriminatory access, data unbundling, publication formats) against current market data practices.
• Update market data pricing policies to ensure that fees are demonstrably based on reasonable commercial basis criteria defined in Delegated Regulation (EU) 2025/1156, including documentation of cost allocation and margin methodology.
• Revise market data access policies and client terms to ensure non‑discriminatory conditions and appropriate unbundling of pre‑trade and post‑trade data, in line with the RTS.
• Amend compliance manuals, MiFID/MiFIR control frameworks, and training materials to remove references to CSSF Circular 21/783 and ESMA Guidelines, replacing them with references to Delegated Regulation (EU) 2025/1156.

What changed

• - CSSF Circular 21/783, which applied ESMA’s Guidelines on MiFID II/MiFIR obligations on market data in Luxembourg, will cease to be applicable as of 23 August 2026 and is formally classified as...
• The supervisory reference framework for market data obligations in Luxembourg shifts from ESMA soft-law Guidelines to binding regulatory technical standards contained in Commission Delegated...
• Requirements on making market data available to the public on a “reasonable commercial basis” are now set out in directly applicable EU law, including detailed RTS criteria on cost-based pricing,...
• ESMA’s interpretative role via Guidelines is replaced by binding RTS, which reduces reliance on national circulars and increases harmonisation of market data rules across EU trading venues and data...
• Luxembourg firms can no longer rely on Circular 21/783 as the primary interpretative document for market data obligations; instead, their compliance frameworks must directly reference Delegated...

Key dates

02 December 2022

- CSSF published the SFDR FAQ clarifying supervisory expectations for Article 8 and Article 9 disclosures

01 January 2023 Deadline

- UCITS and AIFs disclosing under Article 8 or Article 9 must use the SFDR RTS periodic reporting templates in annual reports issued after this date

Suggested considerations

• Review all Article 8 pre-contractual disclosures to confirm that the stated investment strategy clearly explains how the fund’s environmental or social characteristics are achieved.
• Strengthen any Article 8 exclusion-based strategy disclosures so they provide sufficient detail for investors to understand the connection between exclusions and the claimed sustainability characteristics.
• Reassess all Article 9 product classifications to confirm that the portfolio is built around qualifying sustainable investments, not only exclusions.
• Implement controls to verify that Article 9 holdings remain aligned with Article 2(17) SFDR on an ongoing basis throughout the fund lifecycle.
• Document and retain the internal methodology used to assess sustainable-investment status, including any thresholds, and ensure it can be provided to investors or supervisors upon request.

What changed

• - Article 8 funds must describe how the investment strategy actually enables the fund to meet the environmental and/or social characteristics disclosed to investors.
• If an Article 8 fund relies mainly on an exclusion strategy, the CSSF expects the exclusion policy to be detailed enough for investors to understand how the stated characteristics are being met.
• Article 9 funds cannot rely only on an exclusion strategy; they must invest in sustainable investments and use a positive selection process that demonstrates alignment with Article 2(17) SFDR.
• For Article 9 funds, the CSSF expects sustainable-investment status to be maintained at all times, including on an ongoing basis during the life cycle of the fund.
• Financial market participants should make available the methodology used to determine whether an investment is a sustainable investment, including any thresholds used for a pass-fail approach.

Key dates

02 March 2026

- Most revised MiFIR transparency requirements under the MiFID II/MiFIR review (amending Delegated Regulation) apply at EU level, influencing the content and focus of national FAQs and supervisory guidance, including CSSF’s

13 July 2026 Deadline

- CSSF publishes/updates the MiFID II/MiFIR FAQ version dated 13 July 2026, which becomes the current reference point for CSSF supervisory expectations on MiFID II/MiFIR compliance

Suggested considerations

• Review the latest CSSF MiFID II/MiFIR FAQ (13 July 2026 version) in full, comparing it against existing internal MiFID II/MiFIR policies, procedures, and controls to identify gaps or misalignments.
• Confirm and, where necessary, update client‑facing disclosures to clearly state whether investment services (especially advice and portfolio management) are provided on an independent or non‑independent basis, and ensure that inducement arrangements are consistent with this classification.
• Reassess inducement frameworks (commissions, fees, non‑monetary benefits) for investment advice and portfolio management to ensure that no prohibited inducements are received or retained where services are independent or involve portfolio management.
• Review and update product governance frameworks, including target market definition processes and product approval procedures, to ensure that each instrument’s intended target market is properly documented and consistently used by distributors.
• Examine best execution policies to confirm they are clear, detailed, and understandable to clients, and implement or enhance ongoing monitoring mechanisms (e.g. execution quality reports, periodic reviews) to evidence compliance with best execution obligations.

What changed

• Because the visible page content provided is limited to technical and cookie‑related information, the key points below focus on the regulatory substance of the CSSF MiFID II/MiFIR FAQ (Q&A) as the...
• The CSSF confirms the application of MiFID II investor protection rules to Luxembourg investment service providers, including obligations on inducements, suitability, product governance, and best...
• The FAQ reiterates that investment services providers must inform clients clearly whether their investment advice or services are provided on an independent or non‑independent basis, and explains the...
• The FAQ clarifies that inducements are expressly prohibited when investment advice is provided on an independent basis and for portfolio management services, requiring firms to structure their...
• The CSSF guidance reflects product governance obligations: manufacturers must define a target market for each financial instrument based on clients’ knowledge and experience, financial situation,...

Key dates

30 June 2026 Deadline

– Reference date for the covered deposits snapshot; all figures in the survey must reflect the amount of covered deposits outstanding at close of business on this date

Early July 2026 (TBD by CSSF circular text and technical annex)

– Expected opening of the reporting window for uploading the 30 June 2026 covered deposits survey via CSSF eDesk or other specified channels, in line with the timetable used in prior CPDI surveys

Mid–Late July 2026 (TBD by CSSF/CSSI reporting instructions)

– Likely cut-off date for submission of the 30 June 2026 survey, consistent with prior CPDI quarterly survey practices that require prompt post‑quarter reporting for FGDL purposes

Suggested considerations

• Apply the EUR 100,000 coverage cap per depositor for the survey and ensure that non‑eligible deposits (such as certain financial sector deposits or specific categories excluded under the 2015 Law) are correctly filtered out of the covered deposits figures.
• Reconcile the 30 June 2026 covered deposits data with internal finance, risk, and regulatory reporting systems to ensure consistency with other prudential data and FGDL contribution calculations.
• Arrange for the survey report to be reviewed and formally approved by the institution’s governing body or the designated senior manager responsible for deposit guarantee scheme reporting, documenting the approval and any key assumptions or methodological choices.
• Submit the completed 30 June 2026 covered deposits survey through the CSSF eDesk platform or other specified reporting channel within the deadline set by CSSF-CPDI 26/51 and any accompanying CPDI instructions.
• Retain detailed working papers, data extracts, and methodology documentation supporting the 30 June 2026 survey in order to evidence compliance to CSSF, facilitate internal audit review, and support future FGDL ex‑ante contribution calculations.

What changed

• - CSSF launches a new covered deposits data survey with reference date 30 June 2026, continuing the established quarterly reporting cycle used for FGDL funding and risk-based contribution...
• Credit institutions incorporated under Luxembourg law, POST Luxembourg (for postal financial services), and Luxembourg branches of credit institutions from third countries must report the stock of...
• The survey must be submitted via the CSSF reporting channels (CSSF eDesk platform or other specified electronic means), using the data templates and technical specifications communicated by the CPDI,...
• Institutions that are members of the FGDL must ensure alignment between the survey data and the definition of “covered deposits” under the Law of 18 December 2015 on the failure of credit...
• The circular reaffirms that data reported for the survey feed into the risk‑based ex‑ante contribution mechanism set out in CPDI circulars on FGDL contributions (e.g.

Key dates

TBD (from AMLA operational go‑live date in 2025–2026)

- AMLA formally designates its first batch of directly supervised obliged entities at EU level, potentially including entities identified under this circular

25 June 2026

- CSSF publishes Circular 26/914 identifying obliged entities eligible for direct supervision by AMLA and setting the framework for Luxembourg’s contribution to AMLA’s selection and supervisory process

TBD (periodic, post‑AMLA go‑live)

- Periodic reviews by AMLA and the CSSF of eligible entities’ status and updates to the list of entities subject to, or proposed for, direct AMLA supervision

Suggested considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

What changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Key dates

22 June 2026

- Circular CSSF 26/913 is published and the CSSF confirms application of EBA/GL/2026/01

TBD (effective date not stated in the publication)

- Firms should apply the CSSF’s expectations from the date the circular becomes applicable, if that date is specified in the full circular text or accompanying CSSF notice

TBD (implementation date not stated in the publication)

- Affected firms should complete internal perimeter reviews and any resulting governance or reporting updates by the first supervisory reporting cycle after application

Suggested considerations

• Review all group entities and business lines to identify activities that may fall within the definition of an ancillary services undertaking under Article 4(1)(18) CRR.
• Document a formal assessment methodology for classifying activities against the EBA/GL/2026/01 criteria.
• Reconfirm the prudential consolidation perimeter and ensure all ancillary service entities are correctly included or excluded, with the reasoning retained for supervisory review.
• Update legal entity inventories, regulatory mapping, and governance documents so they align with the CSSF’s adopted EBA framework.
• Test whether existing internal reporting, risk management, and control frameworks capture any newly identified ancillary services undertakings.

What changed

• - The CSSF has formally applied the EBA Guidelines on ancillary services undertakings specified in EBA/GL/2026/01 for identifying activities under Article 4(1)(18) of Regulation (EU) No 575/2013.
• Firms must assess whether a non-bank activity or group entity qualifies as an ancillary services undertaking under the EBA criteria, rather than relying on internal labels or informal business...
• The regulatory perimeter analysis now needs to consider whether relevant activities are performed within a banking group in a way that affects prudential consolidation and supervisory treatment.
• Institutions should expect the CSSF to use the EBA framework as the benchmark for determining whether an activity is sufficiently connected to banking support functions to fall within the ancillary...
• Compliance evidence will need to show a documented, reproducible assessment of each potentially relevant activity against the EBA identification criteria.

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be overhauled

15 June 2026

– CSSF press release published, drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview and signaling supervisory expectations that entities consider this doctrine when preparing annual accounts

Suggested considerations

• Obtain and review the full CNC Q&A 26/037 and the CNC chairman’s interview (French‑language originals), ensuring that finance, accounting, and compliance teams understand the clarified distinctions between statutory and contractual/voluntary annual accounts.
• Map all sets of financial statements prepared by each Luxembourg entity (statutory accounts, covenant‑based or lender‑specific accounts, group reporting packages, management accounts, etc.) and classify each set as statutory or contractual/voluntary in line with CNC Q&A 26/037 definitions.
• Update internal accounting policies and manuals to explicitly define statutory versus contractual/voluntary annual accounts, specify the applicable accounting principles and disclosures for each, and describe any differences in measurement, presentation, or scope.
• Assess current practices for communicating financial information to lenders, investors, regulators, and other stakeholders to confirm that non‑statutory accounts are not labeled or presented in a way that could be misinterpreted as statutory accounts approved under Luxembourg company law.
• Implement clear labeling and disclosure conventions on the face of financial statements and in accompanying notes (e.g., in engagement reports, board minutes, and management communications) to distinguish statutory annual accounts from any contractual or voluntary accounts.

What changed

• - The CSSF formally draws regulated entities’ attention to CNC Q&A 26/037, elevating it as a key interpretative reference on the concepts of annual accounts prepared for legal/statutory purposes...
• The CNC Q&A 26/037 provides clarified definitions of “comptes annuels établis à fins légales” (statutory annual accounts) and “comptes annuels établis à des fins contractuelles ou sur base...
• The Q&A gives practical answers to frequently asked questions from preparers about when accounts qualify as statutory versus merely contractual or voluntary, and how this affects applicable...
• The Q&A addresses related issues, such as the extent to which CNC doctrine and Luxembourg GAAP must be followed for contractual or voluntary accounts, and the risks of presenting non‑statutory...
• The CSSF also highlights an interview with the CNC chairman announcing that Luxembourg accounting legislation will undergo a refonte (major overhaul), signaling that current CNC doctrine, including...

Key dates

08 June 2026

– Publication of the interview with the CNC chairman in Paperjam announcing that Luxembourg accounting legislation will be subject to a comprehensive overhaul

15 June 2026

– CSSF communiqué published, formally drawing attention to CNC Q&A 26/037 and the CNC chairman’s interview, and thereby activating supervisory expectations that firms take these clarifications into account

TBD (post‑2026)

– Effective dates for the planned overhaul of Luxembourg accounting legislation remain to be defined; firms should anticipate consultation and transition periods once draft law is published

Suggested considerations

• Identify all sets of financial statements prepared by the firm or its Luxembourg entities (statutory, covenant/banking, shareholder/management, group‑reporting, voluntary) and map which are statutory annual accounts under Luxembourg law and which are contractual or voluntary.
• Review the CNC Q&A 26/037 in detail and update internal accounting manuals and group reporting policies to embed the CNC’s definitions, terminology and criteria for statutory versus non‑statutory annual accounts.
• Implement a clear labelling and disclosure convention so that all non‑statutory financial statements explicitly state their nature (contractual or voluntary) and are not presented or communicated as statutory annual accounts.
• Update templates for board and shareholder approvals, minutes and resolutions to ensure that the correct set of statutory annual accounts is approved for legal purposes such as profit appropriation, dividend distribution, capital reduction and regulatory filings.
• Review all contractual arrangements (loan agreements, bond indentures, shareholder agreements, management incentive plans and service contracts) to determine whether they require statutory annual accounts or allow contractual/adjusted accounts, and align documentation and practice accordingly.

What changed

• - The CSSF endorses and promotes CNC Q&A 26/037 as the reference clarification on the concept of “comptes annuels établis à fins légales” (statutory annual accounts) versus annual accounts prepared...
• The Q&A provides clear criteria to distinguish statutory accounts from non‑statutory accounts, including their legal basis, approval process, filing and publication obligations, and permissible use...
• The CNC guidance clarifies that statutory annual accounts must fully comply with Luxembourg accounting law (including mandatory layouts, valuation rules and disclosures), whereas...
• The CNC addresses frequent practical questions from preparers, including whether financial statements prepared for banks, covenants, shareholders’ agreements, management incentive plans or...
• The CSSF communicates that misunderstandings between statutory and contractual accounts remain common, implicitly warning against the risk of using non‑statutory statements in contexts where...

Key dates

02 June 2026

- CSSF publishes the reminder on T+1 readiness, survey participation, and ESMA’s consultation work

09 June 2026 Deadline

- Deadline to complete the CSSF national competent authorities’ T+1 readiness survey

07 December 2026

- Expected application date of the revised ESMA guidelines on standardised procedures and messaging protocols

11 October 2027

- T+1 settlement cycle becomes effective under CSDR

Suggested considerations

• Complete the CSSF T+1 readiness survey before 9 June 2026 and ensure the submission accurately reflects the firm’s current operational readiness.
• Participate in the EU T+1 Industry Committee second readiness survey to demonstrate engagement with the EU-wide readiness process.
• Review the firm’s allocation and confirmation workflows to ensure they can operate within T+1 timeframes.
• Replace any reliance on oral, manual, or non-machine-readable communications with electronic, standardised messaging channels unless a temporary technical disruption justifies an exception.
• Align internal messaging standards with international messaging protocols used for post-trade communication.

What changed

• - CSSF is requiring market participants to complete the national competent authorities’ T+1 readiness survey by 9 June 2026, with responses visible only to CSSF and ESMA.
• CSSF is strongly encouraging participation in the EU T+1 Industry Committee second readiness survey to support a Union-wide assessment of market preparedness.
• CSSF is flagging that the transition to T+1 settlement on 11 October 2027 under CSDR will require coordinated changes across the trading and post-trading chain.
• CSSF is warning that forthcoming amendments to the RTS on Settlement Discipline are expected to be endorsed by the European Commission and will further define operational requirements for the T+1...
• ESMA’s revised guidelines on standardised procedures and messaging protocols are intended to make post-trade communication faster, clearer, and more consistent across the EU.

Key dates

09 June 2026 Deadline

- Deadline for Luxembourg market participants to complete the CSSF national competent authorities’ T+1 readiness survey

07 December 2026

- Expected application date of revised ESMA guidelines on standardised procedures and messaging protocols and the aligned new RTS on Settlement Discipline requirements on allocations and confirmations

11 October 2027

- Effective date for the transition to a T+1 settlement cycle in the EU under CSDR

Suggested considerations

• Identify all group entities and business lines in Luxembourg that are in scope of CSDR T+1 (trading, clearing, settlement, custody, collateral, fund dealing) and formally designate a T+1 programme owner at senior management level.
• Complete the CSSF T+1 national competent authorities’ survey in full and by 9 June 2026, ensuring that responses accurately reflect current readiness, key risks, dependencies on third parties, and planned remediation milestones.
• Arrange for appropriate internal review and sign‑off (e.g. by Compliance and relevant senior management) of the responses to both the CSSF survey and the EUIC second readiness survey before submission.
• Participate in the EU T+1 Industry Committee second readiness survey and ensure the firm’s answers are consistent with the information provided to CSSF and with internal T+1 project documentation.
• Perform a comprehensive T+1 impact assessment of front‑to‑back trade flows, covering trade execution, allocation, confirmation, affirmation, clearing, settlement, collateral movements, cash and liquidity management, and corporate actions.

What changed

• - The EU settlement cycle for in‑scope financial instruments under CSDR will shorten from T+2 to T+1 with effect from 11 October 2027, materially reducing the time to complete front‑to‑back trade,...
• CSSF has launched a national competent authorities’ T+1 readiness survey and sets a firm completion deadline of 9 June 2026 for Luxembourg market participants, treating it as a critical supervisory...
• In parallel, CSSF strongly encourages Luxembourg firms to complete the EU T+1 Industry Committee (EUIC) second readiness survey to support an EU‑wide view of T+1 readiness and potential systemic...
• ESMA’s final draft amendments to the CSDR RTS on Settlement Discipline will introduce additional operational requirements specifically designed to support T+1 (e.g.
• ESMA has launched a consultation on updated guidelines on standardised procedures and messaging protocols for allocations, confirmations and affirmations, explicitly aimed at facilitating the T+1...

Key dates

21 July 2018

- Article 36(2) transparency requirements apply to MMFs authorised under MMFR as of this date, excluding MMFs benefiting from the transitional provision in article 44(1)

28 August 2018

- CSSF first published the MMFR FAQ, establishing the supervisory clarification framework for MMF questions

18 March 2024

- The CSSF MMF page shows Version 4 of the FAQ and references updated related MMF materials, including ESMA stress test scenario guidance

05 June 2025

- The CSSF webpage shows Version 4 as updated on this date, before the current Version 5 publication

Version 5 / current publication date not stated in the provided extract

- The updated FAQ is now the current CSSF guidance version on the public webpage

Suggested considerations

• Review the MMF prospectus and website disclosure architecture to ensure that maturity breakdown and credit profile information are presented in a manner consistent with the CSSF’s current FAQ interpretation.
• Confirm that weekly article 36(2) disclosures are scheduled on a controlled and documented day of the week, with escalation procedures for missed or late publication.
• Verify that internal credit quality assessment methodology, evidence, and sign-off are documented and available for disclosure or supervisory review.
• Reassess whether each MMF in scope is subject to article 36(2) based on its authorisation status and whether any transitional article 44(1) treatment applies.
• Align reporting and disclosure controls with the broader CSSF MMF framework, including recurring financial reporting expectations for CSSF-supervised MMF managers.

What changed

• - The CSSF has published an updated MMFR FAQ and the current public version is Version 5, indicating that supervisory clarifications have been refreshed since the prior Version 4 publication.
• The FAQ continues to address key MMFR transparency topics, including maturity breakdown, credit profile disclosure, and the ability to provide some information via a website link in the prospectus.
• The guidance confirms that the manager may choose the day of the week for the weekly disclosure required under article 36(2), which is operationally important for recurring disclosure controls.
• The FAQ states that information on internal credit quality assessment must be provided, reinforcing the expectation that the assessment is documented and made available as required.
• The FAQ clarifies that article 36(2) applies only to MMFs authorised in accordance with MMFR as at 21 July 2018, and not to MMFs benefiting from the transitional provision in article 44(1).

Key dates

21 January 1991

- Original Circular IML 91/75 entered into force, setting rules for undertakings governed by the Law of 30 March 1988 on undertakings for collective investment

22 May 2026

- Circular CSSF 26/912 is published and takes effect, repealing Circular IML 91/75 (as amended) with immediate effect and archiving it from the same date

Suggested considerations

• Identify and inventory all internal and external documents (including policies, procedures, compliance manuals, prospectuses, offering documents, service agreements and SLAs) that reference Circular IML 91/75 or its amending Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901.
• Remove or replace all references to Circular IML 91/75 and its amending circulars in compliance frameworks, manuals, registers of applicable rules and control libraries, ensuring they are mapped instead to the current applicable UCI, SIF, SICAR, AIFM and relevant CSSF circulars.
• Perform a gap analysis to confirm that all substantive topics previously governed by IML 91/75 in your framework are now fully covered by current Luxembourg laws, EU fund regulations and up‑to‑date CSSF circulars and FAQs.
• Update training materials and onboarding content for compliance, portfolio management, risk and operations staff to reflect that IML 91/75 has been repealed and to direct staff to the current legal and regulatory sources governing UCIs and alternative funds.
• Adjust internal audit and compliance monitoring programs so that any test steps or key controls referencing IML 91/75 are updated to reference the applicable current provisions and CSSF administrative practice.

What changed

• - Circular IML 91/75, which set out rules for Luxembourg undertakings governed by the Law of 30 March 1988 on undertakings for collective investment, is repealed in full with effect from 22 May 2026...
• All amendments to Circular IML 91/75 introduced by Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901 are implicitly repealed as part of the repeal of IML 91/75 itself.
• The regulatory expectations previously contained in IML 91/75 are now either superseded by later Luxembourg fund laws (including post‑1988 UCI legislation and regimes for SICARs and SIFs), later CSSF...
• The historical link to the Law of 30 March 1988 on undertakings for collective investment is effectively severed at circular level, confirming that the operative framework is now the modern suite of...
• IML 91/75 is flagged as archived by the CSSF as of 22 May 2026, clarifying that it has no continuing normative or interpretative value as a live supervisory instrument.

Key dates

21 January 1991

- Original Circular IML 91/75 on revision and remodelling of rules applicable to UCIs under the Law of 30 March 1988 is issued (subsequently amended by later circulars)

22 May 2026

- Circular CSSF 26/912 is published and Circular IML 91/75 (as amended by Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901) is repealed and archived

Suggested considerations

• Update your regulatory inventory and obligation registers to reflect that Circular IML 91/75 and its amending circulars (CSSF 05/177, 18/697, 21/790, 22/811 and 25/901) have been repealed by Circular CSSF 26/912 as of 22 May 2026.
• Verify that your compliance monitoring programmes and internal audit test plans do not rely on requirements sourced from Circular IML 91/75, and re-align any such tests to the currently applicable legal and regulatory standards.
• Communicate the repeal of Circular IML 91/75 internally to legal, compliance, risk, product, and fund administration teams to prevent continued reliance on obsolete rules in ongoing or future projects.
• For any ongoing remediation, authorisation or approval processes that previously cited IML 91/75 as justification for a control design, reassess and document those controls against the current CSSF requirements that have effectively replaced or superseded the 1991 framework.
• Maintain an audit trail evidencing the update of documentation and registers in response to Circular CSSF 26/912, including board or senior management notification where your governance framework requires it for changes in regulatory obligations.

What changed

• - Circular IML 91/75, including its amendments by Circulars CSSF 05/177, 18/697, 21/790, 22/811 and 25/901, is formally repealed by Circular CSSF 26/912.
• The rules on “revision and remodelling of the rules to which Luxembourg undertakings governed by the Law of 30 March 1988 on undertakings for collective investment are subject” no longer form part of...
• Supervisory expectations for Luxembourg UCIs are now to be derived exclusively from the current UCI regime (notably the Law of 17 December 2010 relating to undertakings for collective investment and...
• Any internal compliance mappings, policy references, or control frameworks that still cite Circular IML 91/75 or its amending circulars must be treated as referencing repealed guidance and should be...

Key dates

26 March 2026

- ESMA publishes the English, French, and German translations of the 2025 Guidelines on stress test scenarios under Article 28 MMFR on its website, starting the two‑month period to application

26 May 2026

- Circular CSSF 26/911 enters into force and Circular CSSF 25/877 is repealed and replaced, making the 2025 ESMA Guidelines the applicable stress testing framework in Luxembourg

30 June 2026 Deadline

- MMFs and MMF managers must apply the 2025 ESMA Guidelines for the preparation of the required MMF reporting as from the reporting date 30 June 2026 onwards, meaning that stress test calculations underlying this and subsequent reports must be based on the 2025 parameters

Suggested considerations

• Identify all MMFs and MMF mandates in scope of Regulation (EU) 2017/1131 for which the CSSF is the competent authority and confirm that they are currently using the 2024 ESMA stress test framework under Circular CSSF 25/877.
• Obtain and review in detail the ESMA 2025 Guidelines on stress test scenarios (ESMA50-481369926-30585) and the annexed parameters as integrated by Circular CSSF 26/911, comparing them line‑by‑line to the 2024 version to map all methodological and parameter changes.
• Update the MMF stress testing policy and procedures to reference Circular CSSF 26/911 and the 2025 ESMA Guidelines, including explicit descriptions of the scenarios, calibration choices, modelling techniques, and governance for scenario approval.
• Recalibrate stress testing models and tools used for MMFs to reflect the 2025 common reference parameters, ensuring that interest rate shocks, credit spread moves, liquidity shocks, redemption scenarios, and concentration risks are aligned with the new ESMA specifications.
• Perform impact analyses on representative MMFs using both 2024 and 2025 parameters to quantify changes in stress outcomes, and prepare internal briefing materials for senior management and boards explaining the impacts on liquidity and risk profiles.

What changed

• - Circular CSSF 26/911 replaces Circular CSSF 25/877 and integrates ESMA’s 2025 Guidelines on stress test scenarios under Article 28 of Regulation (EU) 2017/1131 (MMFR), making the updated scenarios...
• The 2025 ESMA Guidelines (Ref. ESMA50-481369926-30585) update the common reference stress test parameters for MMFs, reflecting more recent market conditions and liquidity risk drivers than the 2024...
• The circular clarifies that MMFs and MMF managers must use the updated 2025 ESMA stress test scenarios when preparing the MMF reporting required under the MMFR and the related Commission Implementing...
• Circular CSSF 26/911 confirms that the 2025 Guidelines and their translations, published by ESMA on 26 March 2026, are now integrated into CSSF supervisory practice, following the ESMA process...
• The circular reiterates that MMFs and their managers must tailor the ESMA reference scenarios to the specificities of each MMF, adding additional risk factors or requirements where needed to ensure...

Key dates

15 April 2026

Publication and CSSF application date of ESMA Guidelines via Circular CSSF 26/910

Suggested considerations

• Review and Update Policies: IFMs must select, calibrate, activate/deactivate LMTs per ESMA guidelines, documenting fair/reasonable ADT calibration (e.g., transaction costs, market impact analysis).
• Demonstrate Compliance: Be prepared to show regulators liquidity risk management, including at least one quantitative LMT, one ADT, and condition-specific tools; integrate with UCITS/AIFMD requirements.
• Risk Management Integration: Ensure primary responsibility for LMTs, with consistent supervisory application; open-ended SIFs to cross-reference with (EU) 2026/465.
• Supervisory Preparedness: Maintain records of previous transactions for market impact estimation and overall LMT rationale.

What changed

• - Adoption of ESMA Guidelines: CSSF formally applies ESMA's guidelines (ESMA34-671404336-1364), focusing on LMT selection (e.g., redemption gates, suspension of redemptions/dealings, side pockets),...
• Calibration Requirements: IFMs must demonstrate fair and reasonable ADT calibration for normal and stressed conditions, including explicit transaction costs and, where appropriate, estimated implicit...
• LMT Recommendations: IFMs should select at least one quantitative-based LMT, one ADT, one for normal conditions, and one for stressed conditions; consider additional measures.
• Scope Expansion Recommendation: Open-ended SIFs (not under Part II of the 2010 Law) should consider the circular alongside Commission Delegated Regulation (EU) 2026/465.

Key dates

1 April 2026

Circular CSSF 26/909 published; immediate application of ESMA competence guidelines.; [User-provided content]

Suggested considerations

• Assess Staff Competence: Implement ESMA-guided evaluations (e.g., exams, certifications) for all relevant personnel handling crypto services; document results in governance frameworks.
• Update Policies and Training: Integrate competence criteria into HR, onboarding, and annual reviews; roll out MiCA-specific training on reporting, breaches, and governance.
• Licensing Dossier Enhancement: Include competence attestations in CSSF applications; appoint dedicated compliance/risk officers with verified qualifications.
• Ongoing Monitoring: Conduct regular audits, penetration tests, and incident planning; confirm compliance annually via management body statements.
• Early CSSF Engagement: Schedule dialogues and info sessions; create MiCA readiness scorecards for board and regulator discussions.

What changed

• - Adoption of ESMA Guidelines: CSSF mandates application of ESMA's criteria for evaluating staff knowledge and competence in crypto-asset services, including roles in custody, trading, portfolio...
• Assessment Framework: Firms must implement standardized tests and processes to verify staff qualifications, aligning with MiCA Article 62 on CASP authorization, focusing on technical crypto...
• No New Standalone Rules: This circular builds on prior CSSF MiCA circulars (e.g., 25/890 on crypto-asset classification), integrating competence checks into licensing dossiers and ongoing supervision.

Key dates

31 March 2026

- Reference date for snapshot of covered deposits

30 April 2026 Deadline

(inferred from pattern in prior circulars like 25/49) - Likely submission deadline for survey data to CPDI (exact date in full PDF; aligns with one-month post-reference in predecessors)

Suggested considerations

• Compile data on covered deposits (eligible deposits up to €100,000 per depositor, per Article 163 of 2015 Law), excluding items per Article 172 (e.g., financial institutions, life insurance).
• Report detailed breakdowns: total eligible/covered deposits, omnibus/fiduciary accounts (with beneficiary counts), natural vs. legal persons, branch-level data.
• Submit via specified format (per attached specs, unchanged from priors) to CPDI by deadline; quarterly data ongoing per CSSF-CPDI 17/07.
• Ensure alignment with FGDL contributions under CSSF-CPDI 25/48.

What changed

This circular introduces no substantive changes to survey content, methodology, or reporting specifications compared to prior issuances (e.g., CSSF-CPDI 25/49 for 31 December 2025). Updates are limited to the reference date (31 March 2026) and associated deadlines, maintaining the risk-based ex-ante contribution method from Circular CSSF-CPDI 20/21 and quarterly reporting under CSSF-CPDI 17/07.

Key dates

17 December 2018

- Original issuance of Circular CSSF 18/703 introducing semi-annual reporting

25 March 2026

- Publication date of Circular CSSF 26/908 (today)

Suggested considerations

• Download and review the full Circular CSSF 26/908 (291.96Kb PDF) and the updated consolidated Circular CSSF 18/703 (258.91Kb PDF) from the CSSF website: https://www.cssf.lu/en/Document/circular-cssf-26-908/.
• Conduct a gap analysis of current reporting processes against the amended requirements for borrower-related residential real estate indicators.
• Update internal systems, data collection templates, and reporting workflows to ensure accurate semi-annual submissions to the CSSF.
• Train relevant compliance, risk, and finance teams on changes; document compliance confirmations for audit trails.

What changed

The circular introduces amendments to the original Circular CSSF 18/703 (itself amended by Circulars CSSF 20/737 and 21/772), focusing on semi-annual reporting of indicators tied to borrowers in residential real estate. Specific changes are not detailed in the provided summary or full content excerpt, but they likely involve refinements to reporting templates, data granularity, or submission processes to align with evolving EU prudential standards on real estate risk monitoring. The updated consolidated version of Circular CSSF 18/703 is now available as a 258.91Kb PDF.

Key dates

December 3, 2020

- CSSF Regulation No 20-08 originally published

January 1, 2021

- Regulation and LTV limits became effective for residential real estate credit on Luxembourg territory

May 21, 2024

- CSSF Regulation No 24-04 introduced temporary adjustments to LTV limits

December 30, 2024

- CSSF Regulation No 24-10 extended temporary adjustments

January 7, 2025

- Most recent Technical FAQ version published (prior to March 9, 2026 update)

Suggested considerations

• *For all lenders:
• *Verify LTV compliance calculations for all new residential mortgage originations using the framework specified in the FAQ, ensuring own funds are calculated as actual equity contributions from borrowers
• *Implement dual LTV tracking for borrowers financing new property through sale of existing property, ensuring compliance with both interim and final LTV ratios
• *Document own funds sources carefully, particularly when cash collateral or sale proceeds are used, as these are only permitted for loans with initial LTV below 100%
• *Prepare for June 30, 2025 transition by:

What changed

• The most recent update (March 9, 2026) to the Technical FAQ reflects the regulatory framework established by CSSF Regulation No 20-08 (as modified by Regulation No 24-10).
• First-time buyers: LTV limit of up to 100%
• Other buyers: LTV limit of 90%, implemented via portfolio allowance Buy-to-Let Residential Loans:
• Standard LTV limit of 80%
• Temporary exemption (until June 30, 2025): Lenders may apply LTV ratios up to 95% for up to 10% of annual production Other Residential Real Estate Loans:

Key dates

17 Dec 2018

Original Circular CSSF 18/703 published; reporting obligation introduced

19 Feb 2020

Circular CSSF 20/737 and FAQ published; clarified exemptions and scope

10 May 2021

Circular CSSF 21/772 amendment published

25 Mar 2026

Circular CSSF 26/908 amendment published (today's date); immediate implementation expected for upcoming cycles

Ongoing (semi Deadline

annual); Reports due in April (ref. 31 Dec) and October (ref. 30 Jun) each year

Suggested considerations

• Download and use the dedicated RRE data template from the CSSF website (https://www.cssf.lu/en/Document/circular-cssf-18-703/).
• Assess total outstanding RRE exposure; if > EUR 10 million, collect data on new/outstanding exposures per reference dates (30 Jun/31 Dec).
• Ensure IT systems store/process RRE indicators (e.g., borrower debt metrics, collateral details) for semi-annual extraction.
• Submit reports to CSSF in April/October; review amendments (20/737, 21/772, 26/908) and FAQ for updates.
• For exempt banks: Confirm eligibility annually; no zero report required.

What changed

• - Original Scope (CSSF 18/703, 17 Dec 2018): Requires semi-annual reporting of RRE indicators for loans secured by Luxembourg residential real estate (existing dwellings, under construction,...
• Amendment CSSF 20/737 (19 Feb 2020): Clarified reporting thresholds and processes; banks with total outstanding RRE exposure ≤ EUR 10 million are exempt from reporting (no zero report needed if no...
• FAQ (19 Feb 2020): Specifies reporting for new exposures (Jan-Jun or Jul-Dec) and outstanding exposures as of 30 June/31 Dec; exemption applies only if exposure < EUR 10 million.
• Amendment CSSF 21/772 (10 May 2021): Further refinements to data template and indicators.
• Amendment CSSF 26/908 (25 Mar 2026): Latest update to reporting template and processes, effective immediately given publication date. Data is collected via a CSSF template on the website, focusing on...

Key dates

23 February 2026

- Planned launch for specialised professionals' CSSF questionnaire (delayed per 11 March update)

2 March 2026

- Original launch date for AMLA questionnaire and calibration exercise via eDesk platform (delayed)

13 March 2026

- AMLA webinar (10:00-12:00) on reporting framework and clarifications (connection details in CSSF annex)

15 April 2026 Deadline

- Submission deadline for AMLA calibration exercise participants (maintained despite delays; changes to be communicated)

TBD (post Deadline

11 March 2026); - New launch and submission deadlines for all data collections, pending final AMLA questionnaire

Suggested considerations

• Monitor CSSF communications for final questionnaire, launch dates, and eDesk access; prepare data on 2025 ML/TF risks and mitigation using current AMLA draft (not for submission).
• Selected AMLA calibration participants: Compile and submit quantitative/qualitative data via eDesk by 15 April 2026; attend 13 March webinar.
• Non-selected credit/financial institutions: Complete AMLA templates on ML/TF risks/mitigation for 2025 via eDesk upon launch.
• Specialised professionals: Prepare CSSF-specific questionnaire ahead of (delayed) 23 February launch.
• All: Ensure resources for timely reporting; review internal AML/CFT risk assessments for consistency with EU standards.

What changed

• - CSSF adopts AMLA-developed data collection templates for credit institutions, investment firms, and investment fund managers (excluding specialised professionals), replacing its prior questionnaire...
• Entities selected for AMLA's mandatory calibration exercise (notified directly by CSSF) must report quantitative and qualitative ML/TF risk data; non-selected entities still report via AMLA templates...
• Launch delayed from 2 March 2026 due to AMLA's consultation feedback on templates and guidance; new timelines and final questionnaire to be announced, but AMLA maintains 15 April 2026 submission for...
• Specialised professionals of the financial sector complete a separate CSSF questionnaire, launching earlier on 23 February 2026 (subject to delay).

Key dates

23 August 2018

- Publication of underlying Circular CSSF 18/698, setting baseline requirements

14 January 2019

- Original publication of the list

12 March 2026

- Latest update to the list, requiring immediate review and integration into reporting processes[Source URL]

End of May (post Deadline

financial year); - Compliance deadline for Circular 18/698 obligations, including governance reporting (e.g., 5 months after year-end)

Suggested considerations

• Download and use the XLSX table: Incorporate the exact list of activities/mandates into internal templates for reporting management body and conducting officer roles[Source URL].
• Update authorization and notification files: Include detailed CVs, criminal record extracts, wealth declarations, and organization charts for relevant personnel/shareholders; notify CSSF of changes (e.g., qualifying holdings, guarantees).
• Conduct fit-and-proper assessments: Ensure declarations cover all listed mandates, demonstrating no conflicts and adequate resources; perform initial/ongoing due diligence on delegates.
• Annual compliance review: Document roles in compliance monitoring plans, training, and reporting to senior management/CSSF; align with delegate oversight (e.g., risk-based monitoring of compliance, audit functions).
• Policy updates: Revise governance policies to reflect the updated list, including AML/CFT officer designations and own funds proofs.

What changed

• The document was originally published on 14 January 2019 and updated on 12 March 2026, reflecting revisions to the predefined list of professional activities and mandates[Source URL].
• Alignment with Circular CSSF 18/698 requirements for IFMs (management companies for UCIs and AIFs), specifying reportable roles like those in collective portfolio management, risk management,...
• Emphasis on detailed documentation of mandates to demonstrate fitness, properness, and avoidance of conflicts, including for shareholders with qualifying holdings.
• No entirely new requirements introduced, but the update likely incorporates evolving governance expectations, such as enhanced delegate oversight and AML/CFT compliance officer designations.

Key dates

TBD 2026

Potential ad-hoc CSSF questionnaires for essential data points

23 February 2026

Original launch for specialised professionals' CSSF questionnaire

2 March 2026

Original launch date for AMLA calibration exercise data collection via eDesk (now potentially adjusted or paused per delay circular)

11 March 2026

Publication of delay circular, superseding prior timelines; further modalities to be communicated

15 April 2026 Deadline

Original reporting deadline to CSSF for AMLA calibration exercise data

Suggested considerations

• Monitor CSSF updates: Await forthcoming communications on revised modalities, new timelines, and any ad-hoc requests via eDesk platform.
• Prioritize AMLA obligations: Selected entities must prepare quantitative/qualitative ML/TF risk data per draft RTS on risk assessments (Article 40(2) of Directive (EU) 2024/1640); non-selected entities focus on AMLA templates for 2025 risks/mitigation.
• Specialised professionals: Continue preparations for CSSF-specific questionnaire, confirming any shifts post-delay.
• Internal review: Assess ML/TF risk profiles, mitigation measures, and reporting readiness in light of EU alignment; update compliance calendars to reflect simplification.
• No immediate submissions: Stand down from original 2 March/15 April deadlines unless individually notified otherwise.

What changed

• - Postponement of CSSF-specific questionnaire: The CSSF has decided not to proceed with its own AML/CFT standardised data collection for most supervised entities (credit institutions, investment...
• Exception for specialised professionals: Specialised professionals of the financial sector (e.g., certain non-credit institutions) remain subject to a CSSF-specific questionnaire, though timelines...
• Rationale tied to AMLA calibration exercise: Entities selected for AMLA's 2026 calibration exercise (notified directly by CSSF) must complete it regardless; non-selected entities were to use AMLA...
• Potential for ad-hoc requests: CSSF reserves the right to issue targeted questionnaires later in 2026 for essential data points not covered by AMLA. These changes supersede the 12 February 2026...

Key dates

2 March 2026

Publication and effective date; Guidance applies immediately; incomplete applications received on/after this date will not start processing until complete

Suggested considerations

• Review Guidance: Download and study the XLSX document (Version 1.0) detailing per-shareholder/per-change requirements.
• Prepare Complete Packages: For initial authorisation or amendments, compile minimum docs (e.g., IDs for beneficial owners/PEPs, group charts, financing details, MEF, fees); use *MEF templates where noted.
• Submit Fully: Ensure all minimums included in future filings to avoid delays; anticipate CSSF requests for extras.
• Internal Processes: Update compliance checklists, train teams on shareholder due diligence, and integrate into authorisation workflows.

What changed

• - Minimum Document Requirements: Establishes a mandatory list of documents for each new shareholder candidate, differentiated by type (e.g., natural person, legal person, beneficial owner,...
• Additional Mandatory Submissions: For changes involving qualified holdings (entry, increase/decrease, removal), requires updated group structure charts, MEF (in some cases), financing information,...
• Enforcement Mechanism: From 2 March 2026, applications lacking these minimums are deemed incomplete, halting analysis until fully submitted.
• No prior formalised list existed in this detail for IFMs, shifting from case-by-case to standardised requirements.

Key dates

2 March 2026

Publication and immediate applicability; New guidance effective; incomplete applications received on/after this date not processed until complete

Suggested considerations

• Prepare Complete Packages: For each new shareholder candidate, compile type-specific docs (e.g., ID/CV/DH/CR for direct unqualified shareholders; financing proof if indirect qualified lacks resources).
• Submit Core Items: Always include updated group structure chart, MEF (template available), acquisition financing details, fee form; classify request type (e.g., prior authorisation for qualified changes).
• Initial/Modification Filings: Use XLSX guidance as checklist; ensure beneficial owner verification per Circular CSSF 19/732.
• Ongoing: Notify CSSF of changes; anticipate ad-hoc requests for extras like PEP declarations.

What changed

• - Minimum Document Lists: Introduces detailed checklists in an XLSX format covering candidate shareholder documents (e.g., ID, CV, declarations of honour (DH), criminal records (CR) for natural...
• Differentiation by Shareholder Type: Requirements vary by natural/legal person, beneficial owner, direct/indirect qualified/unqualified shareholders, and involvement in financing (e.g., "Yes, if PEP...
• Other Mandatory Submissions: For qualified holding changes (entry, increase/decrease, removal), requires updated group structure charts, Market Entry Forms (MEF), financing details, and fee forms;...
• Enforcement Mechanism: From 2 March 2026, incomplete submissions halt analysis until remedied; CSSF may request additional info.

Key dates

18 February 2026

- Circular CSSF 26/907 published

No specific implementation deadline provided Deadline

in available search results; firms should consult the full French text for any transition periods or effective dates

Suggested considerations

• *Obtain and review the full French text of Circular CSSF 26/907 from the CSSF website
• *Assess current auditor qualifications against the new requirements for approved special statutory auditors
• *Update audit engagement letters and terms to reflect any new standards or responsibilities
• *Document compliance with the circular's requirements in governance and audit files
• *Communicate with appointed auditors to ensure alignment with the new framework

What changed

• The search results provided do not contain the full text of Circular CSSF 26/907, as it is available only in French and the PDF content was not included in the available materials.
• Statutory auditor qualifications and requirements for the specialized role of approving auditors (réviseurs agréés spéciaux) overseeing credit institutions that issue mortgage bonds
• Governance standards for auditors in this specialized capacity
• Audit and oversight responsibilities specific to mortgage bond issuance activities The circular aligns with broader Luxembourg regulatory modernization efforts evident in concurrent CSSF guidance,...

Key dates

17 February 2026

- CSSF publishes updated FAQ (effective immediately)

No explicit transition period stated Deadline

- Firms should implement changes promptly to ensure compliance with the new quarterly disclosure requirement

Suggested considerations

• *For IFMs Managing UCITS ETFs:
• *Update disclosure procedures to transition from monthly to quarterly publication schedules for detailed portfolio holdings
• *Maintain daily information sharing with APs and market makers to support arbitrage mechanisms—this requirement remains unchanged
• *Revise prospectuses to reflect the new quarterly disclosure frequency and confirm compliance with the 30 business-day publication window
• *Document procedures for calculating the 30 business-day deadline from quarter-end

What changed

• The update modifies two critical FAQ sections: Portfolio Transparency Requirements (Question 12.1) The CSSF has expanded and clarified its guidance to apply to all UCITS ETFs, not just actively...
• Daily disclosure to market participants: Market makers and authorized participants (APs) continue to receive detailed portfolio information on a daily basis to maintain efficient arbitrage mechanisms...
• Quarterly public disclosure: Investment Fund Managers (IFMs) must now publish detailed portfolio holdings to all investors at least quarterly with a maximum time lag of 30 business days (previously...

Key dates

20 May 2025

Related AIFM FAQ Version 24; Introduces changes relevant to UCI managers acting as AIFMs

16 January 2026

UCI Authorisation page update; Reflects ongoing CSSF expectations for approvals

04 February 2026

Crypto FAQ Version 7 update effective; MiCAR-aligned changes on crypto exposure, authorisation extensions, and depositary notifications

17 February 2026 Deadline

FAQ Version 23 update effective; Applies immediately to UCI operations, authorisations, and compliance.[User-provided content]

Suggested considerations

• Review and Update Documents: Align UCI constitutive documents, investment policies, and sales documents with clarified rules on strategies, LMTs, conflicts, and risk-spreading; apply look-through for intermediaries.
• Crypto-Specific: For >10% NAV exposure, apply for "Other-Other Fund-Crypto-assets" extension (custody, valuation, AML/CFT plans, expertise); notify CSSF for depositary crypto custody; implement heightened AML/CFT due diligence per FATF/Luxembourg assessments.
• Authorisation/Amendments: Submit for CSSF approval on new setups, manager changes, or sub-funds (esp. SICAV multi-sub-funds with EU cross-border services).
• Governance and Reporting: Ensure RC/RR demonstrate crypto risk understanding; update disclosures for investors on risks, LMTs, and fair treatment.
• Ongoing Compliance: Use FAQ/Compilation for RAIFs/SIFs/SICARs/Part II UCIs; auditors/managers confirm tax-exempt status for SICARs.

What changed

• - Authorisation Requirements: UCIs require CSSF approval of constitutive documents (articles, management regulations), depositary selection, and management company/AIFM applications for contractual...
• Crypto-Asset Updates (aligned with separate but related FAQ Version 7): Replaces "virtual assets" with "crypto-assets" per MiCAR (EU 2023/1114); UCITS and retail AIFs (non-well-informed investors)...
• Investment Policies and Liquidity Management: Funds must detail objectives, strategies, asset classes, restrictions, borrowing, and conflicts; look-through for intermediary vehicles per ESMA/AIFMD...
• Risk Spreading Exemptions: Limits do not apply to OECD/EU-guaranteed securities or UCIs with comparable risk-spreading.
• Depositary Role in Crypto: Luxembourg depositaries can custody crypto-assets with safeguards and CSSF notification; responsibility varies by model (depositary or MiCAR provider).