Luxembourg

Licensing, Authorisation & Market Access

CSSF Circular 26/906 is the defining licensing and authorisation development in Luxembourg this cycle. It consolidates central administration, internal governance and risk-management requirements applicable to payment institutions, e-money institutions and account information service providers into a single instrument, repealing four prior circulars: IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155. Compliance with the consolidated framework is required by 30 June 2026, giving affected institutions a defined runway to align internal governance structures. This is a nonbank-focused instrument; it applies specifically to the PI/EMI/AISP population supervised by the CSSF, distinct from the prudential framework applicable to credit institutions.

Separately, and with lower confidence, Paytm Europe Payments S.A. is reported to have incorporated in Luxembourg in January 2026 and received a CSSF payment-institution licence, with a listing on the CSSF's official PI register. This claim was sourced from a lower-tier aggregator rather than confirmed directly against the CSSF register this cycle, and is treated as uncertain pending independent verification. If accurate, it would represent continued market entry into Luxembourg's payment-institution licensing regime by an internationally-recognised payments brand.

Outlook

The 30 June 2026 compliance deadline for Circular 26/906 is the immediate date to watch for the PI/EMI/AISP population. Independent confirmation of Paytm Europe Payments' licensing status against the CSSF's public register would also be a useful verification point for market-entry tracking.

Licensing, Authorisation & Market Access

CSSF Circular 26/906, published 20 January 2026 and applicable from 30 June 2026, represents a comprehensive overhaul of the central-administration, internal-governance and risk-management framework applicable to Luxembourg payment institutions, electronic-money institutions and account-information service providers. The circular requires robust internal governance arrangements and effective processes to identify, manage, monitor and report risks, requirements the circular sets out for firms that fall within its scope, and it requires annual signed management-body compliance attestations along with a minimum of two Authorised Managers per institution. The circular repeals and amends multiple legacy texts, consolidating what had previously been a more fragmented governance framework into a single reference instrument.

The distinction that matters most for market participants is the one between banks and non-bank payment institutions and e-money institutions: this circular targets the non-bank population specifically, meaning PIs, EMIs and AISPs are now being brought toward governance standards that more closely resemble those already expected of credit institutions, while the bank sector's own governance framework is untouched by this instrument. Transfer pricing has also become an explicit regulatory obligation for payment and e-money institutions under the circular, a dimension of the overhaul that extends beyond pure governance into intra-group commercial-arrangement documentation.

For market entrants and existing licence holders, the practical consequence is a materially higher bar for demonstrating governance adequacy ahead of the 30 June 2026 applicability date, with the two-Authorised-Manager minimum and the annual attestation requirement both functioning as concrete, auditable compliance checkpoints rather than general principles alone.

Outlook

The 30 June 2026 applicability date is the immediate compliance-calendar milestone for all Luxembourg PIs, EMIs and AISPs. Firms that have not yet appointed a second Authorised Manager or established the annual attestation process face a compressed implementation window. Beyond this cycle, PSD3's eventual adoption and Luxembourg's transposition of it will determine whether Circular 26/906's governance framework is absorbed into, or sits alongside, any new EU-level authorisation requirements.

Licensing, Authorisation & Market Access

Luxembourg's payments licensing environment underwent two parallel movements this cycle: a governance-rules overhaul for the existing non-bank payment-institution population, and a cluster of new authorisations concentrating digital-asset-payments activity under the CSSF. The CSSF published Circular 26/906, effective 30 June 2026, establishing unified central-administration, internal-governance and risk-management rules applicable to payment institutions, e-money institutions and account-information service providers alike. The circular formalises a three-lines-of-defence governance model, daily client-fund reconciliation requirements, and annual compliance attestations. This carries the non-bank PI/EMI distinction directly: these rules apply specifically to the non-bank payment-institution and e-money-institution population, a distinct supervisory track from bank-based payment-services provision. This finding is Probable in confidence, sourced from a single reference the interpreter has flagged with a tier-derivation note (T4 nominal, T3 derived), and would benefit from independent corroboration against the CSSF's own circular text in a future cycle.

Against that governance backdrop, three notable authorisation events landed this cycle. Ripple secured full electronic-money-institution authorisation from the CSSF on 2 February 2026, following a preliminary approval announced 14 January 2026, and went on to obtain full CASP authorisation under MiCA on 6 July 2026 (preliminary Green Light Letter 23 June 2026), enabling EU/EEA-wide passporting from its Luxembourg base -- a Confirmed finding. Coinbase Luxembourg SA was separately authorised as an electronic money institution by the CSSF on 5 March 2026, covering credit transfers, standing orders, and e-money issuance, distribution and refund, extending its existing 2025 MiCA CASP authorisation into conventional payments activity -- also Confirmed. And B2C2 Europe S.à r.l. obtained MiCA CASP authorisation from the CSSF on 13 May 2026, becoming the first Global OTC Liquidity Provider so authorised, building on its 2024 VASP registration -- a Probable finding.

Taken together, these three authorisations mean Luxembourg's non-bank PI/EMI licensing population now includes a materially larger cohort of crypto-native firms holding dual EMI and CASP status, a market-access pattern distinct from the traditional fintech-EMI population the Circular 26/906 governance rules were presumably designed around.

Outlook

The item to watch is whether CSSF applies Circular 26/906's governance requirements -- particularly the daily reconciliation and three-lines-of-defence standards -- uniformly across this newly-authorised crypto-native EMI/CASP cohort, or issues calibrated guidance recognising the different operational profile of dual-licensed firms.

Licensing, Authorisation & Market Access

Luxembourg's MiCAR-adjacent crypto-asset perimeter moved from transition to full enforcement this cycle. The EU-wide MiCA transition period for virtual asset service providers ended on 1 July 2026, after which unauthorised providers may no longer onboard EU customers or offer new crypto-asset services without CASP authorisation from the CSSF. From 3 August 2026 the CSSF migrated the notification procedure for crypto-asset white papers, covering assets other than asset-referenced and e-money tokens, onto its eDesk platform under a dedicated procedure; this digitises an existing MiCAR obligation rather than changing its substance. Against this backdrop the CSSF granted Ripple full MiCA CASP authorisation, completing its Luxembourg regulatory stack alongside the EMI licence it obtained in February 2026, an outcome reported by trade press and corroborated only by a single T3 source in the research pool. The underlying payment-institution and electronic-money authorisation regime under the amended Law of 10 November 2009 is unchanged this cycle; movement is confined to the MiCAR/CASP layer administered by the same authority.

Outlook

The close of the EU-wide VASP transition period, combined with a live CASP-authorisation grant to a significant crypto-payments provider, positions Luxembourg as an early venue for combined CASP-and-EMI licensing structures. Continued CSSF authorisation activity in this channel, and the durability of the eDesk notification migration, are the two threads this module will track into the next cycle.

Licensing, Authorisation & Market Access

The CSSF fined Alipay (Europe) SA EUR 214,000 following an inspection that identified AML and sanctions-screening deficiencies (low confidence; single tier-4 source, primary CSSF notice not independently retrieved this cycle). This is a dated enforcement entry evidencing continued CSSF licensing-conduct supervision of Luxembourg's EMI cohort.

Outlook

Watch for independent tier-1 corroboration of this fine via the CSSF's own enforcement register, and for whether further EMI-specific enforcement actions accompany the approaching Circular 26/906 safeguarding compliance deadline.

Licensing, Authorisation & Market Access

CSSF Circular 26/906, published 20 January 2026, overhauls central administration, internal governance, and risk-management rules for payment institutions, e-money institutions, and account-information-service providers, effective 30 June 2026. This is a high-confidence, Tier-3-sourced finding corroborated across two independent legal-commentary outlets. The circular incorporates EBA guidelines on authorisation information for PIs and EMIs and on AISP registration under PSD2 Article 5(5), and its scope extends beyond Luxembourg-headquartered firms to home-member-state PSPs and EMIs and to Luxembourg branches of foreign payment entities, a scope extension with direct relevance for the bank-versus-nonbank distinction in this market: the governance overhaul applies to the nonbank PI/EMI population specifically, not to Luxembourg's banking-licensed payment activity. Separately, PSD3/PSR's formal EU adoption and Official Journal publication is expected around mid-2026, with an approximately 18-month transition placing application in late 2027 or early 2028; the CSSF is reported to be preparing to adapt its licensing and safeguarding regime and to assess overlap between the incoming PSR and DORA, and existing PIs and EMIs are expected to face fresh authorisation processes once PSD3/PSR applies, rather than automatic continuity of existing licences. On market access specifically, Paytm Europe Payments, a One 97 Communications subsidiary incorporated in Luxembourg in January 2026, received a CSSF payment institution licence and was placed on the CSSF's official PI register, a concrete data point for continued nonbank market entry into the jurisdiction.

Outlook

The items to watch are the CSSF Circular 26/906 implementation deadline of 30 June 2026 and the pace of PSD3/PSR's formal adoption, expected around the third quarter of 2026, both of which will determine the shape of authorisation requirements for nonbank PIs and EMIs operating in or through Luxembourg over the next 18 to 24 months.

Conduct, Safeguarding & Financial Promotions

The live conduct-side development this cycle is CSSF Circular 26/906's treatment of client-funds safeguarding for Luxembourg payment institutions and electronic-money institutions. The circular sets out guiding principles for safeguarding that require a designated management-body owner for the safeguarding function, a requirement that becomes applicable from 30 June 2026 alongside the circular's broader governance overhaul. This closes what had previously been, in effect, an accountability gap: safeguarding responsibility is now explicitly assigned at the most senior operational level of the institution rather than left implicit or delegated without a named accountable owner.

This safeguarding-ownership requirement should be read as part of the same governance-tightening exercise driving the W1a licensing and market-access changes rather than as a separate conduct initiative; the circular treats governance and safeguarding as interlocking obligations within one consolidated framework. The practical effect for PIs and EMIs is that safeguarding arrangements, previously documented at an operational level, now require explicit sign-off and ownership at management-body level, which raises the evidentiary bar for demonstrating safeguarding adequacy during CSSF supervisory review.

Outlook

As with the broader governance overhaul, 30 June 2026 is the applicability date to track for the safeguarding-ownership requirement. Firms should expect CSSF supervisory attention to focus on whether the named management-body owner for safeguarding has been formally designated and documented ahead of that date, rather than on safeguarding mechanics themselves, which are not reported as having changed substantively this cycle.

Conduct, Safeguarding & Financial Promotions

Luxembourg's PI/EMI conduct and governance baseline tightened on three fronts this cycle. The compliance deadline for Circular CSSF 26/906, which consolidates central administration, internal governance and risk-management requirements and repeals four legacy circulars, fell due on 30 June 2026; this finding rests on a single primary CSSF source and should be read as provisionally supported pending further corroboration rather than a fully settled shift. A new circular, CSSF 26/915, clarifies that Digital Operational Resilience Act ICT and cyber-resilience requirements apply to third-country branches operating in Luxembourg, expressly naming payment institutions, electronic money institutions and account information service providers within scope, closing a supervisory gap for non-EEA groups' Luxembourg branch operations. Separately, the CSSF imposed a EUR 12,000 administrative fine on PingPong Europe S.A., an electronic money institution, for AML/CFT professional-obligation breaches including a failure to promptly notify Luxembourg's Financial Intelligence Unit of suspicious activity; the fine quantum is modest but the breach category is a recurring supervisory priority, and this account should be read as a supervision-level signal rather than a fully corroborated primary narrative, since it combines a CSSF sanction document with an inferred sector-level framing. Illicit-finance analysis of the PingPong enforcement action itself sits with the Financial Intelligence Monitor rather than this module.

Outlook

Governance convergence under Circular 26/906 and the DORA branch-scope extension under Circular 26/915 both raise the compliance floor for Luxembourg PI/EMI simultaneously, compounding cost for nonbank licence-holders in particular. Continued CSSF enforcement activity against AML/CFT professional obligations is the pattern to watch into the next cycle, alongside confirmation of whether the governance-circular finding strengthens beyond its current single-source support.

Conduct, Safeguarding & Financial Promotions

CSSF Circular 26/906 represents a structural modernisation of Luxembourg's safeguarding regime for non-bank payment institutions (PIs) and electronic-money institutions (EMIs), and it is the most substantial conduct-and-safeguarding development in this cycle's evidence base (assessed confidence). The circular introduces two linked requirements. First, it mandates daily reconciliation of safeguarded client funds -- an operational-frequency requirement that tightens the cadence at which non-bank PIs and EMIs must verify that client funds held in segregation match their recorded liabilities to customers. Second, it introduces a governance layer: a dedicated management-body member is now required to hold responsibility for safeguarding oversight, a separate dedicated management-body member is required for AML/CFT, and firms must maintain at least two authorised managers operating under a three-lines-of-defence model.

Read together, these two requirements bank-proof, in effect, a segment of the payments landscape that operates under a materially different prudential architecture from licensed banks. Non-bank PIs and EMIs do not hold banking licences and are not subject to the same capital-adequacy and liquidity regime as banks; historically, this has meant that safeguarding of client funds, rather than balance-sheet solvency, has been the primary consumer-protection lever for this cohort, and weaknesses in safeguarding practice have been correspondingly harder for a supervisor to detect between periodic reporting cycles than a bank's capital position. Daily reconciliation directly addresses that detection gap by compressing the interval at which a mismatch between held and owed client funds would surface. The governance provisions address the accountability gap: rather than diffuse responsibility for safeguarding compliance, the circular fixes a named accountable individual at management-body level, mirroring the kind of senior-manager accountability regime more commonly associated with prudentially-regulated banks. The three-lines-of-defence model itself deserves note: it is a standard prudential-risk-management structure -- first-line operational controls, second-line risk and compliance oversight, third-line independent audit -- that until now has been more closely associated with credit institutions than with non-bank payment firms in Luxembourg's supervisory practice. Its extension to PIs and EMIs via Circular 26/906 is itself a signal that the CSSF intends non-bank payment firms' internal-control architecture to converge, at least partially, with bank-grade practice, even though the underlying prudential licence and capital regime remains distinct.

The circular's effective date, 30 June 2026, gives affected non-bank PIs and EMIs a defined compliance runway, and it is reasonable to read the CSSF's contemporaneous enforcement activity against the EMI cohort -- including the Alipay (Europe) SA fine for AML and sanctions-screening deficiencies -- as part of the same supervisory current. The evidence base for Circular 26/906 itself rests on a single independent source; no second, independently-retrieved tier-1 CSSF-original text of the circular was located this cycle, which is recorded as a gap and should temper confidence in the precise wording of individual provisions even as the overall direction is clear. This safeguarding-and-governance tightening should also be read against a separate but structurally related finding this cycle: a 26 February 2025 ruling of the Luxembourg Court of Appeal holding that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, which forecloses subsequent criminal proceedings against the same firm on the same facts. For non-bank PIs and EMIs newly subject to Circular 26/906's stricter regime, this ruling clarifies that a CSSF administrative sanction for a safeguarding or governance failure would, if final, itself carry criminal-law double-jeopardy protection against a later prosecution on the same underlying facts.

Outlook

The central marker for coming cycles is the 30 June 2026 compliance deadline itself: whether affected non-bank PIs and EMIs have operationalised daily reconciliation and the new management-body roles by that date, and whether the CSSF follows the circular's introduction with either a supervisory review sweep or discrete enforcement action against firms that have not implemented the new governance model. A second-source, tier-1 retrieval of the circular's original text would materially improve confidence in the precise scope of its provisions.

Conduct, Safeguarding & Financial Promotions

CSSF Circular 26/906 raises the conduct and reporting burden for nonbank payment institutions, e-money institutions, and account-information-service providers materially this cycle. Firms in scope must now submit ICT risk assessments, annual compliance attestations, and compliance and internal-audit summary reports to the CSSF within three months of financial year-end, a new obligation ahead of the circular's 30 June 2026 compliance deadline; this is characterised in the underlying evidence as enhanced ICT-risk and governance reporting rather than a change to the fund-safeguarding mechanism itself. Separately, PSD3/PSR implementation is expected to bring tighter fraud-reporting obligations and stronger reimbursement rights for payment-fraud victims, applying to both banks and payment institutions, an assessed-confidence finding given PSD3/PSR's formal adoption is still pending. Together these two developments describe a conduct environment that is tightening ahead of, and independent of, the still-pending PSD3/PSR transposition: the CSSF is not waiting for the EU-level instrument to raise its own domestic reporting and governance bar for the nonbank PI/EMI population specifically.

Outlook

The 30 June 2026 Circular 26/906 deadline is the immediate compliance-operations item; the PSD3/PSR-driven strengthening of APP-fraud reimbursement rights is the medium-term item to watch as the directive and regulation move toward formal adoption and, later, application in Luxembourg.

Operational Resilience & Critical Infrastructure

Circular CSSF 26/915 extends Digital Operational Resilience Act ICT and cyber-resilience expectations explicitly to third-country branches operating in Luxembourg, closing a supervisory gap that had left non-EEA payment and e-money groups' branch operations without an explicit DORA hook. This finding is the same underlying circular already addressed under conduct and governance; it is carried here because it bears directly on operational-resilience posture for cross-border branch structures.

Outlook

Whether CSSF issues further sector guidance operationalising the third-country-branch DORA scope, and whether any non-EEA groups restructure their Luxembourg presence in response, are the questions to track into the next cycle.

Operational Resilience & Critical Infrastructure

The CSSF issued a July 2026 supervisory communication directing management bodies to establish governance structures for AI-enabled cyber risk consistent with existing DORA ICT risk-management requirements, referencing recent ESRB (7 July 2026) and FSB (10 June 2026) publications on frontier AI (high confidence; primary CSSF source).

Outlook

Watch for whether this expectation-setting communication is followed by a formal DORA-linked supervisory review or rulemaking specific to payment and e-money firms.

Legal & Litigation

A structural litigation-surface finding surfaced as backfill this cycle: the Luxembourg Court of Appeal, sitting in chambers, ruled in February 2025 that a prior final CSSF administrative fine was criminal in nature given its severity, barring subsequent criminal proceedings against the same financial institution on non bis in idem grounds. This is a Probable finding, and although it pre-dates this cycle's recency window, it is surfaced here because of its structural significance for how CSSF administrative sanctions interact with Luxembourg's broader criminal-enforcement architecture for payment and banking-sector firms.

The practical implication is that a sufficiently severe CSSF administrative fine can now be characterised, at least by this chamber of the Court of Appeal, as criminal in substance rather than purely administrative -- which in turn triggers non bis in idem protection against a subsequent criminal prosecution covering the same underlying conduct. For payment institutions and banks operating under CSSF supervision in Luxembourg, this creates a meaningful boundary question: where CSSF elects to proceed by way of administrative fine, and that fine is severe enough to be characterised as criminal in nature, the door to a later or parallel criminal referral for the same facts may be closed. This is a litigation-surface development with direct relevance to how enforcement strategy is structured by CSSF and by prosecutors going forward, rather than an incident affecting a specific named payment firm this cycle.

Outlook

The item to watch is whether CSSF or Luxembourg prosecutorial authorities adjust their enforcement sequencing in light of this non bis in idem characterisation -- for instance, by front-loading criminal referral ahead of any administrative fine in cases where both routes are contemplated, to avoid this bar arising.

Legal & Litigation

A 26 February 2025 ruling of the Luxembourg Court of Appeal held that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, rendering subsequent criminal proceedings on the same facts inadmissible (assessed confidence). This is a structural constraint on double-prosecution risk for Luxembourg payment and e-money firms facing both administrative and criminal exposure on the same conduct.

Outlook

Watch for whether this ruling is applied in a subsequent CSSF enforcement matter or cited in future Luxembourg case law on administrative-versus-criminal sanction characterisation.

Product Innovation & Market Development

The CSSF published Version 1 of its FAQ on tokenisation on 2 October 2026. The document confirms that Luxembourg-domiciled UCIs may issue units or shares natively on a distributed ledger, with the relevant units existing only in token form, and clarifies that issuing in this form does not change the legal form of the security - it remains either registered or dematerialised under existing Luxembourg securities law. The CSSF's own framing is that the document does not constitute a complete guide to tokenisation under Luxembourg law, positioning it as an initial clarification rather than a comprehensive regime.

The FAQ additionally addresses outsourcing notice periods applicable to control agents, a role created under the Blockchain Law IV, which is relevant to institutions managing outsourcing arrangements under DORA. A secondary report from ChainCatcher, published the following day, described the same development, characterising the CSSF guidance as confirming funds can issue shares natively on distributed ledgers; this account is consistent with the primary CSSF publication.

Outlook

The FAQ represents an incremental but material step for Luxembourg's standing as a fund-domicile hub, reducing operational friction for native-DLT issuance while leaving underlying securities law unchanged. Because this is the first CSSF statement of its kind, no multi-cycle supervisory record yet exists on how the guidance is applied in practice; whether the CSSF follows with further detail, particularly on the control-agent outsourcing notice-period treatment, is the point to watch.

Correspondent Banking, Settlement & Access

This cycle's relevant finding for correspondent banking and settlement access is structural rather than transactional, and it flows from the same backfilled litigation development covered under Legal & Litigation: the February 2025 Court of Appeal ruling characterising a severe CSSF administrative fine as criminal in nature for non bis in idem purposes. This is a Probable finding. Its relevance to the correspondent-banking and settlement-access module lies in what it signals about the enforcement environment banks operating settlement and correspondent relationships in Luxembourg must navigate: a severe CSSF administrative sanction against a bank now carries the practical weight and legal consequence of a criminal finding, at least for double-jeopardy purposes, which is a materially different enforcement-risk profile than a purely administrative sanction regime would present.

This module's analytical spine is ordinarily the bank-versus-non-bank access asymmetry in correspondent banking and settlement arrangements; this cycle's evidence does not extend to fresh material on that asymmetry itself, but the litigation finding is a relevant structural data point for how enforcement risk is allocated across whichever institutions -- bank or non-bank -- hold correspondent or settlement access in Luxembourg. No new correspondent-banking-specific access or de-risking development was identified this cycle beyond this litigation-surface signal.

Outlook

Whether this non bis in idem characterisation is tested again in a subsequent Luxembourg administrative-fine matter involving a bank with correspondent or settlement access responsibilities is the item to watch for this module specifically.

Commercial Intelligence (M&A / Investment / Product)

Two Luxembourg-licensed market entrants this cycle underline CSSF's continuing pull as an EEA passporting hub. Paytm Europe Payments S.A., a Luxembourg step-down subsidiary of India's One 97 Communications capitalised with EUR 9 million around 30 June 2026, received a payment institution licence effective 2 July 2026 covering payment-transaction execution and merchant acquiring; the deal value is not applicable, as this is a licence grant rather than a disclosed transaction. Separately, Ripple's full MiCA CASP authorisation, granted alongside its pre-existing EMI licence obtained in February 2026, gives it a combined CASP-and-EMI regulatory base spanning the EEA for crypto-asset and stablecoin payment infrastructure; this is a licensing outcome rather than a disclosed-value commercial transaction, so no amount applies here either.

Outlook

Whether Paytm's entry draws further India-linked or Asia-linked payment institutions toward Luxembourg licensing, and whether rival crypto-infrastructure providers pursue a comparable combined CASP-and-EMI structure, are the developments this module will track into the next cycle.

Commercial Intelligence & Fintech

Two discrete commercial events mark this cycle for Luxembourg's payments and digital-asset licensing activity. Paytm Europe Payments, a One 97 Communications subsidiary, was incorporated in Luxembourg in January 2026 and received a CSSF payment institution licence, disclosed via regulatory filing; the transaction value is not applicable, as this is a de novo licensing event rather than an investment or acquisition, and no monetary amount was disclosed in connection with the entity formation itself. Separately, Ripple's Luxembourg crypto-asset-service-provider authorisation was upgraded from preliminary to full status on 6 July 2026, a commercial and product-status milestone enabling regulated crypto-payments services across all 30 EEA countries under passporting; no transaction amount is applicable to this authorisation-upgrade event, and none was disclosed. Both events are high-confidence, Tier-3-sourced, and both point in the same direction commercially: Luxembourg continues to attract new payments and crypto-payments entrants and to convert existing entrants from preliminary to fully authorised status, functioning as an active EU licensing venue for both nonbank payment institutions and crypto-asset service providers.

Outlook

Further new-entrant PI/EMI licensing announcements and further conversions from preliminary to full authorisation status, in either the payments or crypto-asset-service-provider population, are the pattern to watch for in assessing whether Luxembourg's commercial attractiveness as a licensing venue is sustained into the next cycle.