title: Luxembourg Payments Regulation Monitor | World Payments Monitor canonical: https://payments.gi/jurisdictions/luxembourg/ date_modified: 2026-10-21 publisher: Asymmetric Intelligence # Luxembourg LU schema world-payments-v1 trajectory: not yet assessed Last updated 2026-10-21 · 14 modules · 57 sourced findings · 180 sources in the cumulative register 14 Modules baseline.modules[] 57 Findings modules[].findings[] 94 Tier-1 sources run_metadata.t1_source_count Confidence mix (sums to 14 rendered modules; click to filter) No modules moved this cycle. ** Law made at European Economic Area level** that applies in Luxembourg is covered once, on the [European Economic Area](https://payments.gi/jurisdictions/european-economic-area/) page. This page covers Luxembourg’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief ###### Latest update · 11 October 2026 #### Lead Signal Luxembourg's payments-regulatory posture this cycle is defined by incremental modernisation rather than a single dominant event. The CSSF announced a modernisation of its prudential reporting framework for payment institutions, e-money institutions and crypto-asset service providers, migrating from Excel-based reporting to the eDesk platform. Testing runs from 1 January to 31 March 2027, with mandatory go-live set for 1 April 2027. This is a supervisory-infrastructure change rather than a substantive conduct or licensing-standard shift, but it signals that CSSF's oversight of the non-bank payments sector is moving toward a more standardised, platform-based reporting model. Alongside this, Luxembourg's stablecoin and digital-money landscape continues to consolidate around standing anchors established earlier in the year. Banking Circle SA remains the first Luxembourg institution to hold banking, electronic-money-token issuer, and crypto-asset service provider licences simultaneously, with its CASP authorisation having taken effect 15 April 2026. The CSSF's updated Crypto-assets FAQ for undertakings for collective investment, version 7, dated 4 February 2026, permits indirect crypto-asset exposure of up to 10% of net asset value and electronic-money-token holdings of up to 20% of net assets for subscription and redemption purposes, with alternative investment funds permitted direct or indirect investment. #### Other Developments **The Payconiq-to-Wero migration was reported as underway and nearing completion.** Luxembourg payments users began migrating from the domestic Payconiq wallet to the pan-European, EPI-backed Wero wallet from July 2026, with completion reported as due by September 2026. As at October 2026, no independent confirmation of completion was available; a consumer-facing observation of an absence of Payconiq branding in online-casino payment listings is consistent with, but does not independently confirm, completion of the migration. **Banking Circle's licence trio remains the standing commercial-intelligence anchor for Luxembourg's digital-asset sector.** The CASP authorisation effective 15 April 2026, combined with Banking Circle's existing banking and electronic-money-token issuer licences, continues to represent the most significant Luxembourg-specific commercial milestone in the stablecoin and digital-money space, with no newer commercial event reported this cycle to supersede it. #### Cross-Monitor Connections Banking Circle's licence trio and the CSSF's broader crypto-asset licensing activity intersect with the Financial Integrity Monitor's assessment of the same licensing action from a different lens, where the concentration of banking, e-money-token and crypto-asset activities within a single supervised entity is read for its AML/CTF and sanctions-perimeter implications rather than its market-access and product-innovation implications. No further cross-monitor routing signal was present in this cycle's structured input. #### Outlook The CSSF's eDesk reporting migration, with mandatory go-live on 1 April 2027, will be the clearest near-term indicator of how Luxembourg's non-bank payments supervisory relationship evolves over the coming cycles; testing from January to March 2027 should surface any operational friction ahead of the mandatory deadline. Independent confirmation of the Payconiq-to-Wero migration's completion, reported as due by September 2026 but not yet independently verified as at this cycle, remains an open item worth tracking. The stablecoin and digital-money posture, anchored by Banking Circle's licence trio and the CSSF's permissive UCI crypto-asset exposure limits, appears to have reached a settled standing position for the time being, with no new developments reported this cycle beyond the continuation of these established anchors. _7 earlier updates not shown here._ ###### Standing brief · as of 27 June 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Lead Signal Luxembourg's payments operating environment is converging on a pair of mid-2026 compliance cliffs that materially raise the bar for both bank and non-bank operators. CSSF Circular 26/906, published 20 January 2026 and effective 30 June 2026, consolidates safeguarding into a dedicated chapter 8 with daily reconciliations, strict segregation of client funds, and a mandatory management-body member responsible for safeguarding oversight, alongside a three-lines-of-defence governance model and two authorised managers. Two days later, on 1 July 2026, the MiCAR transitional period for pre-30-December-2024 registered VASPs ends; under the national law of 6 February 2025 the CSSF is the competent authority, and firms must hold full CASP authorisation or cease regulated crypto-asset services. These two forward-dated changes converge to raise the operational and authorisation burden for Luxembourg payment and electronic-money institutions and crypto firms simultaneously. The assessed significance is that this is not an incremental tightening but a structural reset of the conduct and crypto-access baseline. Circular 26/906 also requires the Board to approve and annually review guiding principles for safeguarding of client funds, professional conduct and conflicts of interest, and to designate one member for AML/CFT and one for safeguarding arrangements. The cumulative effect is a fixed senior-management overhead applied to every Luxembourg PI and EMI, layered onto a crypto cohort facing a hard authorisation deadline. For a jurisdiction whose commercial draw rests on EEA passporting, the timing concentrates risk into a single fortnight. #### Other Developments Across the wider module spine the picture is one of a maturing rulebook. DORA entered into force 17 January 2025 and is directly applicable in Luxembourg, with the implementing law published 2 July 2024 designating the CSSF and the Commissariat aux Assurances as competent authorities across five resilience pillars; Circular CSSF 25/893 then extended the DORA classification and reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009, with three-phase reporting through the CSSF eDesk portal. On the corridor side, under Regulation (EU) 2024/886 Luxembourg implemented SCT Inst measures effective 9 October 2025, carrying a EUR 100,000 cap, 24/7 processing within seconds, mandated cost parity with conventional transfers, and the Verification of Payee regime. The commercial-intelligence layer is the most kinetic. A trailing-twelve-month cluster of digital-asset licensing has anchored to Luxembourg: Coinbase obtained its MiCA licence from the CSSF in June 2025 and chose Luxembourg as its European headquarters, while Standard Chartered established a Luxembourg digital-asset custody entity in 2025; Ripple received full EMI authorisation in February 2026 and a preliminary CASP green-light letter on 23 June 2026; and Singapore's dtcpay received a CSSF green-light letter for a Luxembourg EMI licence in July 2025, making Luxembourg its European HQ. Banking Circle separately issues the euro EMT EURI from Luxembourg under CSSF supervision. Deal values across the cluster are not publicly disclosed. Structurally, the litigation surface shifted in February 2025 when the Luxembourg Court of Appeal in chambers declared criminal proceedings against a financial institution inadmissible on non bis in idem grounds, finding a prior final CSSF administrative fine to be criminal in nature given its severity. On consumer protection, the CSSF acts only as a non-binding ADR entity for out-of-court dispute resolution, with no UK-style mandatory APP reimbursement regime. #### Cross-Monitor Connections Two strands carry beyond WPM scope into the Financial Integrity Monitor. The W11 AML/CFT surface is Sentinel-fed: the CSSF is the AML/CFT supervisor with power of injunction over PIs, EMIs, VASPs and banks, and IPR Article 5d requires a shift from transaction-level to daily customer-level sanctions screening from 9 January 2025. The original illicit-finance analysis on these items belongs in FIM, not here. Separately, the MiCAR stablecoin and CASP licensing momentum — Coinbase, Ripple and the Banking Circle EURI EMT — carries sanctions-evasion and illicit-finance use significance that is a FIM matter rather than a WPM payments-instrument conclusion. #### Outlook The near-term watch is the 30 June and 1 July 2026 cliff pair, which will test whether Luxembourg's PI/EMI cohort and transitional VASPs can absorb the combined safeguarding and authorisation burden without attrition. Further out, PSD3/PSR are agreed and expected to be adopted in early 2026 and will require PI/EMI re-authorisation, with the proposed FiDA open-finance regulation expected in 2027 — both forward cost-and-opportunity drivers for open-banking providers. The structural settlement constraint persists beneath all of this: direct access to T2-LU and TIPS in central bank money remains restricted to credit institutions, leaving non-bank PIs and EMIs dependent on bank sponsorship even as the jurisdiction's non-bank cohort expands. The net read is a jurisdiction tightening on safeguarding and crypto transition while continuing to liberalise on digital-asset market access — a deliberate gateway posture rather than a contradiction. trust tier: ai_unverified ###### Latest update · 11 October 2026 #### Regulatory Status Luxembourg's payments-regulatory posture this cycle reflects incremental modernisation rather than a single dominant event. The CSSF announced a modernisation of its prudential reporting framework for payment institutions, e-money institutions and crypto-asset service providers, migrating from Excel-based reporting to the eDesk platform, with testing from 1 January to 31 March 2027 ahead of a mandatory go-live of 1 April 2027. This affects the licensing and market-access supervisory relationship for Luxembourg's non-bank payments population. The jurisdiction's stablecoin and digital-money position remains anchored by Banking Circle SA's combined banking, electronic-money-token issuer, and crypto-asset service provider licences, with CASP authorisation effective 15 April 2026, and by the CSSF's Crypto-assets FAQ for UCIs (version 7, 4 February 2026), which permits UCITS indirect crypto-asset exposure up to 10% of NAV and EMT holdings up to 20% of net assets for subscription/redemption, with AIFs permitted direct or indirect investment. A reported migration of domestic payments users from the Payconiq wallet to the pan-European, EPI-backed Wero wallet began in July 2026, with completion originally due by September 2026; as at October 2026, this completion had not been independently confirmed. #### Outlook The CSSF's eDesk reporting migration, with mandatory go-live 1 April 2027, is the clearest near-term structural indicator for Luxembourg's non-bank payments supervisory relationship. Independent confirmation of the Payconiq-to-Wero migration's completion status remains an open item. Luxembourg's stablecoin and digital-money regulatory position appears settled for the time being, anchored by Banking Circle's licence trio and the CSSF's permissive UCI crypto-asset exposure framework. _3 earlier updates not shown here._ ###### Standing brief · as of 24 August 2026 _Written before the update above. Where they differ, the update is the more recent position._ #### Regulatory Status Luxembourg's payments regulatory environment tightened this cycle across conduct, safeguarding, and operational-resilience dimensions. CSSF Circular 26/906 modernises the safeguarding regime for non-bank payment institutions and electronic-money institutions, introducing daily reconciliation of client funds and a dedicated management-body governance structure ahead of a 30 June 2026 compliance deadline. Contemporaneous CSSF enforcement activity, including a EUR 214,000 fine against Alipay (Europe) SA for AML and sanctions-screening deficiencies, evidences active supervision of the EMI cohort specifically. Separately, the CSSF's July 2026 supervisory communication on frontier-AI cyber risk extends DORA-linked operational-resilience expectations to the full supervised population, and a 26 February 2025 Court of Appeal ruling clarified that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, a structural constraint on double-prosecution exposure for payment and e-money firms. #### Outlook The 30 June 2026 Circular 26/906 compliance deadline is the central near-term marker; whether affected non-bank PIs and EMIs have implemented the required daily reconciliation and governance structures by that date, and whether further CSSF enforcement follows either the safeguarding circular or the frontier-AI supervisory expectations, will shape Luxembourg's payments-regulatory trajectory into the next cycle. 14 of 14 modules Signal Density Selections OR within a group, AND across groups. Press / to search. ### W1a Licensing, Authorisation & Market Access limited signal Confirmed confirmed 2026-06-27 Luxembourg's MiCAR-adjacent payments/crypto perimeter moved from transition to full enforcement this cycle: the EU-wide VASP transition period ended 1 July 2026, after which only CSSF-authorised CASPs may serve customers, and the CSSF migrated crypto-asset white paper notifications to its eDesk platform from 3 August 2026. The underlying PI/EMI authorisation regime under the amended Law of 10 November 2009 (PSL) is unchanged; movement is confined to the MiCAR/CASP layer administered by the same authority. Standing sub-brief · as of 27 June 2026 280 words · last cycle 2026-10-11 #### Licensing, Authorisation & Market Access Luxembourg's payments market-access gateway runs through the CSSF. Under PSL Articles 6 and 24-2, no person established in Luxembourg may provide payment services or issue e-money without written CSSF authorisation as a Payment Institution (PI) or Electronic Money Institution (EMI); AISP activity requires CSSF registration under Article 48-1a, with Article 3 limited-network exclusions subject to notification. This is the core licensing gateway for the jurisdiction and the structural distinction that separates non-bank PIs and EMIs from bank-PSPs at the point of authorisation. Minimum capital under the PSL is EUR 20,000-125,000 for a Payment Institution depending on the type of payment services, and EUR 350,000 for an Electronic Money Institution, with ongoing own-funds requirements. These tiered capital floors are a primary cost determinant in the choice of authorisation route and jurisdiction for new entrants. The commercial draw of the route is EEA passporting on notification: a CSSF authorisation confers cross-border reach across the European Economic Area, which is the primary post-Brexit attraction for inbound non-bank operators. The baseline is currently stable but with a forward-dated qualifier. PSD3/PSR are agreed and expected to be adopted in early 2026 and will require PI/EMI re-authorisation, which will reopen the authorisation perimeter for the existing non-bank cohort rather than merely adjust conduct rules. #### Outlook The licensing gateway itself is settled, but the PSD3/PSR re-authorisation cycle is the dominant forward variable for W1a. Operators authorised under the current PSL framework should expect a re-authorisation pathway once PSD3/PSR are adopted; the non-bank PI/EMI cohort carries the heaviest re-papering exposure, while bank-PSPs already authorised as credit institutions face a lighter incremental burden. The trajectory is established with escalation latent in the adoption timeline. Periodic update · new data 2026-10-11 #### Licensing, Authorisation & Market Access The CSSF announced a modernisation of its prudential reporting framework applicable to payment institutions, e-money institutions and crypto-asset service providers, moving from Excel-based reporting submissions to the eDesk digital platform. This change was announced 10 September 2026. A testing window runs from 1 January to 31 March 2027, ahead of a mandatory go-live date of 1 April 2027 for all affected licence-holders. This is a supervisory-infrastructure development rather than a change to licensing criteria, capital requirements, or authorisation standards themselves. It affects how non-bank payment institutions and e-money institutions, together with crypto-asset service providers now brought within the same reporting infrastructure, submit prudential data to the CSSF on an ongoing basis. The practical effect for licensed entities is a transition period during which reporting teams will need to adapt internal processes to the new eDesk platform ahead of the April 2027 mandatory deadline, with the three-month testing window intended to surface implementation issues before that deadline takes effect. The grouping of PIs, EMIs and CASPs together under a single modernised reporting framework is itself notable: it indicates that the CSSF's supervisory technology build-out is treating the non-bank payments and crypto-asset licensing populations as a single reporting cohort, rather than maintaining entirely separate reporting infrastructures for traditional payment institutions versus crypto-asset service providers. This reflects the broader convergence of these licensing categories that is also visible in Banking Circle's combined banking, EMT-issuer and CASP licensing position, discussed under the stablecoin module. No other licensing or market-access developments specific to Luxembourg's payment institution or e-money institution population were identified this cycle. The reporting-modernisation announcement stands as the sole W1a-coded development. #### Outlook The testing window from January to March 2027 will be the key near-term marker for whether the eDesk migration proceeds smoothly ahead of the mandatory 1 April 2027 go-live. Licensed PIs, EMIs and CASPs operating in Luxembourg should expect further CSSF guidance or technical specifications for the eDesk platform to emerge as the testing window approaches, though no such guidance was identified in this cycle's structured input. Whether the modernised reporting framework surfaces any substantive change in CSSF's prudential expectations, beyond the reporting mechanism itself, remains to be seen in subsequent cycles. **6 earlier distinct update(s)** Periodic update · new data 2026-09-28 #### Licensing, Authorisation & Market Access CSSF Circular 26/906 is the defining licensing and authorisation development in Luxembourg this cycle. It consolidates central administration, internal governance and risk-management requirements applicable to payment institutions, e-money institutions and account information service providers into a single instrument, repealing four prior circulars: IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155. Compliance with the consolidated framework is required by 30 June 2026, giving affected institutions a defined runway to align internal governance structures. This is a nonbank-focused instrument; it applies specifically to the PI/EMI/AISP population supervised by the CSSF, distinct from the prudential framework applicable to credit institutions. Separately, and with lower confidence, Paytm Europe Payments S.A. is reported to have incorporated in Luxembourg in January 2026 and received a CSSF payment-institution licence, with a listing on the CSSF's official PI register. This claim was sourced from a lower-tier aggregator rather than confirmed directly against the CSSF register this cycle, and is treated as uncertain pending independent verification. If accurate, it would represent continued market entry into Luxembourg's payment-institution licensing regime by an internationally-recognised payments brand. #### Outlook The 30 June 2026 compliance deadline for Circular 26/906 is the immediate date to watch for the PI/EMI/AISP population. Independent confirmation of Paytm Europe Payments' licensing status against the CSSF's public register would also be a useful verification point for market-entry tracking. Periodic update · new data 2026-09-21 #### Licensing, Authorisation & Market Access CSSF Circular 26/906, published 20 January 2026 and applicable from 30 June 2026, represents a comprehensive overhaul of the central-administration, internal-governance and risk-management framework applicable to Luxembourg payment institutions, electronic-money institutions and account-information service providers. The circular requires robust internal governance arrangements and effective processes to identify, manage, monitor and report risks, requirements the circular sets out for firms that fall within its scope, and it requires annual signed management-body compliance attestations along with a minimum of two Authorised Managers per institution. The circular repeals and amends multiple legacy texts, consolidating what had previously been a more fragmented governance framework into a single reference instrument. The distinction that matters most for market participants is the one between banks and non-bank payment institutions and e-money institutions: this circular targets the non-bank population specifically, meaning PIs, EMIs and AISPs are now being brought toward governance standards that more closely resemble those already expected of credit institutions, while the bank sector's own governance framework is untouched by this instrument. Transfer pricing has also become an explicit regulatory obligation for payment and e-money institutions under the circular, a dimension of the overhaul that extends beyond pure governance into intra-group commercial-arrangement documentation. For market entrants and existing licence holders, the practical consequence is a materially higher bar for demonstrating governance adequacy ahead of the 30 June 2026 applicability date, with the two-Authorised-Manager minimum and the annual attestation requirement both functioning as concrete, auditable compliance checkpoints rather than general principles alone. #### Outlook The 30 June 2026 applicability date is the immediate compliance-calendar milestone for all Luxembourg PIs, EMIs and AISPs. Firms that have not yet appointed a second Authorised Manager or established the annual attestation process face a compressed implementation window. Beyond this cycle, PSD3's eventual adoption and Luxembourg's transposition of it will determine whether Circular 26/906's governance framework is absorbed into, or sits alongside, any new EU-level authorisation requirements. Periodic update · new data 2026-09-14 #### Licensing, Authorisation & Market Access Luxembourg's payments licensing environment underwent two parallel movements this cycle: a governance-rules overhaul for the existing non-bank payment-institution population, and a cluster of new authorisations concentrating digital-asset-payments activity under the CSSF. The CSSF published Circular 26/906, effective 30 June 2026, establishing unified central-administration, internal-governance and risk-management rules applicable to payment institutions, e-money institutions and account-information service providers alike. The circular formalises a three-lines-of-defence governance model, daily client-fund reconciliation requirements, and annual compliance attestations. This carries the non-bank PI/EMI distinction directly: these rules apply specifically to the non-bank payment-institution and e-money-institution population, a distinct supervisory track from bank-based payment-services provision. This finding is Probable in confidence, sourced from a single reference the interpreter has flagged with a tier-derivation note (T4 nominal, T3 derived), and would benefit from independent corroboration against the CSSF's own circular text in a future cycle. Against that governance backdrop, three notable authorisation events landed this cycle. Ripple secured full electronic-money-institution authorisation from the CSSF on 2 February 2026, following a preliminary approval announced 14 January 2026, and went on to obtain full CASP authorisation under MiCA on 6 July 2026 (preliminary Green Light Letter 23 June 2026), enabling EU/EEA-wide passporting from its Luxembourg base -- a Confirmed finding. Coinbase Luxembourg SA was separately authorised as an electronic money institution by the CSSF on 5 March 2026, covering credit transfers, standing orders, and e-money issuance, distribution and refund, extending its existing 2025 MiCA CASP authorisation into conventional payments activity -- also Confirmed. And B2C2 Europe S.à r.l. obtained MiCA CASP authorisation from the CSSF on 13 May 2026, becoming the first Global OTC Liquidity Provider so authorised, building on its 2024 VASP registration -- a Probable finding. Taken together, these three authorisations mean Luxembourg's non-bank PI/EMI licensing population now includes a materially larger cohort of crypto-native firms holding dual EMI and CASP status, a market-access pattern distinct from the traditional fintech-EMI population the Circular 26/906 governance rules were presumably designed around. #### Outlook The item to watch is whether CSSF applies Circular 26/906's governance requirements -- particularly the daily reconciliation and three-lines-of-defence standards -- uniformly across this newly-authorised crypto-native EMI/CASP cohort, or issues calibrated guidance recognising the different operational profile of dual-licensed firms. Periodic update · new data 2026-09-08 #### Licensing, Authorisation & Market Access Luxembourg's MiCAR-adjacent crypto-asset perimeter moved from transition to full enforcement this cycle. The EU-wide MiCA transition period for virtual asset service providers ended on 1 July 2026, after which unauthorised providers may no longer onboard EU customers or offer new crypto-asset services without CASP authorisation from the CSSF. From 3 August 2026 the CSSF migrated the notification procedure for crypto-asset white papers, covering assets other than asset-referenced and e-money tokens, onto its eDesk platform under a dedicated procedure; this digitises an existing MiCAR obligation rather than changing its substance. Against this backdrop the CSSF granted Ripple full MiCA CASP authorisation, completing its Luxembourg regulatory stack alongside the EMI licence it obtained in February 2026, an outcome reported by trade press and corroborated only by a single T3 source in the research pool. The underlying payment-institution and electronic-money authorisation regime under the amended Law of 10 November 2009 is unchanged this cycle; movement is confined to the MiCAR/CASP layer administered by the same authority. #### Outlook The close of the EU-wide VASP transition period, combined with a live CASP-authorisation grant to a significant crypto-payments provider, positions Luxembourg as an early venue for combined CASP-and-EMI licensing structures. Continued CSSF authorisation activity in this channel, and the durability of the eDesk notification migration, are the two threads this module will track into the next cycle. Periodic update · new data 2026-09-05 #### Licensing, Authorisation & Market Access The CSSF fined Alipay (Europe) SA EUR 214,000 following an inspection that identified AML and sanctions-screening deficiencies (low confidence; single tier-4 source, primary CSSF notice not independently retrieved this cycle). This is a dated enforcement entry evidencing continued CSSF licensing-conduct supervision of Luxembourg's EMI cohort. #### Outlook Watch for independent tier-1 corroboration of this fine via the CSSF's own enforcement register, and for whether further EMI-specific enforcement actions accompany the approaching Circular 26/906 safeguarding compliance deadline. Periodic update · new data 2026-08-11 #### Licensing, Authorisation & Market Access CSSF Circular 26/906, published 20 January 2026, overhauls central administration, internal governance, and risk-management rules for payment institutions, e-money institutions, and account-information-service providers, effective 30 June 2026. This is a high-confidence, Tier-3-sourced finding corroborated across two independent legal-commentary outlets. The circular incorporates EBA guidelines on authorisation information for PIs and EMIs and on AISP registration under PSD2 Article 5(5), and its scope extends beyond Luxembourg-headquartered firms to home-member-state PSPs and EMIs and to Luxembourg branches of foreign payment entities, a scope extension with direct relevance for the bank-versus-nonbank distinction in this market: the governance overhaul applies to the nonbank PI/EMI population specifically, not to Luxembourg's banking-licensed payment activity. Separately, PSD3/PSR's formal EU adoption and Official Journal publication is expected around mid-2026, with an approximately 18-month transition placing application in late 2027 or early 2028; the CSSF is reported to be preparing to adapt its licensing and safeguarding regime and to assess overlap between the incoming PSR and DORA, and existing PIs and EMIs are expected to face fresh authorisation processes once PSD3/PSR applies, rather than automatic continuity of existing licences. On market access specifically, Paytm Europe Payments, a One 97 Communications subsidiary incorporated in Luxembourg in January 2026, received a CSSF payment institution licence and was placed on the CSSF's official PI register, a concrete data point for continued nonbank market entry into the jurisdiction. #### Outlook The items to watch are the CSSF Circular 26/906 implementation deadline of 30 June 2026 and the pace of PSD3/PSR's formal adoption, expected around the third quarter of 2026, both of which will determine the shape of authorisation requirements for nonbank PIs and EMIs operating in or through Luxembourg over the next 18 to 24 months. **Sources and findings (4)** 1. T1 [https://www.cssf.lu/en/authorisation-procedure-payment-institution-or-electronic-money-institution-registration-aisp/](https://www.cssf.lu/en/authorisation-procedure-payment-institution-or-electronic-money-institution-registration-aisp/) retrieved 2026-06-27 2. T3 [https://www.luxembourgforfinance.com/publication/electronic-money-and-payment-institutions/](https://www.luxembourgforfinance.com/publication/electronic-money-and-payment-institutions/) retrieved 2026-06-27 3. T3 [https://www.luxembourgforfinance.com/wp-content/uploads/2019/02/LFF_How-to-set-up_Electronic-Money_Payment-Institutions-1.pdf](https://www.luxembourgforfinance.com/wp-content/uploads/2019/02/LFF_How-to-set-up_Electronic-Money_Payment-Institutions-1.pdf) retrieved 2026-06-27 4. T3 [https://practiceguides.chambers.com/practice-guides/banking-regulation-2026/luxembourg/trends-and-developments](https://practiceguides.chambers.com/practice-guides/banking-regulation-2026/luxembourg/trends-and-developments) retrieved 2026-06-27 ### W1b Conduct, Safeguarding & Promotions Confirmed confirmed 2026-06-27 CSSF governance/risk-management convergence for PI/EMI moved into force this cycle: the compliance deadline under Circular CSSF 26/906 (consolidating central administration, internal governance and risk-management requirements) fell due 30 June 2026, and a new circular (CSSF 26/915) extended DORA ICT-resilience expectations explicitly to third-country branches from 27 August 2026. Enforcement activity continued, with a EUR 12,000 administrative fine against an EMI (PingPong Europe S.A.) for AML/CFT professional-obligation breaches published 8 July 2026. Horizon · 2026-06-30 (±quarter) CSSF Circular 26/906 enters into force (safeguarding & governance)_in_force_pending · T1_ Standing sub-brief · as of 27 June 2026 235 words · last cycle 2026-10-04 #### Conduct, Safeguarding & Promotions The live W1b item is CSSF Circular 26/906, published 20 January 2026 and effective 30 June 2026, which consolidates safeguarding into a dedicated chapter 8 with daily reconciliations, strict segregation of client funds, and a mandatory management-body member responsible for safeguarding oversight, alongside a three-lines-of-defence governance model and two authorised managers. This is a material modernisation of the Luxembourg safeguarding regime for non-bank PIs and EMIs, and its daily-reconciliation requirement plus dedicated governance roles raise the operational compliance burden meaningfully. The governance overlay is equally consequential. Circular 26/906 requires the Board to approve and annually review guiding principles for safeguarding of client funds, professional conduct and conflicts of interest, and to designate one member for AML/CFT and one for safeguarding arrangements, with at least two authorised managers. The combination of an annual board attestation and a designated-member structure adds a fixed senior-management overhead to every Luxembourg PI/EMI operation — a cost that falls on the non-bank cohort specifically, since these designation requirements are framed around the PI/EMI governance model rather than the credit-institution one. #### Outlook W1b is escalating. The 30 June 2026 effective date is the proximate event, and the operational question is whether mid-sized PIs and EMIs can stand up daily reconciliation and the new designated-member structure in time. The conduct and safeguarding baseline is now materially heavier than its predecessor, and the trajectory remains escalating into the in-force date. Periodic update · new data 2026-09-28 #### Conduct, Safeguarding & Financial Promotions CSSF Circular 26/906 carries significant conduct and financial-promotions provisions alongside its governance-consolidation function. The circular requires that PIs' and EMIs' central administration and decision-making centres be physically located in Luxembourg, and mandates at least two Authorised Managers permanently on-site, addressing substance-of-presence concerns for nonbank payment entities. On the financial-promotions side, the circular prohibits the use of banking terminology, including terms such as "bank account" or "neo-bank", in PI/EMI marketing materials. This is a direct regulatory intervention into how nonbank payment institutions present themselves to consumers, closing off marketing language that could blur the distinction between licensed credit institutions and nonbank payment institutions in the eyes of retail customers. This conduct-and-marketing provision is corroborated by both the primary circular text and independent practitioner commentary, giving it a high evidentiary basis. It applies specifically to the nonbank PI/EMI population and forms part of the same consolidated framework whose compliance deadline of 30 June 2026 governs the governance provisions addressed under Licensing, Authorisation & Market Access. #### Outlook The 30 June 2026 compliance deadline applies equally to these conduct and marketing-terminology provisions. Enforcement activity, if any emerges, against PIs or EMIs continuing to use prohibited banking terminology in marketing after that date would be a signal worth tracking as an early test of the circular's practical bite. **4 earlier distinct update(s)** Periodic update · new data 2026-09-21 #### Conduct, Safeguarding & Financial Promotions The live conduct-side development this cycle is CSSF Circular 26/906's treatment of client-funds safeguarding for Luxembourg payment institutions and electronic-money institutions. The circular sets out guiding principles for safeguarding that require a designated management-body owner for the safeguarding function, a requirement that becomes applicable from 30 June 2026 alongside the circular's broader governance overhaul. This closes what had previously been, in effect, an accountability gap: safeguarding responsibility is now explicitly assigned at the most senior operational level of the institution rather than left implicit or delegated without a named accountable owner. This safeguarding-ownership requirement should be read as part of the same governance-tightening exercise driving the W1a licensing and market-access changes rather than as a separate conduct initiative; the circular treats governance and safeguarding as interlocking obligations within one consolidated framework. The practical effect for PIs and EMIs is that safeguarding arrangements, previously documented at an operational level, now require explicit sign-off and ownership at management-body level, which raises the evidentiary bar for demonstrating safeguarding adequacy during CSSF supervisory review. #### Outlook As with the broader governance overhaul, 30 June 2026 is the applicability date to track for the safeguarding-ownership requirement. Firms should expect CSSF supervisory attention to focus on whether the named management-body owner for safeguarding has been formally designated and documented ahead of that date, rather than on safeguarding mechanics themselves, which are not reported as having changed substantively this cycle. Periodic update · new data 2026-09-08 #### Conduct, Safeguarding & Financial Promotions Luxembourg's PI/EMI conduct and governance baseline tightened on three fronts this cycle. The compliance deadline for Circular CSSF 26/906, which consolidates central administration, internal governance and risk-management requirements and repeals four legacy circulars, fell due on 30 June 2026; this finding rests on a single primary CSSF source and should be read as provisionally supported pending further corroboration rather than a fully settled shift. A new circular, CSSF 26/915, clarifies that Digital Operational Resilience Act ICT and cyber-resilience requirements apply to third-country branches operating in Luxembourg, expressly naming payment institutions, electronic money institutions and account information service providers within scope, closing a supervisory gap for non-EEA groups' Luxembourg branch operations. Separately, the CSSF imposed a EUR 12,000 administrative fine on PingPong Europe S.A., an electronic money institution, for AML/CFT professional-obligation breaches including a failure to promptly notify Luxembourg's Financial Intelligence Unit of suspicious activity; the fine quantum is modest but the breach category is a recurring supervisory priority, and this account should be read as a supervision-level signal rather than a fully corroborated primary narrative, since it combines a CSSF sanction document with an inferred sector-level framing. Illicit-finance analysis of the PingPong enforcement action itself sits with the Financial Intelligence Monitor rather than this module. #### Outlook Governance convergence under Circular 26/906 and the DORA branch-scope extension under Circular 26/915 both raise the compliance floor for Luxembourg PI/EMI simultaneously, compounding cost for nonbank licence-holders in particular. Continued CSSF enforcement activity against AML/CFT professional obligations is the pattern to watch into the next cycle, alongside confirmation of whether the governance-circular finding strengthens beyond its current single-source support. Periodic update · new data 2026-09-05 #### Conduct, Safeguarding & Financial Promotions CSSF Circular 26/906 represents a structural modernisation of Luxembourg's safeguarding regime for non-bank payment institutions (PIs) and electronic-money institutions (EMIs), and it is the most substantial conduct-and-safeguarding development in this cycle's evidence base (assessed confidence). The circular introduces two linked requirements. First, it mandates daily reconciliation of safeguarded client funds -- an operational-frequency requirement that tightens the cadence at which non-bank PIs and EMIs must verify that client funds held in segregation match their recorded liabilities to customers. Second, it introduces a governance layer: a dedicated management-body member is now required to hold responsibility for safeguarding oversight, a separate dedicated management-body member is required for AML/CFT, and firms must maintain at least two authorised managers operating under a three-lines-of-defence model. Read together, these two requirements bank-proof, in effect, a segment of the payments landscape that operates under a materially different prudential architecture from licensed banks. Non-bank PIs and EMIs do not hold banking licences and are not subject to the same capital-adequacy and liquidity regime as banks; historically, this has meant that safeguarding of client funds, rather than balance-sheet solvency, has been the primary consumer-protection lever for this cohort, and weaknesses in safeguarding practice have been correspondingly harder for a supervisor to detect between periodic reporting cycles than a bank's capital position. Daily reconciliation directly addresses that detection gap by compressing the interval at which a mismatch between held and owed client funds would surface. The governance provisions address the accountability gap: rather than diffuse responsibility for safeguarding compliance, the circular fixes a named accountable individual at management-body level, mirroring the kind of senior-manager accountability regime more commonly associated with prudentially-regulated banks. The three-lines-of-defence model itself deserves note: it is a standard prudential-risk-management structure -- first-line operational controls, second-line risk and compliance oversight, third-line independent audit -- that until now has been more closely associated with credit institutions than with non-bank payment firms in Luxembourg's supervisory practice. Its extension to PIs and EMIs via Circular 26/906 is itself a signal that the CSSF intends non-bank payment firms' internal-control architecture to converge, at least partially, with bank-grade practice, even though the underlying prudential licence and capital regime remains distinct. The circular's effective date, 30 June 2026, gives affected non-bank PIs and EMIs a defined compliance runway, and it is reasonable to read the CSSF's contemporaneous enforcement activity against the EMI cohort -- including the Alipay (Europe) SA fine for AML and sanctions-screening deficiencies -- as part of the same supervisory current. The evidence base for Circular 26/906 itself rests on a single independent source; no second, independently-retrieved tier-1 CSSF-original text of the circular was located this cycle, which is recorded as a gap and should temper confidence in the precise wording of individual provisions even as the overall direction is clear. This safeguarding-and-governance tightening should also be read against a separate but structurally related finding this cycle: a 26 February 2025 ruling of the Luxembourg Court of Appeal holding that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, which forecloses subsequent criminal proceedings against the same firm on the same facts. For non-bank PIs and EMIs newly subject to Circular 26/906's stricter regime, this ruling clarifies that a CSSF administrative sanction for a safeguarding or governance failure would, if final, itself carry criminal-law double-jeopardy protection against a later prosecution on the same underlying facts. #### Outlook The central marker for coming cycles is the 30 June 2026 compliance deadline itself: whether affected non-bank PIs and EMIs have operationalised daily reconciliation and the new management-body roles by that date, and whether the CSSF follows the circular's introduction with either a supervisory review sweep or discrete enforcement action against firms that have not implemented the new governance model. A second-source, tier-1 retrieval of the circular's original text would materially improve confidence in the precise scope of its provisions. Periodic update · new data 2026-08-11 #### Conduct, Safeguarding & Financial Promotions CSSF Circular 26/906 raises the conduct and reporting burden for nonbank payment institutions, e-money institutions, and account-information-service providers materially this cycle. Firms in scope must now submit ICT risk assessments, annual compliance attestations, and compliance and internal-audit summary reports to the CSSF within three months of financial year-end, a new obligation ahead of the circular's 30 June 2026 compliance deadline; this is characterised in the underlying evidence as enhanced ICT-risk and governance reporting rather than a change to the fund-safeguarding mechanism itself. Separately, PSD3/PSR implementation is expected to bring tighter fraud-reporting obligations and stronger reimbursement rights for payment-fraud victims, applying to both banks and payment institutions, an assessed-confidence finding given PSD3/PSR's formal adoption is still pending. Together these two developments describe a conduct environment that is tightening ahead of, and independent of, the still-pending PSD3/PSR transposition: the CSSF is not waiting for the EU-level instrument to raise its own domestic reporting and governance bar for the nonbank PI/EMI population specifically. #### Outlook The 30 June 2026 Circular 26/906 deadline is the immediate compliance-operations item; the PSD3/PSR-driven strengthening of APP-fraud reimbursement rights is the medium-term item to watch as the directive and regulation move toward formal adoption and, later, application in Luxembourg. **Sources and findings (4)** 1. T1 [https://www.cssf.lu/en/2026/01/new-circular-cssf-26-906-central-administration-internal-governance-and-risk-management-applicable-to-payment-and-electronic-money-institutions/](https://www.cssf.lu/en/2026/01/new-circular-cssf-26-906-central-administration-internal-governance-and-risk-management-applicable-to-payment-and-electronic-money-institutions/) retrieved 2026-09-08 2. T3 [https://www.klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-Administration-Internal-Governance-and-Risk-Management-for-Payment-and-E-Money-Institutions-2-26-2026](https://www.klgates.com/Luxembourgs-CSSF-Circular-26/906-on-Central-Administration-Internal-Governance-and-Risk-Management-for-Payment-and-E-Money-Institutions-2-26-2026) retrieved 2026-06-27 3. T3 [https://www.loyensloeff.com/insights/news--events/news/circular-cssf-26906-new-governance-framework-for-payment-institutions-and-electronic-money-institutions/](https://www.loyensloeff.com/insights/news--events/news/circular-cssf-26906-new-governance-framework-for-payment-institutions-and-electronic-money-institutions/) retrieved 2026-06-27 4. T1 [https://www.cssf.lu/wp-content/uploads/cssf18_677_eng.pdf](https://www.cssf.lu/wp-content/uploads/cssf18_677_eng.pdf) retrieved 2026-06-27 ### W2 Stablecoins & Digital Money Confirmed confirmed 2026-06-27 MiCA's national VASP-to-CASP transitional regime for Luxembourg-registered entities ended 1 July 2026; the CSSF is now the licensing/supervisory authority for full CASP authorisation, with first full authorisations (e.g., Ripple) already granted, positioning Luxembourg as an active MiCA licensing hub with EEA-wide passporting. Horizon · 2026-07-01 (±quarter) MiCAR VASP transitional period ends_in_force_pending · T1_ Standing sub-brief · as of 27 June 2026 269 words · last cycle 2026-10-11 #### Stablecoins & Digital Money MiCAR is the governing frame. It entered into force 29 June 2023 and applied to ART/EMT issuers from 30 June 2024 and to CASPs from 30 December 2024; under the national law of 6 February 2025 the CSSF is the competent authority, with an 18-month transition for pre-30-December-2024 registered VASPs ending 1 July 2026. EMTs are issuable only by authorised credit institutions or EMIs, which keeps the issuance gateway tied to the W1a authorisation spine. The 1 July 2026 VASP transition cliff is the forward-dated material change in this module: pre-registered crypto firms must complete full CASP authorisation or exit. The jurisdiction already hosts live issuance. Banking Circle issues the euro EMT EURI from Luxembourg under CSSF supervision, one of roughly a dozen MiCA-authorised EMT issuers across the EU as of Q1 2026. EURI demonstrates Luxembourg's live position as a MiCAR EMT issuance base and anchors stablecoin payment-rail activity in the jurisdiction. The bank-or-non-bank distinction matters here: EURI sits on the non-bank EMI side, while the EMT framework also admits credit-institution issuers. A coverage gap should be flagged: no evidenced Luxembourg-established Asset-Referenced Token (ART) issuer was identified, and W2 coverage is EMT-centric; ART issuance under MiCAR Title III may be present but uncovered. #### Outlook W2 is escalating on the 1 July 2026 transition cliff. The proximate question is attrition — how many transitional VASPs complete CASP authorisation versus ceasing regulated services. EURI issuance and the broader CASP licensing momentum (covered in W13) suggest the jurisdiction is consolidating as an EU stablecoin and crypto-payments base even as the transition deadline forces a clearing event. Trajectory: escalating. Periodic update · new data 2026-10-11 #### Stablecoins & Digital Money Luxembourg's stablecoin and digital-money regulatory position continues to rest on two standing anchors, both confirmed in earlier reporting and unchanged in substance this cycle. Banking Circle SA holds the distinction of being the first Luxembourg institution to combine banking, electronic-money-token issuer, and crypto-asset service provider licences within a single entity, with the CASP authorisation element having taken effect 15 April 2026. This licence trio allows Banking Circle to operate across traditional banking, e-money-token issuance under the Markets in Crypto-Assets framework, and broader crypto-asset service provision, all under one CSSF-supervised structure. Separately, the CSSF's Crypto-assets FAQ for undertakings for collective investment reached its seventh version on 4 February 2026, setting out the regulator's current position on fund-level crypto-asset exposure. Under this FAQ, UCITS funds may hold indirect crypto-asset exposure up to 10% of net asset value, and may hold electronic-money tokens up to 20% of net assets specifically for subscription and redemption purposes. Alternative investment funds are permitted to invest in crypto-assets either directly or indirectly, a materially more permissive position than that available to UCITS. Together, these two anchors describe a Luxembourg digital-money environment in which both the service-provider side, through licensed entities like Banking Circle, and the fund-investment side, through the CSSF's FAQ-based guidance for UCIs, have reached a relatively settled regulatory position. Neither element changed substantively this cycle; both are carried forward as the standing module position for Luxembourg's stablecoin and digital-money regulatory architecture. No new stablecoin-specific enforcement action, licensing refusal, or regulatory guidance update was identified for Luxembourg this cycle beyond the continuation of these two standing positions. #### Outlook The stability of Luxembourg's stablecoin and digital-money position this cycle suggests the jurisdiction has reached a settled regulatory posture following the MiCA/VASP transition period that closed mid-2026. Future cycles should watch for whether other Luxembourg institutions pursue a licensing strategy similar to Banking Circle's combined banking, EMT-issuer and CASP model, and whether the CSSF updates its UCI Crypto-assets FAQ beyond version 7 as fund-level demand for crypto-asset exposure evolves. **Sources and findings (4)** 1. T1 [https://www.cssf.lu/en/markets-in-crypto-assets-mica-micar/](https://www.cssf.lu/en/markets-in-crypto-assets-mica-micar/) retrieved 2026-06-27 2. T1 [https://www.cssf.lu/en/issuers-of-asset-referenced-tokens-arts/](https://www.cssf.lu/en/issuers-of-asset-referenced-tokens-arts/) retrieved 2026-06-27 3. T3 [https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers](https://eco.com/support/en/articles/15192006-mica-compliant-stablecoins-2026-full-list-with-issuers) retrieved 2026-06-27 4. T3 [https://coinlaw.io/what-is-mica-regulation/](https://coinlaw.io/what-is-mica-regulation/) retrieved 2026-06-27 ### W3 Operational Resilience & Critical Infrastructure Confirmed confirmed 2026-06-27 Operational resilience is governed by DORA (Regulation (EU) 2022/2554), directly applicable since 17 January 2025, with the Luxembourg implementing law published 2 July 2024 designating the CSSF and CAA as competent authorities. The CSSF issued Circulars 25/880–25/883 (April 2025) and 25/892–25/893 (2025) operationalising ICT risk management and a DORA-aligned major-incident classification and reporting framework that also captures non-DORA PSPs via Article 105-2 PSL. Incident reporting runs through the CSSF eDesk portal in three phases under strict RTS time limits. Kept on Dataprotection.gi, not restated here: data and cloud switching obligations on service providers, including notice periods and charges. [Open this jurisdiction's page on Dataprotection.gi →](https://dataprotection.gi/jurisdictions/luxembourg/) Standing sub-brief · as of 27 June 2026 227 words · last cycle 2026-10-04 #### Operational Resilience & Critical Infrastructure DORA (Regulation (EU) 2022/2554) entered into force 17 January 2025 and is directly applicable in Luxembourg; the implementing law published 2 July 2024 designates the CSSF and the Commissariat aux Assurances as competent authorities across five resilience pillars. DORA is now live and imposes ICT resilience and third-party oversight obligations across all Luxembourg PSPs, applying to both bank-PSPs and non-bank PIs/EMIs as a substantial operational and vendor-management cost driver. The operational detail sits in the incident-reporting layer. Circular CSSF 25/893 sets the practical modalities for DORA entities reporting major ICT incidents and significant cyber threats and extends the DORA classification/reporting framework to PSPs outside DORA scope via Article 105-2 of the Law of 10 November 2009, with three-phase reporting (initial, intermediate, final) via the CSSF eDesk portal. The extension to non-DORA PSPs is the analytically important move: it widens the compliance perimeter to smaller Luxembourg payment operators that might otherwise have sat outside the DORA scope. #### Outlook W3 is established rather than escalating — DORA is in force and the incident-reporting circular operationalises it. The forward watch is supervisory practice: how the CSSF exercises its incident-classification and third-party oversight powers in the first full year, and whether smaller non-DORA PSPs absorb the extended reporting obligation without friction. Trajectory: established, with the escalation in this module already realised through the 25/893 perimeter extension. Periodic update · new data 2026-09-28 #### Operational Resilience & Critical Infrastructure Luxembourg's transposition of CRD VI, via the Law of 5 May 2026, introduces a new standalone prudential category requiring CSSF-supervised credit institutions to identify, assess, manage and mitigate crypto-asset risk. This is distinct from conduct-level crypto-asset licensing requirements applicable to crypto-asset service providers; it operates at the level of bank prudential risk management, requiring credit institutions with crypto-asset exposure, whether direct holdings, custody arrangements, or counterparty exposure, to build this into their formal risk-management frameworks. The same transposition act introduces a new third-country-branch authorisation requirement under Articles 32-2/32-3 of the Law on the Financial Sector, which begins phasing in from 11 January 2027. This requirement specifically affects non-EEA banks operating branches in Luxembourg, adding a formal authorisation layer to what may previously have been a lighter-touch branch-establishment regime, and reflects the broader post-Brexit and post-CRD-VI trend toward more explicit supervisory control over third-country banking presence within the EU. Both provisions are sourced from specialist law-firm commentary on a confirmed transposition act rather than the primary legislative text itself, but the underlying transposition act's existence and effective date are treated as confirmed. #### Outlook The 11 January 2027 phase-in date for the third-country-branch authorisation requirement is the key date to watch, alongside any CSSF supervisory guidance clarifying how credit institutions should structure crypto-asset risk assessment under the new standalone prudential category. **2 earlier distinct update(s)** Periodic update · new data 2026-09-08 #### Operational Resilience & Critical Infrastructure Circular CSSF 26/915 extends Digital Operational Resilience Act ICT and cyber-resilience expectations explicitly to third-country branches operating in Luxembourg, closing a supervisory gap that had left non-EEA payment and e-money groups' branch operations without an explicit DORA hook. This finding is the same underlying circular already addressed under conduct and governance; it is carried here because it bears directly on operational-resilience posture for cross-border branch structures. #### Outlook Whether CSSF issues further sector guidance operationalising the third-country-branch DORA scope, and whether any non-EEA groups restructure their Luxembourg presence in response, are the questions to track into the next cycle. Periodic update · new data 2026-09-05 #### Operational Resilience & Critical Infrastructure The CSSF issued a July 2026 supervisory communication directing management bodies to establish governance structures for AI-enabled cyber risk consistent with existing DORA ICT risk-management requirements, referencing recent ESRB (7 July 2026) and FSB (10 June 2026) publications on frontier AI (high confidence; primary CSSF source). #### Outlook Watch for whether this expectation-setting communication is followed by a formal DORA-linked supervisory review or rulemaking specific to payment and e-money firms. **Sources and findings (4)** 1. T3 [https://www.globalcompliancenews.com/2025/04/23/https-insightplus-bakermckenzie-com-bm-banking-finance_1-luxembourg-cssf-aligns-with-dora-key-updates-on-ict-and-outsourcing-regulations_04172025/](https://www.globalcompliancenews.com/2025/04/23/https-insightplus-bakermckenzie-com-bm-banking-finance_1-luxembourg-cssf-aligns-with-dora-key-updates-on-ict-and-outsourcing-regulations_04172025/) retrieved 2026-06-27 2. T1 [https://www.cssf.lu/en/2025/05/publication-of-two-new-circulars-ict-related-incident-classification-and-reporting-for-dora-entities-and-other-payment-service-providers-and-adoption-of-esa-guidelines-on-the-estimation-of-aggregated/](https://www.cssf.lu/en/2025/05/publication-of-two-new-circulars-ict-related-incident-classification-and-reporting-for-dora-entities-and-other-payment-service-providers-and-adoption-of-esa-guidelines-on-the-estimation-of-aggregated/) retrieved 2026-06-27 3. T3 [https://www.grantthornton.lu/en/insights/important-regulatory-update-from-the-cssf-stay-informed-and-supported/](https://www.grantthornton.lu/en/insights/important-regulatory-update-from-the-cssf-stay-informed-and-supported/) retrieved 2026-06-27 4. T1 [https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/](https://www.cssf.lu/en/ict-and-cyber-risk-for-dora-entities/) retrieved 2026-06-27 ### W4 Scheme & Network Compliance Confirmed confirmed 2026-06-27 Card-scheme compliance in Luxembourg is governed by the EU Interchange Fee Regulation (Regulation (EU) 2015/751), which caps interchange and prohibits territorial/scheme-processing discrimination, with member states designating competent authorities. PCI DSS applies to acquirers/processors (e.g. Worldline PCI-certified gateways). Instant-rail scheme rules follow the EPC SCT Inst rulebook and the Verification of Payee scheme. The IFR requires scheme/processing separation overseen via a Government Expert Group. Standing sub-brief · as of 27 June 2026 150 words · last cycle 2026-10-04 #### Scheme & Network Compliance The Interchange Fee Regulation (Regulation (EU) 2015/751) governs card-scheme compliance in Luxembourg. It prohibits honour-all-cards rules beyond same-brand/category exceptions, bans territorial discrimination in processing, requires scheme/processing interoperability, and obliges member states to designate competent enforcement authorities. The IFR's interchange caps and scheme/processing separation shape card economics and acceptance costs for Luxembourg merchants and acquirers, and the regime applies across both bank and non-bank acquirers. This is a stable module. The IFR framework is settled and there is no forward-dated rule change registered for the card-scheme layer in this cycle; the substantive card-acceptance and acquiring dynamics are carried in W8. #### Outlook W4 trajectory is stable. The interchange-cap and scheme/processing-separation framework is in force and unchanged, with PCI DSS and 3DS-SCA applied as the operational scheme-compliance baseline. No proximate change is flagged; the module functions as standing infrastructure against which the more kinetic acquiring and corridor modules operate. Periodic update · new data 2026-09-28 #### Scheme & Network Compliance Luxembourg's implementing bill for Regulation (EU) 2024/886, the Instant Payments Regulation, requires PSPs that offer regular euro credit transfers to also offer instant euro transfers, covering both sending and receiving, by 9 April 2027. Critically, the instant transfer offering must be priced at no higher charge than standard, non-instant transfers, removing the pricing differential that has historically discouraged instant-transfer adoption. This is a scheme-and-network-level obligation applying across the payments industry in Luxembourg, distinct from the institution-specific governance and prudential obligations addressed elsewhere this cycle. This development is corroborated by specialist law-firm commentary interpreting a confirmed EU-level instrument, giving reasonable confidence in the substance of the obligation, though the precise Luxembourg-specific implementing bill text was not independently retrieved this cycle. #### Outlook The 9 April 2027 deadline for mandatory instant euro transfer offering at parity pricing is the key date to track. In the intervening period, watch for any CSSF or industry guidance on operational readiness for 24/7 instant transfer processing across Luxembourg's payment-services industry. **Sources and findings (4)** 1. T1 [https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32015R0751) retrieved 2026-06-27 2. T1 [https://www.ecb.europa.eu/paym/retail/sepa/html/index.en.html](https://www.ecb.europa.eu/paym/retail/sepa/html/index.en.html) retrieved 2026-06-27 3. T1 [https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf](https://competition-policy.ec.europa.eu/system/files/2021-10/IFR_report_card_payment.pdf) retrieved 2026-06-27 4. T3 [https://worldline.com/en-lu/home/main-navigation/solutions/merchants/acquiring](https://worldline.com/en-lu/home/main-navigation/solutions/merchants/acquiring) retrieved 2026-06-27 ### W5 Payment Corridor Dynamics limited signal Confirmed confirmed 2026-06-27 Luxembourg's principal corridors are euro-denominated and intra-SEPA, dominated by cross-border-worker remittance and B2B financial-services flows with France and Germany, plus a large-value EUR-GBP corridor with the UK. Cross-border rails are SCT/SCT Inst (SEPA), settled via TARGET (T2/TIPS) and EBA Clearing's STEP2/RT1. The Instant Payments Regulation (EU) 2024/886 mandates SCT Inst with cost parity (effective for outgoing transfers from 9 October 2025) and Verification of Payee. Non-SEPA corridors require correspondent banking and FX bridging. Standing sub-brief · as of 27 June 2026 192 words · last cycle 2026-09-21 #### Payment Corridor Dynamics The defining corridor development is the Instant Payments Regulation. Under Regulation (EU) 2024/886, Luxembourg implemented SCT Inst measures effective from 9 October 2025, with a EUR 100,000 cap, 24/7 processing within seconds, mandated cost parity with conventional transfers, and the Verification of Payee regime for pre-execution alerts. The cost-parity mandate is the commercially significant element: it removes the instant-payment premium and reshapes A2A payment economics and revenue for Luxembourg PSPs, applying to both bank and non-bank providers. The corridor structure around Luxembourg is dominated by intra-SEPA euro flows. The LU-FR and LU-DE corridors are stable euro-denominated intra-SEPA channels settled via TARGET and TIPS, with the IPR cost-parity mandate now applying. The LU-UK corridor is frictional, requiring EUR-GBP conversion via correspondent banks post-Brexit, and is further complicated by the 31 December 2025 acquiring re-contracting cliff carried in W8. #### Outlook W5 is established. The IPR SCT Inst obligation is in force and settled via TIPS in central bank money (see W12). The forward watch is competitive: cost parity compresses instant-payment margins, and the Verification of Payee regime shifts fraud-prevention cost onto PSPs. The LU-UK corridor remains the friction point. Trajectory: established. Periodic update · new data 2026-09-21 #### Payment Corridor Dynamics Luxembourg's non-bank payment sector faces a staggered compliance calendar under the EU Instant Payments Regulation. Payment institutions and electronic-money institutions must comply with send/receive obligations by 9 April 2027, a deadline that falls materially later than the equivalent bank-sector deadlines, which had already passed in 2025. This gap means that, for roughly two years, Luxembourg's instant-payments corridor dynamics will be shaped by a two-speed compliance landscape: banks fully subject to instant-payments send/receive obligations, and non-bank PIs/EMIs operating under a longer transition runway before the same obligations bind them. This staggered timeline is a structural feature of the Instant Payments Regulation's own phasing rather than a Luxembourg-specific policy choice, but its practical corridor-dynamics effect in Luxembourg is that non-bank payment institutions retain a temporary competitive and operational flexibility relative to banks on instant-payments infrastructure investment timing, even as they will eventually need to reach parity by April 2027. #### Outlook The 9 April 2027 deadline is the defining forward milestone for this module. Firms operating in the non-bank payment-institution and e-money-institution space should expect the compliance runway to compress as that date approaches, and the two-year gap relative to the bank sector's already-passed deadlines is likely to remain the defining corridor-dynamics feature until the 2027 deadline is reached. **Sources and findings (4)** 1. T3 [https://www.linari-law.lu/luxembourg-instant-payments-regulation/](https://www.linari-law.lu/luxembourg-instant-payments-regulation/) retrieved 2026-06-27 2. T3 [https://cashmanagement.bnpparibas.com/print/pdf/node/121](https://cashmanagement.bnpparibas.com/print/pdf/node/121) retrieved 2026-06-27 3. T3 [https://www.lightspark.com/knowledge/instant-payments-luxembourg](https://www.lightspark.com/knowledge/instant-payments-luxembourg) retrieved 2026-06-27 4. T1 [https://www.ecb.europa.eu/paym/retail/instant_payments/html/index.en.html](https://www.ecb.europa.eu/paym/retail/instant_payments/html/index.en.html) retrieved 2026-06-27 ### W6 Industry Structure & Commercial Probable confirmed 2026-06-27 Luxembourg is a major EU payments and e-money hub hosting 200+ fintechs, anchored by global e-payment/e-commerce players (PayPal — full banking licence since 2007 — Amazon, Airbnb, Rakuten) licensed/supervised by the CSSF as banks, PIs, EMIs or VASPs. The market mixes large incumbent banks (BCEE/Spuerkeess, BIL, Raiffeisen, BGL BNP Paribas, ING) with a growing non-bank PI/EMI cohort; Brexit drove inbound relocation for EU passporting. The LHoFT public-private platform anchors ecosystem growth. Standing sub-brief · as of 27 June 2026 213 words · last cycle 2026-06-27 #### Industry Structure & Commercial Luxembourg's structural market position rests on a deep fintech and payments cluster. Since PayPal received a Luxembourg banking licence in 2007 the country has grown to over 200 fintechs, with e-payment and e-commerce leaders such as Amazon, PayPal, Airbnb and Rakuten licensed and supervised by the CSSF as banks, PIs, EMIs or VASPs, and Brexit driving inbound UK firms seeking EU passporting. This concentration of global e-payment players and the passporting draw define Luxembourg's competitive position as an EU payments hub. The analytically relevant distinction is that this hub spans both bank-PSP and non-bank PI/EMI/VASP authorisations — the jurisdiction does not specialise in a single licence type but draws operators across the spine. This is a structural market view (distinct from the discrete commercial events carried in W13): the standing dynamic is Brexit-driven inbound relocation rather than any single announced deal. #### Outlook W6 is stable. The hub dynamic — passporting draw, inbound relocation, breadth of licensed operators — is a standing competitive feature rather than a moving target. The forward indicator is whether the mid-2026 safeguarding and MiCAR cliffs dampen inbound momentum or whether the regulated-gateway posture continues to attract operators. Trajectory: stable, with structural M&A trends (as opposed to specific deals) belonging in this module rather than W13. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://practiceguides.chambers.com/practice-guides/fintech-2026/luxembourg](https://practiceguides.chambers.com/practice-guides/fintech-2026/luxembourg) retrieved 2026-06-27 2. T3 [https://www.pwc.lu/en/press/press-releases-2025/pwc-luxembourg-hub-for-corporate-banking.html](https://www.pwc.lu/en/press/press-releases-2025/pwc-luxembourg-hub-for-corporate-banking.html) retrieved 2026-06-27 3. T3 [https://thepaypers.com/payments/news/luxembourg-banks-now-offer-instant-payments-under-a-new-eu-law](https://thepaypers.com/payments/news/luxembourg-banks-now-offer-instant-payments-under-a-new-eu-law) retrieved 2026-06-27 4. T3 [https://www.thetalentroute.com/international-showcase-the-payments-industry-in-luxembourg/](https://www.thetalentroute.com/international-showcase-the-payments-industry-in-luxembourg/) retrieved 2026-06-27 ### W7 Legal & Litigation limited signal Probable confirmed 2026-06-27 Payments-relevant enforcement is driven by CSSF administrative sanctions (warnings, reprimands, fines, occupational bans, generally published) for AML/CFT and prudential breaches, without prejudice to criminal sanctions. A landmark Court of Appeal ruling of 26 February 2025 held criminal proceedings inadmissible following a final CSSF administrative fine on non bis in idem grounds, the CSSF sanction being deemed criminal in nature — a structural constraint on parallel double-prosecution. Historic enforcement includes 16 AML fines in 2021 (EUR 5,000–1,320,000) and a EUR 3m bank fine in 2024. Standing sub-brief · as of 27 June 2026 182 words · last cycle 2026-09-21 #### Legal & Litigation The landmark development is a 26 February 2025 ruling in which the Luxembourg Court of Appeal in chambers declared criminal proceedings against a financial institution inadmissible on non bis in idem grounds, finding the prior final CSSF administrative fine to be criminal in nature given its severity. This is a structural constraint on parallel double-prosecution following CSSF administrative fines, and it caps double-jeopardy exposure for Luxembourg-supervised firms, altering the enforcement-risk calculus where CSSF fines precede criminal action. The ruling applies across the supervised population — both bank-PSPs and non-bank PIs/EMIs — wherever a final CSSF administrative sanction has been imposed. It is an episode rather than a standing rule, but its precedential weight makes it a persistent feature of the enforcement-risk landscape. #### Outlook W7 is established around this single landmark ruling. The forward question is how broadly the non bis in idem principle is applied in subsequent matters — whether the severity-based characterisation of CSSF fines as criminal in nature is followed consistently. For supervised firms, the practical read is reduced parallel-prosecution exposure following final administrative sanctions. Trajectory: established. Periodic update · new data 2026-09-21 #### Legal & Litigation PSD3 and its accompanying Payment Services Regulation remain within the EU legislative pipeline, and no adoption was confirmed this cycle. The working expectation among market participants is that existing Luxembourg payment-institution and electronic-money-institution licences will be grandfathered pending re-authorisation once the package is formally adopted, though the specific mechanics of that grandfathering and re-authorisation process are not yet settled or confirmed. PSD3, once adopted, will require Member State transposition within eighteen months of its entry into force, which sets the outer boundary for when Luxembourg-specific re-authorisation requirements would need to take legal effect domestically. This is a watch-status item rather than a confirmed development: the legislative package's continued pendency means Luxembourg PI and EMI licence holders face forward-looking legal uncertainty about the eventual re-authorisation process, but no concrete transition requirement has yet crystallised into an actionable compliance obligation this cycle. #### Outlook Adoption of PSD3/PSR at the EU level is the trigger event to watch; once adopted, the eighteen-month transposition clock will begin running, and Luxembourg market participants should expect clarity on the specific grandfathering and re-authorisation mechanics to emerge only after that adoption, not before. **2 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Legal & Litigation A structural litigation-surface finding surfaced as backfill this cycle: the Luxembourg Court of Appeal, sitting in chambers, ruled in February 2025 that a prior final CSSF administrative fine was criminal in nature given its severity, barring subsequent criminal proceedings against the same financial institution on non bis in idem grounds. This is a Probable finding, and although it pre-dates this cycle's recency window, it is surfaced here because of its structural significance for how CSSF administrative sanctions interact with Luxembourg's broader criminal-enforcement architecture for payment and banking-sector firms. The practical implication is that a sufficiently severe CSSF administrative fine can now be characterised, at least by this chamber of the Court of Appeal, as criminal in substance rather than purely administrative -- which in turn triggers non bis in idem protection against a subsequent criminal prosecution covering the same underlying conduct. For payment institutions and banks operating under CSSF supervision in Luxembourg, this creates a meaningful boundary question: where CSSF elects to proceed by way of administrative fine, and that fine is severe enough to be characterised as criminal in nature, the door to a later or parallel criminal referral for the same facts may be closed. This is a litigation-surface development with direct relevance to how enforcement strategy is structured by CSSF and by prosecutors going forward, rather than an incident affecting a specific named payment firm this cycle. #### Outlook The item to watch is whether CSSF or Luxembourg prosecutorial authorities adjust their enforcement sequencing in light of this non bis in idem characterisation -- for instance, by front-loading criminal referral ahead of any administrative fine in cases where both routes are contemplated, to avoid this bar arising. Periodic update · new data 2026-09-05 #### Legal & Litigation A 26 February 2025 ruling of the Luxembourg Court of Appeal held that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, rendering subsequent criminal proceedings on the same facts inadmissible (assessed confidence). This is a structural constraint on double-prosecution risk for Luxembourg payment and e-money firms facing both administrative and criminal exposure on the same conduct. #### Outlook Watch for whether this ruling is applied in a subsequent CSSF enforcement matter or cited in future Luxembourg case law on administrative-versus-criminal sanction characterisation. **Sources and findings (3)** 1. T3 [https://www.arendt.com/news-insights/news/landmark-ruling-in-aml-cft-criminal-proceedings-declared-inadmissible-following-cssf-sanction/](https://www.arendt.com/news-insights/news/landmark-ruling-in-aml-cft-criminal-proceedings-declared-inadmissible-following-cssf-sanction/) retrieved 2026-06-27 2. T1 [https://www.cssf.lu/en/anti-money-laundering-and-countering-the-financing-of-terrorism/](https://www.cssf.lu/en/anti-money-laundering-and-countering-the-financing-of-terrorism/) retrieved 2026-06-27 3. T3 [https://www.loyensloeff.com/aml---luxembourg---mondaq-comparative-guide.pdf](https://www.loyensloeff.com/aml---luxembourg---mondaq-comparative-guide.pdf) retrieved 2026-06-27 ### W8 Merchant Acquiring & Risk Probable confirmed 2026-06-27 Merchant acquiring in Luxembourg is led by Worldline (which acquired SIX Payment Services in 2018-19, taking the No.1 commercial-acquiring position in Luxembourg). Acquirers operate standard scheme economics (interchange + scheme fee + merchant service charge), 3DS/SCA, chargeback/dispute handling with pre-chargeback alerts, merchant risk onboarding (1–5 day assessments), and rolling reserves for higher-risk merchants. A specialist high-risk acquiring segment (crypto, iGaming, forex) uses enhanced fraud filters and reserves. Post-Brexit, from 31 December 2025 EU merchants cannot use UK-based acquirers and vice versa. Horizon · 2025-12-31 (±quarter) UK/EU cross-border acquiring re-contracting deadline_in_force_pending · T3_ Standing sub-brief · as of 27 June 2026 207 words · last cycle 2026-06-27 #### Merchant Acquiring & Risk The acquiring market is concentrated. Worldline's acquisition of SIX Payment Services gave it the No.1 commercial-acquiring market position in Luxembourg, SIX being one of the largest non-bank commercial acquirers in Continental Europe servicing roughly 210,000 merchants; Worldline Luxembourg supports 3DS/SCA, PSD2 exemptions, chargeback handling and reserves for higher-risk merchants. Worldline's dominance, on the non-bank acquirer side, defines the Luxembourg acquiring landscape and merchant-pricing structure for card acceptance. The discrete forward event is a Brexit re-contracting cliff. From 31 December 2025, as a result of Brexit regulatory change, no EU-based merchant can use a UK-based acquirer and no UK merchant a non-UK acquirer, forcing re-contracting of cross-border acquiring relationships. This is a single-vendor-sourced, assessed-confidence claim, and it should be read with that caveat: no regulatory primary source corroborating the cross-border acquiring prohibition was registered, and merchant-acquiring operational detail rests on a single Worldline source set. #### Outlook W8 is stable on structure but carries a near-term episode. The 31 December 2025 acquiring re-contracting deadline compels Luxembourg merchants and acquirers to re-paper cross-border UK/EU relationships — a discrete operational dislocation rather than a structural shift. Confidence on that cliff is held at assessed pending primary corroboration. Trajectory: stable, with the re-contracting event as the proximate watch. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T3 [https://worldline.com/en/home/top-navigation/media-relations/financial-press-releases/2018/worldline-to-acquire-six-payment-services](https://worldline.com/en/home/top-navigation/media-relations/financial-press-releases/2018/worldline-to-acquire-six-payment-services) retrieved 2026-06-27 2. T3 [https://worldline.com/en-lu/home/main-navigation/solutions/merchants/acquiring](https://worldline.com/en-lu/home/main-navigation/solutions/merchants/acquiring) retrieved 2026-06-27 3. T3 [https://www.lightspark.com/knowledge/instant-payments-luxembourg](https://www.lightspark.com/knowledge/instant-payments-luxembourg) retrieved 2026-06-27 4. T3 [https://worldline.com/en-gb/merchant-services-uk](https://worldline.com/en-gb/merchant-services-uk) retrieved 2026-06-27 ### W9 Product Innovation & Market Development limited signal Probable confirmed 2026-06-27 Luxembourg's CSSF published its first FAQ on fund tokenisation on 2026-10-02, confirming that Luxembourg-domiciled investment funds (UCIs) may issue units/shares natively on a distributed ledger, in token form only, while the legal form of the security (registered or dematerialised) is unaffected. Horizon · 2026-H1 (±half_year) PSD3/PSR adoption (EU)_proposed · T3_ Horizon · 2027 (±year) FiDA open-finance regulation (EU)_proposed · T3_ Standing sub-brief · as of 27 June 2026 223 words · last cycle 2026-10-11 #### Product Innovation & Market Development The wholesale-CBDC frontier is live. In the Venus initiative the Banque de France and the Banque centrale du Luxembourg jointly provided experimental CBDC tokens to settle a EUR 100m EIB digital native bond issued under Luxembourg law, demonstrating same-day issuance, distribution and settlement of digital assets in central bank money. Venus positions Luxembourg at the frontier of wholesale-CBDC settlement for tokenised securities and is a forward indicator of settlement-rail innovation; it sits on the bank-PSP / central-bank side of the spine. The forward regulatory pipeline is the other axis. PSD3/PSR (agreed and expected to be adopted in early 2026) aim to reduce barriers for open-banking providers and the proposed FiDA open-finance regulation is expected in 2027; in July 2025 Investre became the first CSSF-authorised Control Agent under Blockchain Law IV. PSD3/PSR re-authorisation and FiDA open-finance expansion are forward cost-and-opportunity drivers for Luxembourg open-banking providers. This module carries the thematic, regulatory product-access view (open banking, BaaS, open finance) — distinct from the discrete product launches in W13. #### Outlook W9 is escalating, driven by the PSD3/PSR adoption timeline and the FiDA 2027 horizon. The near-term watch is whether PSD3/PSR adoption in early 2026 begins the open-banking barrier reduction it targets, and how the first Control Agent authorisation (Investre) signals the maturing of the Blockchain Law IV product layer. Trajectory: escalating. Periodic update · new data 2026-10-11 #### Product Innovation & Market Development Luxembourg's payments-product landscape saw a reported wallet migration this cycle: the transition of domestic Payconiq users to Wero, the pan-European wallet backed by the European Payments Initiative. This migration began in July 2026, with completion originally reported as due by September 2026. As at the time of this cycle's research in October 2026, no independent confirmation that the migration had completed was available. A consumer-facing data point, namely the absence of Payconiq branding in online-casino payment method listings, is consistent with completion having occurred, but this observation does not independently confirm that the underlying migration process is finished across all use cases and merchant integrations. The Payconiq-to-Wero transition is part of a broader pan-European consolidation of instant-payment wallet infrastructure under the EPI umbrella, of which Luxembourg's participation is one national instance. For Luxembourg specifically, the practical product-development question is whether merchant and consumer adoption of Wero has kept pace with the technical migration, a question this cycle's available sourcing does not resolve. No other product-innovation developments specific to Luxembourg's payments market were identified this cycle. #### Outlook Independent confirmation of the Payconiq-to-Wero migration's completion status would materially improve confidence in this finding; the current sourcing permits only an inference from indirect evidence. Subsequent cycles should watch for merchant-facing confirmation, consumer complaint patterns, or CSSF/scheme-level statements that would more directly evidence whether the migration has concluded as originally reported. **1 earlier distinct update(s)** Periodic update · new data 2026-10-04 #### Product Innovation & Market Development The CSSF published Version 1 of its FAQ on tokenisation on 2 October 2026. The document confirms that Luxembourg-domiciled UCIs may issue units or shares natively on a distributed ledger, with the relevant units existing only in token form, and clarifies that issuing in this form does not change the legal form of the security - it remains either registered or dematerialised under existing Luxembourg securities law. The CSSF's own framing is that the document does not constitute a complete guide to tokenisation under Luxembourg law, positioning it as an initial clarification rather than a comprehensive regime. The FAQ additionally addresses outsourcing notice periods applicable to control agents, a role created under the Blockchain Law IV, which is relevant to institutions managing outsourcing arrangements under DORA. A secondary report from ChainCatcher, published the following day, described the same development, characterising the CSSF guidance as confirming funds can issue shares natively on distributed ledgers; this account is consistent with the primary CSSF publication. #### Outlook The FAQ represents an incremental but material step for Luxembourg's standing as a fund-domicile hub, reducing operational friction for native-DLT issuance while leaving underlying securities law unchanged. Because this is the first CSSF statement of its kind, no multi-cycle supervisory record yet exists on how the guidance is applied in practice; whether the CSSF follows with further detail, particularly on the control-agent outsourcing notice-period treatment, is the point to watch. **Sources and findings (4)** 1. T3 [https://www.abbl.lu/luxembourg-banks-join-forces-to-test-the-ecbs-digital-euro-for-financial-markets/](https://www.abbl.lu/luxembourg-banks-join-forces-to-test-the-ecbs-digital-euro-for-financial-markets/) retrieved 2026-06-27 2. T1 [https://www.banque-france.fr/en/press-release/banque-de-france-and-banque-centrale-du-luxembourg-jointly-conducted-successful-wholesale-central](https://www.banque-france.fr/en/press-release/banque-de-france-and-banque-centrale-du-luxembourg-jointly-conducted-successful-wholesale-central) retrieved 2026-06-27 3. T3 [https://funds-europe.com/tokenization-luxembourgs-pivotal-role-in-accelerating-adoption-by-the-european-financial-sector/](https://funds-europe.com/tokenization-luxembourgs-pivotal-role-in-accelerating-adoption-by-the-european-financial-sector/) retrieved 2026-06-27 4. T3 [https://practiceguides.chambers.com/practice-guides/fintech-2026/luxembourg](https://practiceguides.chambers.com/practice-guides/fintech-2026/luxembourg) retrieved 2026-06-27 ### W10 Consumer Protection & APP Fraud Confirmed confirmed 2026-06-27 Consumer protection sits with the CSSF, the competent authority for compliance with financial-consumer-protection laws and the registered ADR entity for out-of-court complaint resolution under CSSF Regulation 16-07 and Circular 17/671 (transposing Directive 2013/11/EU into the Consumer Code). The procedure is free, voluntary, written and non-binding; complaints must first go to the firm's management and reach the CSSF within one year. APP-fraud mitigation in Luxembourg operates via the IPR Verification of Payee (name/IBAN matching) and daily sanctions screening rather than a UK-style mandatory reimbursement regime. Standing sub-brief · as of 27 June 2026 202 words · last cycle 2026-06-27 #### Consumer Protection & APP Fraud Luxembourg's consumer-protection architecture is ADR-centred and non-binding. The CSSF acts as an ADR entity for out-of-court resolution of consumer disputes, registered under Article L.431-1 of the Consumer Code and on the European Commission's ADR list, with a free, voluntary, confidential written procedure; complaints must first go to firm management and reach the CSSF within one year, with non-binding conclusions. Critically, Luxembourg has no UK-style mandatory APP reimbursement regime; it relies instead on the IPR Verification of Payee mechanism and the ADR process. The analytical consequence is a lighter liability exposure for payment firms than the UK PSR framework imposes. The non-binding ADR-only model means Luxembourg-supervised firms — both bank and non-bank — do not carry a mandatory-reimbursement liability for authorised push payment fraud, differentiating their exposure profile materially from UK peers. #### Outlook W10 is stable. The consumer-protection model is settled, and the absence of a mandatory APP reimbursement regime is a standing structural feature rather than a moving variable. The forward watch is whether the IPR Verification of Payee regime (carried in W5) materially reduces APP fraud incidence in the absence of mandatory reimbursement, and whether EU-level pressure pushes Luxembourg toward a heavier consumer-liability model. Trajectory: stable. no periodic updates on record for this sub-brief ** Sources and findings (4)** 1. T1 [https://www.cssf.lu/en/customer-complaints/](https://www.cssf.lu/en/customer-complaints/) retrieved 2026-06-27 2. T1 [https://www.cssf.lu/wp-content/uploads/RCSSF_No16-07eng.pdf](https://www.cssf.lu/wp-content/uploads/RCSSF_No16-07eng.pdf) retrieved 2026-06-27 3. T1 [https://guichet.public.lu/en/citoyens/justice/voies-recours-reglement-litiges/resolution-litige-amiable/resolution-litige-cssf.html](https://guichet.public.lu/en/citoyens/justice/voies-recours-reglement-litiges/resolution-litige-amiable/resolution-litige-cssf.html) retrieved 2026-06-27 4. T3 [https://www.linari-law.lu/luxembourg-instant-payments-regulation/](https://www.linari-law.lu/luxembourg-instant-payments-regulation/) retrieved 2026-06-27 ### W11 AML/CFT & Financial Crime (Sentinel.gi-fed) [Sourced from Sentinel.gi ↗](https://sentinel.gi/jurisdictions/luxembourg/#sec-dom-D7) Probable confirmed 2026-06-27 Sentinel position (payments context only): Luxembourg's AML/CFT framework rests on the Law of 12 November 2004 and CSSF Regulation 12-02, with the CSSF as AML/CFT supervisor for PIs, EMIs, VASPs and banks, and the CRF (FIU) receiving STRs. Online service providers (PIs, EMIs, VASPs, online banks) are major STR filers. The incoming EU AMLR/AMLA regime and IPR Article 5d daily sanctions screening reshape obligations. Carried as Sentinel feed, not original WPM AML analysis. Standing sub-brief · as of 27 June 2026 214 words · last cycle 2026-06-27 #### AML/CFT & Financial Crime This module is sourced from the Sentinel.gi feed and is carried as provenance only; original illicit-finance analysis is routed to the Financial Integrity Monitor (FIM) rather than conducted here. Per the Sentinel feed, the CSSF is the AML/CFT supervisor with power of injunction and broad sanctioning powers over supervised persons including PIs, EMIs, VASPs and banks, with sanctions generally made public and without prejudice to criminal prosecution. The supervisory reach spans both bank-PSPs and non-bank PIs/EMIs/VASPs, framing the financial-crime compliance burden for Luxembourg payment operators. Also per the Sentinel feed, IPR Article 5d (applying from 9 January 2025 to in-scope PSPs including PIs and EMIs) requires a shift from transaction-level to daily customer-level sanctions screening with event-triggered re-screening, sitting alongside the broader Luxembourg AML framework. This shift materially changes screening-system operating requirements for Luxembourg PSPs. The illicit-finance significance of both items is flagged cross-monitor to FIM. A caveat: the Sentinel-carried STR statistics may be dated, and current bank-versus-non-bank supervision-gap analysis is out of WPM scope. #### Outlook W11 is established as a Sentinel-fed surface. The forward watch — daily customer-level sanctions screening adoption under IPR Article 5d and the evolution of CSSF AML sanctioning practice — is carried here as provenance only, with substantive illicit-finance analysis owned by FIM. Trajectory: established. no periodic updates on record for this sub-brief ** Sources and findings (7)** 1. T3 [https://regreportingdesk.com/sepa-instant-payments-regulation/](https://regreportingdesk.com/sepa-instant-payments-regulation/) retrieved 2026-06-27 2. T? FIM (sentinel.gi) per-JID baseline profile — Luxembourg — Luxembourg's AML/CFT regime rests on the 2004 AML/CFT Law as amended to transpose EU AMLD4/5, supervised by the CSSF (financial sector, VASPs) and the CRF-FIU (prosecutor's office). FATF's 2023 MER found a solid technical framework and good financial-intelligence use, but weak domestic ML investigation/prosecution, asset recovery, and non-financial-sector supervision. 3. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-004) — Gap: sourcing-thinness 4. T1 FIM (sentinel.gi) sanctions_change_register (issue FIM-BASE-SANC-001) — Sanctions: EU listing 5. T2 FIM (sentinel.gi) enforcement_action_register (issue FIM-BASE-ENF-003) — Enforcement: Central Bank of the Russian Federation (plaintiff); EU General Court, seated in Luxembourg (adjudicator) — European Council Regulation 2025/2600 (asset-immobilisation/sanctions regime) 6. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-002) — Gap: regulatory-failure 7. T? FIM (sentinel.gi) gaps_register_cumulative (issue FIM-BASE-GAP-001) — Gap: enforcement-absence ### W12 Correspondent Banking, Settlement & Access limited signal Confirmed confirmed 2026-06-27 Settlement access in Luxembourg runs through the Banque centrale du Luxembourg (BCL) as operator of T2-LU (RTGS/CLM, live on the consolidated T2 platform since 20 March 2023), T2S (securities, with LuxCSD/Clearstream as CSDs) and TIPS (instant settlement in central bank money). Direct T2-LU participants are credit institutions; ancillary systems (Clearstream, LuxCSD) participate directly, and intra-day credit is fully collateralised. Cross-border collateral mobilisation uses the Eurosystem Correspondent Central Banking Model (CCBM). High-value euro flows also route via EURO1; non-SEPA flows use correspondent banking and FX. Standing sub-brief · as of 27 June 2026 226 words · last cycle 2026-10-04 #### Correspondent Banking, Settlement & Access The analytical spine of this module is the bank versus non-bank settlement-access asymmetry. Since 20 March 2023 the Banque centrale du Luxembourg operates the new consolidated T2 platform (RTGS and CLM components) for Luxembourg, replacing the former TARGET2 Single Shared Platform, settling retail and interbank, domestic and cross-border euro payments in central bank money; direct T2-LU participants are credit institutions, with cross-border collateral mobilised via CCBM. The decisive point is that direct T2-LU access is limited to credit institutions, which leaves non-bank PIs and EMIs reliant on bank sponsorship for central-bank-money settlement — a structural access constraint that persists despite Luxembourg's strong non-bank cohort. The instant-payment settlement layer carries the same asymmetry. TIPS enables final and irrevocable interbank settlement of instant payments in central bank money 24/7 in the TARGET legal framework, with participants opening a TIPS Dedicated Cash Account linked to a T2 RTGS account. TIPS settlement finality underpins the SCT Inst rollout (W5), but the participation model again routes through credit-institution access. #### Outlook W12 is established and structural. The persistent constraint — direct central-bank-money settlement access restricted to credit institutions — is the standing feature, and it caps the autonomy of the non-bank PI/EMI cohort even as that cohort expands through inbound licensing. The forward watch is any move (regulatory or scheme-level) to widen non-bank settlement access. Trajectory: established. Periodic update · new data 2026-09-28 #### Correspondent Banking, Settlement & Access Luxembourg's correspondent-banking and settlement landscape this cycle is defined by the bank-versus-nonbank access asymmetry that structurally shapes this domain, now sharpened by a specific litigation development. The Bank of Russia filed a claim in a Luxembourg court on 15 September 2026, seeking to protect a Moscow Arbitration Court award against Euroclear over an estimated USD 230 billion in frozen assets. Euroclear's role as a major settlement-infrastructure provider means this litigation, if it proceeds, touches directly on questions of access to and control over settlement infrastructure with cross-border reach well beyond Luxembourg's own payments market. This claim is sourced from a single law-firm commentary piece and has not been independently corroborated against a court filing or Council document this cycle; it is treated as uncertain. The broader analytical significance of any sanctions-architecture dimension to this litigation sits with the financial-integrity monitor; from a correspondent-banking and settlement-access perspective, the relevant fact is that Luxembourg-seated litigation is now directly engaging major settlement infrastructure, a development that merits monitoring regardless of how the underlying sanctions questions resolve. #### Outlook Watch for independent confirmation of the Bank of Russia's Luxembourg court filing, and for any procedural rulings or developments in the case that would clarify its implications for Euroclear-adjacent settlement access. **1 earlier distinct update(s)** Periodic update · new data 2026-09-14 #### Correspondent Banking, Settlement & Access This cycle's relevant finding for correspondent banking and settlement access is structural rather than transactional, and it flows from the same backfilled litigation development covered under Legal & Litigation: the February 2025 Court of Appeal ruling characterising a severe CSSF administrative fine as criminal in nature for non bis in idem purposes. This is a Probable finding. Its relevance to the correspondent-banking and settlement-access module lies in what it signals about the enforcement environment banks operating settlement and correspondent relationships in Luxembourg must navigate: a severe CSSF administrative sanction against a bank now carries the practical weight and legal consequence of a criminal finding, at least for double-jeopardy purposes, which is a materially different enforcement-risk profile than a purely administrative sanction regime would present. This module's analytical spine is ordinarily the bank-versus-non-bank access asymmetry in correspondent banking and settlement arrangements; this cycle's evidence does not extend to fresh material on that asymmetry itself, but the litigation finding is a relevant structural data point for how enforcement risk is allocated across whichever institutions -- bank or non-bank -- hold correspondent or settlement access in Luxembourg. No new correspondent-banking-specific access or de-risking development was identified this cycle beyond this litigation-surface signal. #### Outlook Whether this non bis in idem characterisation is tested again in a subsequent Luxembourg administrative-fine matter involving a bank with correspondent or settlement access responsibilities is the item to watch for this module specifically. **Sources and findings (4)** 1. T1 [https://www.bcl.lu/en/payment-systems/TARGET-Services/target2/index.html](https://www.bcl.lu/en/payment-systems/TARGET-Services/target2/index.html) retrieved 2026-06-27 2. T1 [https://www.bcl.lu/en/payment-systems/TARGET-Services/target2/liens_autres/index.html](https://www.bcl.lu/en/payment-systems/TARGET-Services/target2/liens_autres/index.html) retrieved 2026-06-27 3. T1 [https://www.bcl.lu/en/payment-systems/TARGET-Services/Tips/index.html](https://www.bcl.lu/en/payment-systems/TARGET-Services/Tips/index.html) retrieved 2026-06-27 4. T3 [https://cashmanagement.bnpparibas.com/print/pdf/node/121](https://cashmanagement.bnpparibas.com/print/pdf/node/121) retrieved 2026-06-27 ### W13 Commercial Intelligence (M&A, Investment & Product) limited signal Probable confirmed 2026-06-27 Trailing-12-month commercial activity dominated by digital-asset/payments licensing into the Luxembourg EU gateway: Coinbase MiCA+EU-HQ (Jun 2025); Ripple preliminary EMI (Jan 2026), full EMI (Feb 2026), preliminary CASP (23 Jun 2026); dtcpay CSSF EMI green-light (Jul 2025); Standard Chartered digital-asset custody entity (2025). Deal values undisclosed. Standing sub-brief · as of 27 June 2026 258 words · last cycle 2026-10-11 #### Commercial Intelligence (M&A, Investment & Product) The trailing-twelve-month commercial-event cluster is dominated by digital-asset licensing into the Luxembourg EU gateway. Ripple received full EMI authorisation from the CSSF in February 2026 and a preliminary CASP green-light letter on 23 June 2026; combined, the EMI and CASP permissions would bring Ripple into full MiCA compliance for EEA-wide crypto/stablecoin payments. This is a flagship gateway-licensing event, with the deal value not applicable / not publicly disclosed. Singapore's dtcpay received a CSSF green-light letter for a Luxembourg EMI licence (July 2025), making Luxembourg its European HQ — a market-entry licensing event with value not publicly disclosed. Coinbase obtained its MiCA licence from the CSSF in June 2025 and chose Luxembourg as its new European headquarters, while Standard Chartered established a Luxembourg European entity dedicated to digital-asset custody in 2025; value not publicly disclosed. These are discrete announced events (the W13 frame), distinct from the structural hub view in W6 and the thematic regulatory product-access view in W9. All three principals sit on the non-bank PI/EMI side of the spine. As a D-tier dashboard cluster, these are dated entries rather than standalone explainers, and a gap should be noted: deal values are uniformly undisclosed, so private-company financial signal is under-indexed. #### Outlook W13 is escalating on the digital-asset licensing momentum. The proximate watch is Ripple's progression from preliminary to full CASP authorisation and whether the inbound relocation pattern (Coinbase, dtcpay, Standard Chartered) continues through the mid-2026 MiCAR transition. The cluster reinforces Luxembourg's post-Brexit passporting draw as the EU digital-asset payments gateway. Trajectory: escalating. Periodic update · new data 2026-10-11 #### Commercial Intelligence & Fintech The standing commercial-intelligence milestone for Luxembourg's payments and digital-asset sector remains Banking Circle SA's achievement of a licence trio spanning banking, electronic-money-token issuance, and crypto-asset service provision, with the CASP element of that trio having taken effect 15 April 2026. This is a discrete, completed licensing event rather than an ongoing structural market trend, and it is treated here as a commercial event under this module rather than as the structural market-analysis treatment that would apply under industry-structure framing. No financial terms were disclosed in connection with this licensing action, and no further commercial events, such as new funding rounds, mergers, acquisitions, or product launches involving Luxembourg-domiciled payments or fintech entities, were identified in this cycle's structured input. The regulatory review associated with Banking Circle's CASP authorisation was conducted by the CSSF as sector licensing and is recorded as cleared. No new M&A, investment, or funding-round activity specific to Luxembourg's payments or fintech sector was reported this cycle. #### Outlook Banking Circle's licence trio remains the most significant discrete commercial event on record for Luxembourg's payments and digital-asset sector. Future cycles should watch for whether competing institutions pursue similar combined licensing strategies, and whether any new funding, acquisition, or product-launch activity emerges among Luxembourg's broader fintech and payments population. **2 earlier distinct update(s)** Periodic update · new data 2026-09-08 #### Commercial Intelligence (M&A / Investment / Product) Two Luxembourg-licensed market entrants this cycle underline CSSF's continuing pull as an EEA passporting hub. Paytm Europe Payments S.A., a Luxembourg step-down subsidiary of India's One 97 Communications capitalised with EUR 9 million around 30 June 2026, received a payment institution licence effective 2 July 2026 covering payment-transaction execution and merchant acquiring; the deal value is not applicable, as this is a licence grant rather than a disclosed transaction. Separately, Ripple's full MiCA CASP authorisation, granted alongside its pre-existing EMI licence obtained in February 2026, gives it a combined CASP-and-EMI regulatory base spanning the EEA for crypto-asset and stablecoin payment infrastructure; this is a licensing outcome rather than a disclosed-value commercial transaction, so no amount applies here either. #### Outlook Whether Paytm's entry draws further India-linked or Asia-linked payment institutions toward Luxembourg licensing, and whether rival crypto-infrastructure providers pursue a comparable combined CASP-and-EMI structure, are the developments this module will track into the next cycle. Periodic update · new data 2026-08-11 #### Commercial Intelligence & Fintech Two discrete commercial events mark this cycle for Luxembourg's payments and digital-asset licensing activity. Paytm Europe Payments, a One 97 Communications subsidiary, was incorporated in Luxembourg in January 2026 and received a CSSF payment institution licence, disclosed via regulatory filing; the transaction value is not applicable, as this is a de novo licensing event rather than an investment or acquisition, and no monetary amount was disclosed in connection with the entity formation itself. Separately, Ripple's Luxembourg crypto-asset-service-provider authorisation was upgraded from preliminary to full status on 6 July 2026, a commercial and product-status milestone enabling regulated crypto-payments services across all 30 EEA countries under passporting; no transaction amount is applicable to this authorisation-upgrade event, and none was disclosed. Both events are high-confidence, Tier-3-sourced, and both point in the same direction commercially: Luxembourg continues to attract new payments and crypto-payments entrants and to convert existing entrants from preliminary to fully authorised status, functioning as an active EU licensing venue for both nonbank payment institutions and crypto-asset service providers. #### Outlook Further new-entrant PI/EMI licensing announcements and further conversions from preliminary to full authorisation status, in either the payments or crypto-asset-service-provider population, are the pattern to watch for in assessing whether Luxembourg's commercial attractiveness as a licensing venue is sustained into the next cycle. **Sources and findings (3)** 1. T3 [https://www.electronicpaymentsinternational.com/news/ripple-luxembourg-preliminary-casp-licence/](https://www.electronicpaymentsinternational.com/news/ripple-luxembourg-preliminary-casp-licence/) retrieved 2026-06-27 2. T3 [https://www.fintechfutures.com/blockchain-crypto-digital-assets/dtcpay-receives-green-light-letter-from-cssf-for-luxembourg-emi-licence](https://www.fintechfutures.com/blockchain-crypto-digital-assets/dtcpay-receives-green-light-letter-from-cssf-for-luxembourg-emi-licence) retrieved 2026-06-27 3. T3 [https://funds-europe.com/tokenization-luxembourgs-pivotal-role-in-accelerating-adoption-by-the-european-financial-sector/](https://funds-europe.com/tokenization-luxembourgs-pivotal-role-in-accelerating-adoption-by-the-european-financial-sector/) retrieved 2026-06-27 ** No modules match.** Filters combine as OR inside a group and AND across groups. ## Editorial metadata Provenance only. Nothing below gates publication or affects the render. Editorial metadata for Luxembourg| Field | Value | |---|---| | `trust.lawyer_review.status` | never_reviewed | | `trust.lawyer_review.reviewer` | no reviewer on record | | ` trust.content_source` | ai_generated | ## Provenance and declared absence **Disclosure model:** module cards load OPEN; standing positions render in full; sub-briefs and jurisdiction briefs load as a clamped teaser with an explicit “read full” control carrying the true word count; earlier updates stay collapsed behind a counted summary. No text is hidden without disclosing how much of it there is. **Sentinel-fed modules** receive no special rendering treatment. `sentinel_feed` is an attribution chip only: it does not suppress content, does not generate an absence reason code, and does not exclude the module from any count, filter, search index or export on this page. **Family taxonomy** is renderer-level presentation config, not a JID field. Colour is always duplicated in text and is never the sole carrier of meaning. **Suppressed by doctrine:** derived risk score; per-module RAG traffic light; `derived_scores` = `{"legal_accessibility": {"per_product": {"prepaid_emoney": "licensed-emi"}}}`. **Band honesty:** uncertainty bands are computed against a frozen build clock of 2026-10-21. A year-precision row is never promoted into a tighter band. **Orphan deltas:** 2 cycle_delta row(s) target non-module objects and are listed in the rail rather than attached to a card. **Envelope:** baseline resolved at `jurisdiction_json.baseline`; 14 module(s), 57 finding(s), 180 source(s) in the cumulative register. Think something on this page is wrong? [Report an error](https://payments.gi/legal/#contact).