Luxembourg: Banking & Finance (2nd edition)

The In-House Lawyer Logo

This country-specific Q&A provides an overview to banking and finance laws and regulations that may occur in Luxembourg.

This Q&A is part of the global guide to Banking & Finance. For a full list of jurisdictional Q&As visit

  1. What are the national authorities for banking regulation, supervision and resolution in your jurisdiction?

    Under Article 42 of the Luxembourg law of 5 April 1993 on the financial sector, as amended (the "Financial Sector Law"), the national authority responsible for the supervision of banks in Luxembourg is the Commission de Surveillance du Secteur Financier (the "CSSF").

    The CSSF, acting via its resolution council, is also the national resolution authority of Luxembourg (point 4. of Article 59-15 of the Financial Sector Law implementing directive 2014/59/EU of the European Parliament and of the Council of 15 May 2014 establishing a framework for the recovery and resolution of credit institutions and investment firms, the "BRRD").

    Banking regulation in Luxembourg comprises an array of different legislative acts. Apart from the European regulations and various Level 2 and Level 3 European measures, the local legislation is passed by the Luxembourg parliament (Chambre des députés) as laws (lois) and can be accompanied by more granular measures, the grand ducal regulations (règlements grand-ducaux). The CSSF issues regulations (règlement de la CSSF) and guidance, the latter often in the form of circulars (circulaires).

  2. Which type of activities trigger the requirement of a banking license?

    The activity of receiving deposits (and other reimbursable funds) from the public and of granting loans on one's own account triggers the requirement to obtain a banking license in Luxembourg (Article 2 of the Financial Sector Law). In certain circumstances, lending might not require a specific license.

    Specific rules apply to banks issuing covered bonds.

  3. Does your regulatory regime know different licenses for different banking services?

    Luxembourg law provides for a general banking license, relevant for most banks, and a specific regime applicable to banks issuing covered bonds. It also provides for separate licenses allowing to exercise various activities of the financial sector and/or the activities ancillary to the financial sector activities (professionnel du secteur financier, the "PSF"). These are divided into three groups:

    • investment firm licenses, which include, amongst others, the licenses of: (a) investment adviser; (ii) brokers in financial instruments; (iii) commission agents; and (iv) private portfolio managers;
    • specialised PSF licenses, which include, amongst others, the licenses of domiciliation agents and family offices; and
    • support PSF licenses for the provision of administrative and technical support to financial insti-tutions.
  4. Does a banking license automatically permit certain other activities, e.g., broker dealer activities, payment services, issuance of e-money?

    The banking license referred to above is broad and allows a credit institution to carry out, among others, the following activities (apart from the core bank activity i.e. accepting deposits and lending) (Article 3(7) of the Financial Sector Law):

    • the provision of payment services within the meaning of Article 1(38) of the Law of 10 November 2009 on payment services;
    • trading for one's own account or for the account of customers in: (a) money-market instruments (cheques, bills, certificates of deposit, etc.); (b) foreign exchange market; (c) financial futures and options; (d) exchange and interest-rate instruments; and (e) transferable securities;
    • money broking;
    • portfolio management and advice;
    • issuance of e-money;
    • investment services and activities listed in part A of Annex II to the Financial Sector Law; and
    • ancillary services listed in part C of Annex II to the Financial Sector Law.
  5. Is there a “sandbox” or “license light” for specific activities?


  6. Are there specific restrictions with respect to the issuance or custody of crypto currencies, such as a regulatory or voluntary moratorium?

    There is no specific legal framework governing virtual currencies and initial coin offerings (the "ICOs") in Luxembourg. On 14 March 2018, the CSSF issued two warnings on risks related to cryptocurrencies and ICOs, recommending the investors to be prudent in their acquisitions of virtual currencies and setting out the risks associated with these.

  7. What is the general application process for bank licenses and what is the average timing?

    To obtain an authorization to operate in Luxembourg, a credit institution has to submit to the CSSF an application complying with the Financial Sector Law, including various requirements regarding capital structure, shareholding structure, transparency and management. The authori-zation is granted by the Minister of Finance after the review of the application by the CSSF. In practice, this might take between 12 to 18 months, if no specific issues are raised.

  8. Is mere cross-border activity permissible? If yes, what are the requirements?

    Article 30 of the Financial Sector Law allows credit institutions authorized in a Member State other than Luxembourg to exercise their activities in Luxembourg through the freedom to provide services pursuant to the Treaty on the functioning of the European Union, to the extent that the activities carried out in Luxembourg are covered by the bank's authorization in its home Member State and subject to the notification to the CSSF.

    As far as third country credit institutions are concerned, they are in principle required to establish a branch in Luxembourg (Article 32 of the Financial Sector Law). Nonetheless, the mere existence of Luxembourg-based clients or, as the case may be, "occasional" marketing trips to Luxembourg do not, as such, suffice to trigger the requirement to obtain an authorization to provide financial services in Luxembourg.

  9. What legal entities can operate as banks? What legal forms are generally used to operate as banks?

    A banking license may only be granted to a legal person incorporated under the Luxembourg law in the form of a public law institution, a société anonyme (a public limited liability company), a société en commandite par actions (a partnership limited by shares) or a société coopérative (a cooperative).

  10. What are the organizational requirements for banks, including with respect to corporate governance?

    The CSSF provides extensive guidance on the organisational requirements for banks, in particular in its circulaire 12/552, as amended from time to time.

    The principal organisational requirements are (but are not limited to) the following:

    • the central administration (i.e. the decision-taking and administrative centre) and the registered office of the bank must be located in Luxembourg;
    • the board of directors and the authorised management of the bank must pass the "fit and prop-er" test and be approved by the CSSF;
    • the bank shall produce evidence that it has a sound administrative and accounting organisation and adequate internal control procedures in Luxembourg and shall put the following functions in place: (i) an accounting function; (ii) a risk management function; (iii) a compliance function; (iv) an IT function; and (v) an internal audit function.

    Certain additional specific organisational and governance requirements apply to the CRR investment firms (please see the answer to Question 11 below) and to the banks and investment firms providing investment services regulated by directive 2014/65/EU of the European Parliament and of the Council of 15 May 2014 on markets in financial instruments ("MiFID II"), as implemented into Luxembourg law.

  11. Do any restrictions on remuneration policies apply?

    Yes. The remuneration restrictions applicable in Luxembourg stem from directive 2013/36/EU of the European Parliament and of the Council of 26 June 2013 on access to the activity of credit institutions and the prudential supervision of credit institutions and investment firms ("CRD IV"), as transposed into Luxembourg law by way of an amendment to the Financial Sector Law (Articles 38 to 38-12 thereof).

    The restrictions in question are applicable to credit institutions and investment incorporated under Luxembourg law and the Luxembourg branches of third-country CRR institutions firms (the "CRR institutions", an each a "CRR institution") and can be summarised as follows:

    • the remuneration policies of CRR institutions have to comply with the principles set out in Article 38-5 of the Financial Sector Law and, including, amongst others, being consistent with and pro-moting sound and effective risk management and not encouraging risk-taking that exceeds the level of tolerated risk of the CRR institution;
    • a clear distinction between fixed and variable remuneration is made, and the ratios between the two are clarified (Article 38-6 of the Financial Sector Law), in particular: (i) a bonus cap must not exceed 100% of fixed remuneration; and (ii) the shareholders are only allowed to increase the variable part of remuneration to a maximum of 200% of fixed remuneration following a special procedure set out in Article 38-6 of the Financial Sector Law and subject to special notification requirements to the CSSF, as set out in the CSSF's circulaire 15/622.
    • the remuneration policies are supervised by the CSSF.
  12. Has your jurisdiction implemented the Basel III framework with respect to regulatory capital? Are there any major deviations, e.g., with respect to certain categories of banks?

    The rules governing capital adequacy are prescribed by CRD IV (transposed into Luxembourg as part of the Financial Sector Law, please see the answer to Question 11. above) and Regulation (EU) No. 575/2013 of the European Parliament and of the Council of 26 June 2013 on prudential requirements for credit institutions and investment firms (the "CRR Regulation"), the latter being directly applicable in Luxembourg. The discretions left to Member States regarding regulatory capital requirements under the CRR are addressed in CSSF Regulation 18-03 (the "Regulation 18-03").

    In addition to the own funds (capital) regime set out in the CRR Regulation, the capital buffer requirements under CRD IV were implemented into Luxembourg law by way of an amendment of the Financial Sector Law.

    We are not aware of any major deviations from CRR and CRD IV in Luxembourg; it is of note in this respect that the Luxembourg legislator generally tends to closely follow the wording of the implemented EU acts.

  13. Are there any requirements with respect to the leverage ratio?

    The calculation and reporting requirements set out in Article 429 and the following of the CRR Regulation are applicable in Luxembourg.

  14. What liquidity requirements apply? Has your jurisdiction implemented the Basel III liquidity requirements, including regarding LCR and NSFR?

    The liquidity requirements applicable in Luxembourg are those adopted at the European level, i.e. stemming from the CRR Regulation and its implementing/delegated acts.

    Accordingly, the Liquidity Coverage Ratio (the "LCR") requirements applicable in Luxembourg are those set out in Commission Delegated Regulation (EU) 2015/61 of 10 October 2014 supplementing the CRR Regulation with regard to liquidity coverage requirement for credit institutions.

    As far as the Net Stable Funding Ratio (the "NSFR") is concerned, we are not aware of the existence of a finalised definition thereof at the EU-level at this stage. Nonetheless, the EBA monitors the compliance of CRR institutions with the NSFR in accordance with the current Basel III standards.

  15. Do banks have to publish their financial statements? Is there interim reporting and, if so, in which intervals?

    As Luxembourg banks are commercial companies governed by Luxembourg law, they are required to prepare, audit and publish their financial statements in accordance with the general principles of Luxembourg corporate law.

    In addition, and for prudential supervisory purposes, the banks supervised by the CSSF are also required to transmit to the CSSF the data relating to their activities on a monthly, quarterly, half-yearly or annual basis, depending on the subject. In particular, the CSSF's circulaire 15/602 lists the documents to be submitted to the relevant authorities (the ECB in the case of significant credit institutions and the CSSF in other cases) and these include, amongst others, the annual reports.

    The supervisory reporting requirements by credit institutions are regulated by the CRR Regulation as implemented by the Commission Implementing Regulation (EU) No. 680/2014, as amended. Apart from the financial information, the reporting under the CRR Regulation includes own funds requirements (solvency), large exposures, leverage, liquidity, losses stemming from lending collateralized by immoveable property and asset encumbrance.

  16. Does consolidated supervision of a bank exist in your jurisdiction? If so, what are the consequences?

    Yes, Article 49 of the Financial Sector Law provides for the supervision of the CRR institutions on a con-solidated basis. The CSSF exercises its supervision on both stand-alone and a consolidated basis, mostly via periodic reporting by the supervised institutions.

    The rules of the consolidated supervision are set out in the CRR Regulation. The main prudential stand-ards and norms that an institution or a financial holding company at a consolidated level must comply with are the following:

    • consolidated own funds;
    • observance of the consolidated solvency ratios;
    • large exposure limits on a consolidated basis;
    • arrangements concerning exposures to transferred credit risk;
    • consolidated liquidity;
    • consolidated leverage ratio; and
    • the information to be published (Pillar 3).

    One of the consequences of the consolidated supervision in Luxembourg is that the CSSF pays particu-lar attention to the “group head” function exercised by the parent institution.

  17. What reporting and/or approval requirements apply to the acquisition of shareholdings in, or control of, banks?

    As far as the approvals are concerned, the would-be acquirer of a qualifying holding (i.e. any direct or indirect holding which represents 10% or more of the capital or of the voting rights or which makes it possible to exercise a significant influence over the management of the regulated entity) in a credit institution notifies its intention to acquire such holding to the national bank-ing supervisor of the target bank. The national supervisor performs the initial assessment and prepares a draft proposal for the European Central Bank (the "ECB"). In cooperation with the national supervisor, the ECB performs its own assessment and then notifies the proposed ac-quirer and the national supervisor(s) involved about the outcome of the assessment.

    Any change in the shareholding structure, direct or indirect, has to be approved by the CSSF. Under Luxembourg law, any natural or legal person who intends to acquire, directly or indirectly, a qualifying holding (as referred to in the response to Question 17. above) or to further increase, directly or indirectly, such qualifying holding as a result of which the proportion of the voting rights or of the capital held would reach or exceed 20%, 33 1/3% or 50 % or so that the regulated entity would become its subsidiary, is required to first notify in writing such intention to the CSSF, including the size of the intended holding.

  18. Does your regulatory regime impose conditions for eligible owners of banks (e.g., with respect to major participations)?

    Yes, eligibility of shareholders is subject to a suitability assessment of the entire chain of shareholding, the management, the key functions (as listed in the response to Question 10. above), the infrastructure, the business plan, etc.

  19. Are there specific restrictions on foreign shareholdings in banks?


  20. Is there a special regime for domestic and/or globally systemically important banks?

    Yes. Under the Financial Sector Law, the CSSF is responsible for identifying global systemically important institutions (the "G-SIIs") authorized in Luxembourg. As of December 2018, none of the banks authorized in Luxembourg qualified as a G-SII.

    The CSSF's Regulation No. 18-06 identifies eight of Luxembourg’s largest banks as other systemically important institutions (the "O-SIIs"), seven of which are charged with 0.5% O-SII capital buffers and the eighth with a 1% O-SII capital buffer.

  21. What are the sanctions the regulator(s) can order in the case of a violation of banking regulations?

    Under Article 63 of the Financial Sector Law, the CSSF may impose administrative sanctions on banks subject to its supervision for, amongst others, failure to comply with applicable laws (including the CRR Regulation). The administrative sanctions are as follows:

    • a warning;
    • a reprimand;
    • a fine ranging between EUR 250 and EUR 250,000;
    • one or more of the following measures: (a) a temporary or definitive prohibition on the execution of any number of operations or activities, as well as any other restrictions on the activities of the person or entity; (b) a temporary or definitive prohibition on participation in the profession by the de jure or de facto, directors or senior management personnel of persons or entities subject to the supervision of the CSSF.

    Without prejudice to the above, the Financial Sector Law also provides for administrative penalties sanc-tioning breaches of authorisation requirements and the rules on the acquisitions of qualifying holdings, these being, amongst others:

    • in the case of a legal person, administrative pecuniary penalties of up to 10% of the total annual net turnover; and
    • in the case of a natural person, administrative pecuniary penalties of up to EUR 5 million.

    In certain cases, the CSSF can also withdraw the authorisation of the CRR institution. This is the case when, amongst others, (a) a CRR institution has obtained the authorisation through false statements or any other irregular means; or (b) a CRR institution, on becoming aware of any acquisitions or disposals of holdings in their capital that cause holdings to exceed or fall below one of the thresholds referred to in the response to Question 18. above, fails to inform the CSSF thereof.

    Apart from the administrative sanctions referred to above, criminal sanctions are also applicable.

  22. What is the resolution regime for banks?

    The resolution regime for banks in Luxembourg reflects the provisions of the BRRD, as implemented by the law of 18 December 2015 on the resolution, reorganisation and winding up measures of credit institutions and certain investment firms and on deposit guarantee and investor compensation schemes (the "Resolution and Deposit Guarantee Law").

    The BRRD requires an establishment of a resolution authority vested with wide-ranging powers, including the possibility to replace the Financial Institution's management and implement resolution tools. In Luxembourg, the resolution authority is going to take the form of a dedicated compartment of the CSSF called the resolution council (conseil de résolution). The resolution council will be separated from the supervisor with a "Chinese wall", having dedicated resources and an independent director.

    Resolution and Deposit Guarantee Law creates the Luxembourg Resolution Fund (Fonds de résolution Luxembourg, the "FRL"). The fund finances the restructuring of the failing institutions not covered by the Single Resolution Mechanism (please see below) and is funded from the contributions from the financial sector. The daily management of the FRL is entrusted to the CSSF.

    The Resolution Council and the Luxembourg Resolution Fund correspond to the bodies at the EU level - the Single Resolution Board and the Single Resolution Fund. They fall under the Single Resolution Mechanism covering systemically important banks supervised directly by the European Central Bank.

    Resolution planning (Articles 7 to 25 of the Resolution and Deposit Guarantee Law) deals with resolution plans, i.e. the roadmaps to resolve a financial institution in an orderly way, minimising the negative impact on the economy. The planning is directed by the resolution authority, which is exceptional as other-wise it steps in only during the "gone concern" period. While the wording of the Resolution and Deposit Guarantee Law follows closely the BRRD, the two acts differ in terms of structure. Unlike the BRRD, the Resolution and Deposit Guarantee Law has three distinctive parts on resolution planning for individual financial institutions and groups, where either a parent company or a significant branch/subsidiary is based in Luxembourg. Since there is an important number of branches and subsidiaries of foreign financial institutions in Luxembourg, the legislator wished to add transparency to the rules on how resolution authorities from different countries cooperate on resolution planning.

    In parallel to resolution planning, the resolution council has the power to carry out the Resolvability analysis. The purpose is to identify obstacles to resolution and, if needed, remove them e.g. by changing the organisational structure of a financial institution.

    The section on Objectives, Conditions and General Principles of Resolution follows closely the BRRD and applies to both individual institutions and groups. Accordingly, the objectives of resolution are micro and macro-economic, i.e. to protect both individual depositors and overall financial stability in order to prevent taxpayer bail-outs and runs on banks. The conditions triggering resolution are related to the state of the balance sheet of the financial institution as well as the need for exceptional public aid. Lastly, the general principles of resolution govern the order of loss-bearing (shareholders first, followed by creditors), the power of the resolution council to replace the institution's management and the "no creditor worse off" principle, affirming the protection of guaranteed depositors at the level equal, if not high-er, to standard insolvency proceedings.

    Resolution instruments represent the core of the resolution provisions of the BRRD and are closely transposed in the Articles 38 to 56 of the Resolution and Deposit Guarantee Law. The resolution council has the power to use all the following tools without shareholder approval:

    • Private sector sale of the failing financial institution;
    • Bridge bank, whereby core functions of a financial institution are transferred onto a temporary structure, while the remaining part of the bank is wound down;
    • Good bank/bad bank structure, separating healthy and toxic assets in order to wind down the "bad bank" in accordance with a normal insolvency procedure. It is always implemented together with another resolution tool;
    • Bail-in tool, where the institution's capital base is strengthened by wiping out debt and/or converting it to equity. This tool is expected to become the key resolution tool in the future. The rationale is that it should be the creditors and shareholders, not the taxpayer, who bear the cost of resolution.
  23. How are client’s assets and cash deposits protected?

    Apart from the resolution-related provisions of the BRRD (referred to in the answer to Question 22. above), the Resolution and Deposit Guarantee Law implements directive 2014/49/EU of the EU Parlia-ment and the Council of 16 April 2014 on deposit guarantee schemes, requiring all deposit-taking banks in the EU to be a member of a national deposit guarantee system.

    The Resolution and Deposit Guarantee Law provides for the Fonds de Garantie des Dépôts Luxembourg (the "FGDL") is a public institution that collects contributions (ex-ante) due from credit institutions, man-ages the collected assets and compensates depositors in case of bank failure (Art. 162(2) of the Resolu-tion and Deposit Guarantee Law).

    FGDL is financed, fully and exclusively, by its member institutions via contributions (held with the BCL). The coverage level is up to EUR 100,000 in aggregate for all deposits of each depositor per credit insti-tution. The coverage level is enhanced up to EUR 2,500,000 in aggregate for all deposits ("temporary high credit balances") resulting from certain life events (such as real estate transactions) of each deposi-tor per credit institution during 12 months as from the date on which the deposits were held with the member institution.

    As far as the financial instruments are concerned (e.g. securities accounts), these are covered by the Système d’indemnisation des investisseurs Luxembourg (the "SIIL"). Customers holding financial instru-ments have a right of restitution in the event of failure of the custodian institution (credit institution or investment firm), if some of these financial instruments are found to have vanished due to e.g. fraud or administrative negligence, up to EUR 20,000 per person and per institution.

  24. Does your jurisdiction know a bail-in tool in bank resolution and which liabilities are covered?

    Yes, the bail-in tool is available in Luxembourg (please see the answer to Question 22. above in this re-spect).

    In principle, all the liabilities of credit institutions and investment firms are covered, except for those for those expressly excluded from the scope of the bail-in tool, being, amongst others:

    • covered deposits;
    • secured liabilities, including covered bonds;
    • liabilities to institutions, excluding entities that are part of the same group, with an original maturi-ty of less than seven days; and
    • employee’ salaries.
  25. Is there a requirement for banks to hold gone concern capital (“TLAC”)?

    No, the total loss absorbing capacity (the "TLAC") is one of the Basel III solutions that has yet to be adopted by the European legislation in the course of the revision of the CRR Regulation. As a consequence, this is not yet applicable in Luxembourg.

  26. In your view, what are the recent trends in bank regulation in your jurisdiction?

    The regulation is likely to follow and adapt to technological innovation and new ways of doing business, such as outsourcing, big data analytics, cloud computing, artificial intelligence and distributed ledger technologies.

    The examples are as follows:

    • the implementation of directive (EU) 2015/2366 of the European Parliament and of the Council of 25 November 2015 on payment services in the internal market ("PSD 2") into Luxembourg law by way of law of 13 June 2017 amending the law of 10 November 2009 on payment services and facilitating the entrance of new, innovative operators into the financial sector;
    • the adoption of law of 27 February 2018 on interchange fees, implementing Regulation (EU) 2015/751 of 29 April 2015 on interchange fees for card-based payment transactions and amend-ing several laws relating to financial services, and capping interchange fees;
    • bill 7363 amending law of 1st August 2001 on the circulation of securities, as amended, was lodged with the Luxembourg parliament; the bill introduces a new article 18Bis allowing account holders to register securities with secure electronic devices such based on the blockchain tech-nology.

    Financial regulation in Luxembourg is also evolving to better accommodate the financing of sustainable solutions. Accordingly, the Financial Sector Law was amended by the law of 22 June 2018 in order to create a legal framework governing renewable energy covered bonds. In this respect, it is of note that the Luxembourg Stock Exchange (LuxSE) is highly focused on the issuance of green bonds and other climate finance instruments.

  27. What do you believe to be the biggest threat to the success of the financial sector in your jurisdiction?

    Macroeconomic risks such as trade wars, potential economic downturn in China, slowing growth of certain major Eurozone players like Germany and Italy and Brexit remain the major threats to Luxembourg's financial sector. At the internal plan, Luxembourg, an AAA-rated country, has shown important resilience during previous financial crisis thanks to a stable economic and political environment.