Luxembourg: Fintech (2nd edition)

The In-House Lawyer Logo

This country-specific Q&A provides an overview of the legal framework and key issues surrounding fintech law in Luxembourg.

This Q&A is part of the global guide to Fintech.

For a full list of jurisdictional Q&As visit http://www.inhouselawyer.co.uk/index.php/practice-areas/fintech-2nd-edition

  1. What are the sources of payments law in your jurisdiction?

    The sources of payments law in Luxembourg include, amongst others, the following:

    • Law of 10 November 2009 on payment services, on the activity of electronic money institution and settlement finality in payment and securities settlement systems, as amended (the "2009 Law");
    • CSSF Circular 19/714 update of CSSF Circular 17/654 on IT outsourcing relying on a cloud computing infrastructure;
    • CSSF Circular 19/713 regarding the guidelines of EBA on the security measures for operational and security risks of payment service providers;
    • CSSF Circular 17/656 regarding administrative and accounting organisation; IT outsourcing, repealing Circular 05/178;
    • Circular CSSF 11/520 that enlists CSSF applicable Circulars specifically to the payment and e-money institutions:
      • Circular IML 95/120 regarding the central administration;
      • Circular IML 96/126 relating to the administrative and accounting organisation;
      • Circular IML 98/143 on internal control (as amended by Circular CSSF 04/155 on the compliance function);
      • Circular CSSF 04/155 on the compliance function;
      • Circular CSSF 05/178 regarding the administrative and accounting organisation and outsourcing of IT services (abrogation of point 4.5.2. of Circular IML 96/126 and replacement by point 4.5.2. of Circular CSSF 05/178);
      • Circular CSSF 06/240 on the administrative and accounting organisation; IT outsourcing and details regarding services provided under the status of support PFS, Articles 29-1, 29-2 and 29-3 of the law of 5 April 1993 on the financial sector, as amended; amendment of IT outsourcing conditions for branches located abroad.
    • The law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (hereafter the "AML Law") and other Luxembourg and EU AML related laws.
  2. Can payment services be provided by non-banks, and if so on what conditions?

    Under the 2009 Law, non-banking institutions in the form of payment institutions and electronic money institutions may provide payment services.

    As per entities incorporated in Luxembourg, the general principle is that no person under Luxembourg law may provide payment services as a payment institution or e-money as an e-money institution without holding a written authorisation by the Minister responsible for the Commission de Surveillance du Secteur Financier ("CSSF"). This means that the prerequisite for companies to provide payment services is to obtain a license from the Ministry of Finance after having been reviewed by the CSSF. The licensing package to be reviewed by the CSSF for that purpose includes, amongst others, the following conditions:

    Legal Form

    Undertakings applying for a payment institution license shall be a legal person incorporated and governed by the law of 10 August 1915 on commercial companies, as amended (the "1915 Law"). Undertakings applying for an e-money license, however, have to be established in the form of a public-law institution, public limited company, a limited partnership with a share capital or a cooperative society under the 1915 Law.

    Initial Capital

    According to the 2009 Law, an initial capital of not less than EUR 350,000 is required for undertakings applying for an e-money license. Undertakings applying for a license as a payment institution are, depending upon the regulatory activity for which they seek to obtain an authorization, required to have an initial capital varying between EUR 20,000 and EUR 125,000.

    Own Funds

    Own funds requirements vary between own funds for obtaining an authorization as a (i) payment institution and (ii) an e-money institution.

    Payment institutions shall have own funds calculated according to the three methods as set out under 2009 Law. The final amount of own funds that a payment institution shall hold is, in fact, a higher number of either initial capital or the amount calculated based on the three calculation methods A, B or C for own funds requirements as described hereafter.

    Under Method A, a payment institution's own funds shall amount to at least 10% of its fixed overheads of the preceding year. The CSSF may adjust this requirement in the event of a material change in a payment institution's business since the preceding year. Where a PI has not completed a full year's business at the date of the calculation, the requirement shall be that its own funds amount to at least 10% of the corresponding fixed overheads as projected in its business plan, unless an adjustment to that plan is required by the CSSF.

    Under Method B, a payment institution's own funds shall amount to at least the sum of the following elements multiplied by the scaling factor k defined below, where payment volume ("PV") represents one twelfth of the total amount of payment transactions executed by the payment institution in the preceding year.

    Multiplication factors are then applied to the slices composing this amount:

    • 4,0% of the slice of PV up to EUR 5 million
    • plus
    • 2.5% of the slice of PV above EUR 5 million up to EUR 10 million
    • plus
    • 1% of the slice of PV above EUR 10 million up to EUR 100 million
    • plus
    • 0.5% of the slice above EUR 100 million up to EUR 250 million
    • plus
    • 0.25% of the slice of PV above EUR 250 million.

    The result of the preceding calculation is multiplied by the scaling factor k according to the services provided by the payment institution:

    • 0.5 where the payment institution provides only the payment service listed in point 6 of the Annex to the Law (money remittance);
    • 0.8 where the payment institution provides the payment service listed in point 7 of the Annex to the Law (Intermediary Execution of Payment Transactions);
    • 1.0 where the payment institution provides any of the payment services listed in points 1 to 5 of the Annex to the Law (i.e. other than money remittance or Intermediary Execution of Payment Transactions).

    In accordance with Method C, the own funds shall amount to at least the relevant indicator defined below, which is affected by the multiplication and scaling factors similarly to method B.

    The applicable indicator corresponds to the sum of the following elements (calculation based on the twelve months of the preceding financial year):

    • interest income;
    • interest expenses;
    • commissions and fees received;
    • other operating income.

    The multiplication factor shall be:

    • 10% of the slice up to EUR 2.5 million;
    • 8% of the slice above EUR 2.5 million up to EUR 5 million;
    • 6% of the slice above EUR 5 million up to EUR 25 million;
    • 3% of the slice above EUR 25 million up to EUR 50 million;
    • 1.5% of the slice above EUR 50 million.

    The result obtained in this manner is multiplied by the same scaling factor as under method B.

    In principle, undertakings may freely choose one of the 3 calculation methods referred in the 2009 Law. However, they must justify their choice according to the risks associated with the contemplated activities and prove that they can apply the chosen method. It shall be noted that the CSSF has the right to refuse the choice of a method where its use does not ensure sufficient own funds with regard to the nature, volume or risks of the payment institution's activities.

    In accordance with Method D, the own funds of an electronic money institution for the activity of issuing electronic money shall amount to at least 2% of the average outstanding electronic money.

    Central administration and infrastructure

    Under the 2009 Law, the authorization of an undertaking as a payment or e-money institution is further conditional upon proving of existence of central administration and registered office in Luxembourg. In practice, this implies that undertakings shall have the necessary and sufficient human and technical resources in Luxembourg to carry out the activities that they wish to perform, such as own execution systems, i.e. procedures and technical infrastructure and its own competent and sufficient personnel to enforce the decisions taken. In particular, undertakings shall ensure that transparent and efficient risk management, adequate internal control mechanisms and sound procedures regarding compliance function, remuneration, internal controls and security of the IT systems are in place.

    Safeguarding of the users' funds

    Both payment as e-money institutions allow two methods to be used for their safeguarding of the users' funds: (i) safeguarding by means of segregation of the received funds (deposits in a separate bank account) and/or (ii) an insurance policy or comparable guarantee from an insurance company or a credit institution covering these funds in the event of the potential financial distress of the payment / e-money institution.

    The choice and/or the eventual change of the method of safeguarding the funds shall be communicated to the CSSF. More significant institutions may, subject to the CSSF approval, opt-in for both regimes.

    Shareholders

    Both undertakings applying for an authorization as a payment institution, as well as, e-money license shall communicate to the CSSF the identity of their direct or indirect shareholders having a qualifying holding stake in the institution (the so-called "fit and proper" requirements).

    Professional standing and experience

    An authorization of an undertaking as a payment or e-money institution in Luxembourg are both subject to the condition that the members of the administrative, management and supervisory bodies produce evidence of their professional standing (honorabilité professionnelle). Such standing is assessed by the CSSF on the basis of criminal records and of any evidence tending to show that the persons concerned are of good repute and are offering a guarantee of irreproachable conduct.

    External review

    In order to be authorized as either a payment or e-money institution, the CSSF requires from an undertaking proof that it will have its financial accounts and where applicable consolidated accounts audited by one or more réviseur d'entreprises agréé (approved statutory auditors).

    CSSF fees

    Finally, the CSSF requires a single lump fee of EUR 15,000 per application of an e-money or a payment institution license, as per the Grand-Ducal Regulation of 1 March 2019 relating to the fees to be levied by the CSSF.

  3. What are the most popular payment methods and payment instruments in your jurisdiction?

    Like in other European countries, credit and debit cards are in Luxembourg a popular form of payment methods for either physical purchases in brick-and-mortar-stores or for online purchases. Furthermore, Luxembourg is amongst the countries with the highest rates of mobile payments. A prominent example in Luxembourg is Digicash /Payconiq. Besides, also foreign players have found their place in Luxembourg, such as Apple Inc. that made since mid-2019 their ApplePay service available in Luxembourg.

  4. What is the status of open banking in your jurisdiction (i.e. access to banks’ transaction data and push-payment functionality by third party service providers)? Is it mandated by law, if so to which entities, and what is state of implementation in practice?

    PSD2 introduced an unprecedented disruption in the financial industry, reducing entry barriers for new players and removing technological barriers by urging banks to allow access to their clients' payment accounts data to authorized third parties.

    Directive 2015/2366/EU ("PSD2") introduced in the 2009 Law strong customer authentication ("SCA") and Third Party Provider ("TPP") access rules allowing for the access to and the use of information on the availability of funds on a payment service user account held with another payment service provider, as well, as two new regulated payment services providers:

    • Account Information Services Providers ("AISP"), which collect and consolidate information on the different bank payments accounts of a payment service user in a single place;
    • Payment Initiation Services Providers ("PISP"), which facilitate internet payments by initiating a payment from the user payment account to the merchant account on the payment services user’s demand.

    The requirements introduced by PSD2 oblige banks to make available (dedicated or "adjusted") interfaces to authorized third parties, i.e. service providers other than banks, that may access customer payment accounts with the customer consent to provide new types of payment services to them. Since its entry into force, clients are able to view all their bank payment accounts in a consolidated manner through their AISPs. In addition to the consultation services of an AISP, customers are able to initiate online payments via PISPs.

    Banks had to provide a test environment of their technical interfaces facilitating data exchange by 14 March 2019, together with documentation to enable third party providers to test the banks’ technical interfaces with anonymized data.

    Furthermore, the deadline to deploy live environment was September 2019. According to their external communication, most major banks operating in Luxembourg implemented these PSD2 requirements timely.

  5. How does the regulation of data in your jurisdiction impact on the provision of financial services to consumers and businesses?

    Luxembourg imposes quite strict rules to financial services providers in terms of professional secrecy. This has some impact on the way how those players can outsource certain activities and processes, even on an intra-group level. Outsourcing to entities (in or outside the group), which are not regulated under Luxembourg financial or insurance legislation, in principle requires the consent of the clients of the outsourcing financial services providers. The same holds true for Luxembourg based payment services providers. Furthermore, these actors must abide by different rules issued by the CSSF which are quite similar to those imposed by the European Banking Authority ("EBA") in its 2019 guidelines on outsourcing arrangements. Specific rules exist in relation to IT outsourcing arrangements based on a cloud infrastructure.

    Furthermore, like in all EU Member states, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") is applicable in Luxembourg.

  6. What are regulators in your jurisdiction doing to encourage innovation in the financial sector? Are there any initiatives such as sandboxes, or special regulatory conditions for fintechs?

    Recently, Luxembourg has taken a number of initiatives to create a favourable environment for fintech start-ups. The Ministry of Economy of Luxembourg together with private partners has, for example, set-up an EUR 20 million Digital Tech Fund that invests, in particular, in cybersecurity, fintech, big data, digital health, media & next-generation communication networks, digital learning, the internet of things, telecommunications and satellite services.

    Furthermore, a public/private sector initiative in the form of a national Fintech innovation hub was launched: the Luxembourg House of Financial Technology (the "LHoFT"). The LHoFT brings together financial institutions, FinTech innovators, research, academia and public authorities to help drive forward the development of (financial) products, which meet specific industry needs. The LHoFT has a strong network with FinTech players around the world, encouraging domestic/international collaborations, working groups and initiatives and offers a tech-friendly base to (non-EU) FinTech players seeking opportunities to explore the European Single Market.

    Commitment from the industry in engaging with the FinTech community is also demonstrated by dedicated working groups initiated by industry associations, such as the Association of the Luxembourg fund industry ("ALFI") and The Luxembourg Bankers’ Association ("ABBL").

    From the regulator's end, the CSSF has not put in place regulatory sandboxes or other equivalent regulatory derogation schemes. The CSSF is, however, very open to discuss complex questions and it has a specific department focusing on innovation and FinTech. It also regularly provides guidance on particular issues, such as its approach towards robo-advice, ICOs, virtual currencies, artificial intelligence and video KYC onboarding (see: http://www.cssf.lu/surveillance/fintech/). At the end of 2018, the CSSF has signed a MoU with the Australian regulator on finTech and RegTech.

  7. Do you foresee any imminent risks to the growth of the fintech market in your jurisdiction?

    For the time being, we do not foresee any imminent risks that would affect the growth of the fintech market in Luxembourg. Local actors are rather optimistic and even consider that Brexit could attract FinTechs currently regulated in the UK that want to maintain their EU passport to provide services on a cross-border basis throughout the EU.

  8. What tax incentives exist in your jurisdiction to encourage fintech investment?

    In general, Luxembourg has a competitive VAT and corporate tax landscape. Furthermore, Luxembourg offers an attractive environment for IP management, including an absence of withholding tax on royalty payments and an extensive network of double tax treaties. To encourage R&D activity, Luxembourg offers an attractive IP tax regime that provides for an 80% on the net income derived from eligible IP assets (principally copyright protected software and patents), as well as, a 100% exemption from net wealth tax.

  9. Which areas of fintech are attracting investment in your jurisdiction, and at what level (Series A, Series B etc)?

    In general, FinTechs that are active in the fund, banking or payment industry are attracting most investments in Luxembourg.

  10. If a fintech entrepreneur was looking for a jurisdiction in which to begin operations, why would it choose yours?

    Luxembourg attracts plenty of leading IT and fintech companies, including Microsoft, Amazon, Rakuten, Ebay, Paypal and Bitstamp. The most important reason for this is that Luxembourg is one of the Eurozone’s leading financial centres and the second largest investment fund centre in the world. Furthermore, Luxembourg is a strategic EU location with easy access to Paris, London, Zürich, Amsterdam, Frankfurt and Brussels and has a highly educated workforce that is used to conduct business in French, German and English. Thus, pragmatism and reactivity of both politics, legislator and financial authorities are usually an overriding factor in the decision of a company to establish in Luxembourg.

  11. Access to talent is often cited as a key issue for fintechs – are there any immigration rules in your jurisdiction which would help or hinder that access, whether in force now or imminently? For instance, are quotas systems/immigration caps in place in your jurisdiction and how are they determined?

    In general, Luxembourg’s workforce is highly educated and skilled as well as diverse. 47% of the population are foreigners and 160,000 people commute daily from Belgium, France and Germany to work in the Grand-Duchy.

    European citizens can reside, move, and work freely throughout the European Union on the basis of the "free movement of persons", whereas third country nationals must apply to the Immigration Directorate of the Ministry of Foreign and European Affairs of Luxembourg for a (temporary) authorization to stay prior to entering Luxembourg. In line with the EU rules in this respect, Luxembourg has favourable immigration and working permit conditions for highly qualified workers and workers in the field of IT even have a more favourable regime.

    To the best of our knowledge, no quotas systems/ immigration caps have been implemented in Luxembourg.

  12. If there are gaps in access to talent, are regulators looking to fill these and if so how? How much impact does the fintech industry have on influencing immigration policy in your jurisdiction?

    See answer to question 11.

  13. What protections can a fintech use in your jurisdiction to protect its intellectual property?

    There is certainly a focus on copyright protected software as the exploitation of such software can benefit from a favourable tax regime. Patent protection is also possible in several situations and in 2019 Directive (EU) 2016/943 on the protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure has been implemented in Luxembourg law, which confers efficient enforcement options to FinTech holding trade secrets.

  14. How are cryptocurrencies treated under the regulatory framework in your jurisdiction?

    There are, currently, no specific cryptocurrency regulations in Luxembourg. On 8 August 2019, Draft Law 7467 transposing certain provisions of the fifth Anti-Money Laundering Directive ("AMLD V") was, however, presented to the Luxembourg Chamber of Deputies. AMLD V extends the scope of Directive (EU) 2015/849 ("AMLD IV") so as to include service providers engaged in exchange services between virtual currencies and fiat currencies, as well as, custodian wallet providers. Contrary to other EU Member States, Luxembourg's Draft Law does not contain a licensing requirement for crypto-exchanges nor for custodian wallet providers.

    Currently, the CSSF, in practice, requires crypto-exchanges to obtain a payment institution license. Crypto firms, such as Bitstamp and bitFlyer have been granted with such a license. Given the mandatory registration under AMLD V for AMLD/CFT purposes, it is currently unclear whether the CSSF will continue this practice once AMLD V has been transposed in Luxembourg law.

  15. How are initial coin offerings treated in your jurisdiction? Do you foresee any change in this over the next 12-24 months?

    For the time being, Luxembourg has no specific legal regime for initial coin offerings in place. Contrary to other EU Member States, Luxembourg's Draft Law implementing AMLD V does not contain any "goldplating regime" covering ICOs. It is currently safe to say that there are no changes to be expected for the next 12-24 months. In this respect, however, it should be noted that the CSSF has issued on 14 March 2018 two warning statements to inform and warn investors for cryptocurrencies (Warning regarding virtual currencies ) and the risks of investing in ICOs (Warning regarding initial offerings ("ICOs" and tokens)).

  16. Are you aware of any live blockchain projects (beyond proof of concept) in your jurisdiction and if so in what areas?

    There are various examples of live blockchain projects in the Luxembourg public, as well as, the private sector.

    In the public sector, the Luxembourg Government early in 2019 created its own blockchain for the public sector, thereby expressing its determination to play a pioneering role in the field. Making use of this innovative technology is enabling the Government to test and develop a whole range of new applications to improve interaction between the public and private sectors. Digital identification, proof of land ownership, logistics chain management, and even voting are just a few of the potential applications which would be of interest to the public sector.

    The public sector was also a driving force of the public/private Infrachain partnership, which is setting up an infrastructure layer based on trusted nodes on which blockchain projects can be designed.

    In the private sector, FundsDLT, a live blockchain-based platform that allows asset managers to sell funds directly to the investor aiming to reduce the cost of administration and the time taken to process transactions completed its first real transaction with investors in 2017.

  17. To what extent are you aware of artificial intelligence already being used in the financial sector in your jurisdiction, and do you think regulation will impede or encourage its further use?

    In Luxembourg, some private actors developed digital tools in relation to, robo-advice and chatbots. In this respect, the CSSF published its White Paper "Artificial intelligence: Opportunities, risks and recommendations for the financial sector" in December 2018.

    These initiatives are, currently, developing at a rapid pace. In general, there is an increasing interest of financial professional for digitalization projects in Luxembourg and it is to be expected that artificial intelligence will be more and more present in the Luxembourg banking sector.

  18. Insurtech is generally thought to be developing but some way behind other areas of fintech such as payments. Is there much insurtech business in your jurisdiction and if so what form does it generally take?

    Recently, a number of initiatives have emerged in Luxembourg in this area. Since 2018, a yearly Insurtech summit, for example, is being organized in Luxembourg that aims to gather professionals from the insurance sector to foster discussions regarding the latest developments in the Insurtech domain and build up a network. Furthermore, digitization, currently, fosters insurance transformation at a rapid pace in Luxembourg. In particular, FinTechs, such as Earthlab developing insurtech solutions based upon AI, have recently found their way to Luxembourg.

  19. Are there any areas of fintech that are particularly strong in your jurisdiction?

    Fintechs being established in Luxembourg cover a broad spectrum of financial services. Areas of particular importance, however, include Big Data & AI, insurtech, cybersecurity & authentication, fundtech & investments AML/KYC, regtech, payments, lending, cryptocurrency and blockchain.

  20. What is the status of collaboration vs disruption in your jurisdiction as between fintechs and incumbent financial institutions?

    In Luxembourg there is a strong degree of cooperation between fintechs and incumbent financial institutions. Please see for details Q. 21.

  21. To what extent are the banks and other incumbent financial institutions in your jurisdiction carrying out their own fintech development / innovation programmes?

    In Luxembourg, there are quite a few examples in which incumbent financial institutions are carrying out own fintech development / innovation programmes. Examples, amongst others, include:

    • LUXHUB, a joint initiative creating a PSD2 API connectivity platform of the four leading banks in Luxembourg (BCEE, BGL BNP Paribas, Banque Raiffeisen and POST Luxembourg), has been established last year;
    • i-Hub, a wholly-owned subsidiary of POST Luxembourg, offering innovative services for the collection, verification and storage of (AML/KYC) data and documents; and
    • FundsDLT, a collaboration between Fundsquare, InTech (a subsidiary of the POST Group) and KPMG Luxembourg, a fund administration platform based upon blockchain.
  22. Are there any strong examples of disruption through fintech in your jurisdiction?

    On 14 february 2019, the Luxembourg parliament passed a law permitting the use of distributed ledged technology ("DLT") for the circulation of securities, facilitating the use of blockchain technology in financial services and demonstrates Luxembourg's proactive approach to production use of blockchain technology by FinTechs. Based upon the examples given under 21, it is, however, to be expected that several other areas of financial services will be "disrupted" in the forthcoming years.