#
Consumer protection sits with the CSSF, the competent authority for compliance with financial-consumer-protection laws and the registered ADR entity for out-of-court complaint resolution under CSSF Regulation 16-07 and Circular 17/671 (transposing Directive 2013/11/EU into the Consumer Code). The procedure is free, voluntary, written and non-binding; complaints must first go to the firm's management and reach the CSSF within one year. APP-fraud mitigation in Luxembourg operates via the IPR Verification of Payee (name/IBAN matching) and daily sanctions screening rather than a UK-style mandatory reimbursement regime.
The analytical consequence is a lighter liability exposure for payment firms than the UK PSR framework imposes. The non-binding ADR-only model means Luxembourg-supervised firms — both bank and non-bank — do not carry a mandatory-reimbursement liability for authorised push payment fraud, differentiating their exposure profile materially from UK peers.
Outlook
W10 is stable. The consumer-protection model is settled, and the absence of a mandatory APP reimbursement regime is a standing structural feature rather than a moving variable. The forward watch is whether the IPR Verification of Payee regime (carried in W5) materially reduces APP fraud incidence in the absence of mandatory reimbursement, and whether EU-level pressure pushes Luxembourg toward a heavier consumer-liability model. Trajectory: stable.
no periodic updates on record for this sub-brief
Sources and findings (4 unique sources · R-3/R-4)
The CSSF acts as an ADR entity for out-of-court resolution of consumer disputes, registered under Article L.431-1 of the Consumer Code and on the European Commission's ADR list, with a free, voluntary, confidential written procedure.
- [W10-E2] T1 Derived: Confirmed in_forcehttps://www.cssf.lu/wp-content/uploads/RCSSF_No16-07eng.pdf re-verified
CSSF Regulation N°16-07 on out-of-court complaint resolution implements the consumer ADR Directive 2013/11/EU and references Article 106 of the Law of 10 November 2009 on payment services, conducting a free written procedure within a 90-day period.
- [W10-E3] T1 Derived: Confirmed in_forcehttps://guichet.public.lu/en/citoyens/justice/voies-recours-reglement-litiges/resolution-litige-amiable/resolution-litige-cssf.html re-verified
A complaint must first have been dealt with by the firm's executive management and be filed with the CSSF within one year; the CSSF's reasoned conclusions are not binding on the parties and exclude insurance-sector and commercial-policy disputes.
- [W10-E4] T3 Derived: Probable in_forcehttps://www.linari-law.lu/luxembourg-instant-payments-regulation/ re-verified
The IPR Verification of Payee regime affords pre-execution alerts for name/IBAN discrepancies, a measure intended to reduce EU-wide authorised push payment fraud at the point of payment initiation.