LU: Conduct, Safeguarding & Financial Promotions

Conduct, Safeguarding & Financial Promotions

The live conduct-side development this cycle is CSSF Circular 26/906's treatment of client-funds safeguarding for Luxembourg payment institutions and electronic-money institutions. The circular sets out guiding principles for safeguarding that require a designated management-body owner for the safeguarding function, a requirement that becomes applicable from 30 June 2026 alongside the circular's broader governance overhaul. This closes what had previously been, in effect, an accountability gap: safeguarding responsibility is now explicitly assigned at the most senior operational level of the institution rather than left implicit or delegated without a named accountable owner.

This safeguarding-ownership requirement should be read as part of the same governance-tightening exercise driving the W1a licensing and market-access changes rather than as a separate conduct initiative; the circular treats governance and safeguarding as interlocking obligations within one consolidated framework. The practical effect for PIs and EMIs is that safeguarding arrangements, previously documented at an operational level, now require explicit sign-off and ownership at management-body level, which raises the evidentiary bar for demonstrating safeguarding adequacy during CSSF supervisory review.

As with the broader governance overhaul, 30 June 2026 is the applicability date to track for the safeguarding-ownership requirement. Firms should expect CSSF supervisory attention to focus on whether the named management-body owner for safeguarding has been formally designated and documented ahead of that date, rather than on safeguarding mechanics themselves, which are not reported as having changed substantively this cycle.

Conduct, Safeguarding & Financial Promotions

Luxembourg's PI/EMI conduct and governance baseline tightened on three fronts this cycle. The compliance deadline for Circular CSSF 26/906, which consolidates central administration, internal governance and risk-management requirements and repeals four legacy circulars, fell due on 30 June 2026; this finding rests on a single primary CSSF source and should be read as provisionally supported pending further corroboration rather than a fully settled shift. A new circular, CSSF 26/915, clarifies that Digital Operational Resilience Act ICT and cyber-resilience requirements apply to third-country branches operating in Luxembourg, expressly naming payment institutions, electronic money institutions and account information service providers within scope, closing a supervisory gap for non-EEA groups' Luxembourg branch operations. Separately, the CSSF imposed a EUR 12,000 administrative fine on PingPong Europe S.A., an electronic money institution, for AML/CFT professional-obligation breaches including a failure to promptly notify Luxembourg's Financial Intelligence Unit of suspicious activity; the fine quantum is modest but the breach category is a recurring supervisory priority, and this account should be read as a supervision-level signal rather than a fully corroborated primary narrative, since it combines a CSSF sanction document with an inferred sector-level framing. Illicit-finance analysis of the PingPong enforcement action itself sits with the Financial Intelligence Monitor rather than this module.

Governance convergence under Circular 26/906 and the DORA branch-scope extension under Circular 26/915 both raise the compliance floor for Luxembourg PI/EMI simultaneously, compounding cost for nonbank licence-holders in particular. Continued CSSF enforcement activity against AML/CFT professional obligations is the pattern to watch into the next cycle, alongside confirmation of whether the governance-circular finding strengthens beyond its current single-source support.

Conduct, Safeguarding & Financial Promotions

CSSF Circular 26/906 represents a structural modernisation of Luxembourg's safeguarding regime for non-bank payment institutions (PIs) and electronic-money institutions (EMIs), and it is the most substantial conduct-and-safeguarding development in this cycle's evidence base (assessed confidence). The circular introduces two linked requirements. First, it mandates daily reconciliation of safeguarded client funds -- an operational-frequency requirement that tightens the cadence at which non-bank PIs and EMIs must verify that client funds held in segregation match their recorded liabilities to customers. Second, it introduces a governance layer: a dedicated management-body member is now required to hold responsibility for safeguarding oversight, a separate dedicated management-body member is required for AML/CFT, and firms must maintain at least two authorised managers operating under a three-lines-of-defence model.

Read together, these two requirements bank-proof, in effect, a segment of the payments landscape that operates under a materially different prudential architecture from licensed banks. Non-bank PIs and EMIs do not hold banking licences and are not subject to the same capital-adequacy and liquidity regime as banks; historically, this has meant that safeguarding of client funds, rather than balance-sheet solvency, has been the primary consumer-protection lever for this cohort, and weaknesses in safeguarding practice have been correspondingly harder for a supervisor to detect between periodic reporting cycles than a bank's capital position. Daily reconciliation directly addresses that detection gap by compressing the interval at which a mismatch between held and owed client funds would surface. The governance provisions address the accountability gap: rather than diffuse responsibility for safeguarding compliance, the circular fixes a named accountable individual at management-body level, mirroring the kind of senior-manager accountability regime more commonly associated with prudentially-regulated banks. The three-lines-of-defence model itself deserves note: it is a standard prudential-risk-management structure -- first-line operational controls, second-line risk and compliance oversight, third-line independent audit -- that until now has been more closely associated with credit institutions than with non-bank payment firms in Luxembourg's supervisory practice. Its extension to PIs and EMIs via Circular 26/906 is itself a signal that the CSSF intends non-bank payment firms' internal-control architecture to converge, at least partially, with bank-grade practice, even though the underlying prudential licence and capital regime remains distinct.

The circular's effective date, 30 June 2026, gives affected non-bank PIs and EMIs a defined compliance runway, and it is reasonable to read the CSSF's contemporaneous enforcement activity against the EMI cohort -- including the Alipay (Europe) SA fine for AML and sanctions-screening deficiencies -- as part of the same supervisory current. The evidence base for Circular 26/906 itself rests on a single independent source; no second, independently-retrieved tier-1 CSSF-original text of the circular was located this cycle, which is recorded as a gap and should temper confidence in the precise wording of individual provisions even as the overall direction is clear. This safeguarding-and-governance tightening should also be read against a separate but structurally related finding this cycle: a 26 February 2025 ruling of the Luxembourg Court of Appeal holding that a final CSSF administrative fine is criminal in nature for non bis in idem purposes, which forecloses subsequent criminal proceedings against the same firm on the same facts. For non-bank PIs and EMIs newly subject to Circular 26/906's stricter regime, this ruling clarifies that a CSSF administrative sanction for a safeguarding or governance failure would, if final, itself carry criminal-law double-jeopardy protection against a later prosecution on the same underlying facts.

The central marker for coming cycles is the 30 June 2026 compliance deadline itself: whether affected non-bank PIs and EMIs have operationalised daily reconciliation and the new management-body roles by that date, and whether the CSSF follows the circular's introduction with either a supervisory review sweep or discrete enforcement action against firms that have not implemented the new governance model. A second-source, tier-1 retrieval of the circular's original text would materially improve confidence in the precise scope of its provisions.

Conduct, Safeguarding & Financial Promotions

CSSF Circular 26/906 raises the conduct and reporting burden for nonbank payment institutions, e-money institutions, and account-information-service providers materially this cycle. Firms in scope must now submit ICT risk assessments, annual compliance attestations, and compliance and internal-audit summary reports to the CSSF within three months of financial year-end, a new obligation ahead of the circular's 30 June 2026 compliance deadline; this is characterised in the underlying evidence as enhanced ICT-risk and governance reporting rather than a change to the fund-safeguarding mechanism itself. Separately, PSD3/PSR implementation is expected to bring tighter fraud-reporting obligations and stronger reimbursement rights for payment-fraud victims, applying to both banks and payment institutions, an assessed-confidence finding given PSD3/PSR's formal adoption is still pending. Together these two developments describe a conduct environment that is tightening ahead of, and independent of, the still-pending PSD3/PSR transposition: the CSSF is not waiting for the EU-level instrument to raise its own domestic reporting and governance bar for the nonbank PI/EMI population specifically.

The 30 June 2026 Circular 26/906 deadline is the immediate compliance-operations item; the PSD3/PSR-driven strengthening of APP-fraud reimbursement rights is the medium-term item to watch as the directive and regulation move toward formal adoption and, later, application in Luxembourg.