LogoRegulatory Alerts

Luxembourg: fintech & payments regulation

Regulated

Luxembourg fintech & payments: CSSF-regulated under PSD2, MiCA, and LFS

Lead regulator:
Commission de Surveillance du Secteur Financier (CSSF)
Key law:
Law of 12 July 2005 on the financial sector (LFS); Law of 13 June 2017 on payment accounts
Last updated:
2026-07-12

Luxembourg maintains a comprehensive regulatory framework for fintech and payments, primarily overseen by the Commission de Surveillance du Secteur Financier (CSSF). The regime is anchored in the Law of 12 July 2005 (LFS) for financial sector entities and the Law of 13 June 2017, which transposes the Payment Services Directive 2 (PSD2) into national law.

Payment service providers (PSPs) and crypto-asset service providers (CASPs) require authorization from the CSSF. Recent regulatory updates, such as Circular 25/879, align the jurisdiction with the EU's Markets in Crypto-Assets Regulation (MiCA) and EBA Travel Rule guidelines. The CSSF enforces strict organizational, ICT, and AML/CFT standards for all licensed entities.

The regulatory environment is characterized by active implementation of EU directives, including the adoption of EBA guidelines on fraud data reporting and limited network exclusions. The CSSF continuously updates its circulars to reflect changes in EU law, ensuring that domestic fintech and payment activities remain compliant with the broader European regulatory landscape.

Who regulates

  • Commission de Surveillance du Secteur Financier (CSSF)

    Primary supervisor for payment institutions, investment firms, and crypto-asset service providers

    [1][2][3][4]

Core laws & rules

  • Law of 12 July 2005 on the financial sector (LFS) (2005)

    The foundational statute governing the financial sector, including the authorization and supervision of credit institutions and investment firms.

    [5]

  • Law of 13 June 2017 on payment accounts and postal financial services (2017)

    Transposes PSD2 into national law, regulating payment accounts, fees, and access to basic payment account features.

    [6][7]

Licensing & registration

  • Payment Service Provider (PSP)

    Entities providing payment services must be authorized by the CSSF under PSD2. The CSSF adopts EBA guidelines on limited network exclusions and fraud data reporting.

    [8][9]

  • Crypto-Asset Service Provider (CASP)

    Under MiCA (Regulation (EU) 2023/1113), CASPs require authorization. The CSSF has adopted EBA guidelines on information requirements for crypto-asset transfers.

    [4]

Restrictions & warnings

  • The CSSF mandates strict ICT assessment and relationship management standards for payment service providers via Circular 25/880.

    [3]

  • Third-country firms providing investment services must comply with equivalence rules and authorization requirements established by CSSF Regulation No 20-02.

    [10]

Direction of travel

  • The regulatory framework is actively evolving to integrate EU-wide standards, including the full implementation of MiCA and ongoing updates to AML/CFT and operational resilience requirements.

    [4][3]

Sources

  1. Circular CSSF 26/912 Repeal of Circular IML 91/75 on UCI Rules · 2026-05-22
  2. Circular CSSF 26/906 — Central administration, internal governance and risk management · 2026-01-20
  3. Circular CSSF 25/880 on relationship management of payment service users and PSP ICT assessment · 2025-04-09
  4. CSSF Circular 25/879: Adoption of EBA Travel Rule Guidelines on Fund and Crypto-Asset Transfers · 2025-04-08
  5. Circular CSSF 19/716 (as amended by Circular CSSF 20/743) — Provision in Luxembourg of investment services or performance of investment activities and ancillary services in accordance with Article 32-1 of the LFS · 2019-04-10
  6. CSSF Circular 18/700 on the Law of 13 June 2017 regarding payment accounts and postal financial services · 2018-10-19
  7. Grand-ducal Regulation of 6 June 2018 on the Standardised List of Representative Payment Account Services · 2018-06-06
  8. CSSF Circular 22/812: Adoption of EBA Guidelines on Limited Network Exclusion under PSD2 · 2022-05-18
  9. CSSF Circular 19/712 — EBA Guidelines on Fraud Data Reporting under PSD2 Article 96(6) · 2019-03-14
  10. CSSF Regulation No 20-02 on the equivalence of certain third countries for investment services by third-country firms · 2020-07-01

Email alerts for Luxembourg updates

New circulars, rules and guidance — a digest in your inbox, same day.

This guide is compiled automatically from 10 primary-source documents published by Luxembourg's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.