Luxembourg: fintech & payments regulation

Regulated

Luxembourg fintech: CSSF regulates payments under PSD2; e-money requires LIC/EMF licence

Lead regulator: Commission de Surveillance du Secteur Financier (CSSF)
Also involved: Luxembourg Central Bank (BCL) · CRF (AML/CFT)
Core law: Law of 12 July 2005 on the financial sector (PSD2 transposition)
Entry capital: EUR 300,000 (Payment Institution)
Approval timeline: 6-9 months
Customer assets: Segregated in dedicated accounts
Data protection: Luxembourg Data Protection Act · CNPD
Sandbox: Yes - Luxembourg Fintech Lab

Luxembourg is a mature fintech hub where the CSSF supervises payment and e-money activities under the transposition of the EU Payment Services Directive (PSD2). The regime is strictly regulated, requiring specific authorisation for payment services and e-money issuance. Recent regulatory focus has shifted towards ICT risk management, relationship management, and the implementation of the EU Travel Rule for crypto-assets.

Which licence do you need?

Your activity	Requirement	Capital	Timeline	Authority
Payment processing / gateway	LicencePayment Institution Requires own funds and initial capital per PSD2	EUR 20,000 (initial) / EUR 20,000 (own funds)	6-9 months	CSSF
E-money & wallet issuance	LicenceElectronic Money Institution Strict capital and governance requirements	EUR 350,000	6-9 months	CSSF
Domestic money transfer	LicencePayment Institution Domestic transfers fall under Payment Institution scope	EUR 20,000 (initial) / EUR 20,000 (own funds)	6-9 months	CSSF
Cross-border remittance	LicencePayment Institution Cross-border payments require full Payment Institution licence	EUR 20,000 (initial) / EUR 20,000 (own funds)	6-9 months	CSSF
Agent network	RegistrationPayment Institution Agent Agents must be registered with the CSSF	—	—	CSSF
Open banking / account information	LicencePayment Institution / AISP Account Information Service Providers require authorisation	—	—	CSSF
Foreign-exchange services	LicencePayment Institution FX services are payment services under PSD2	EUR 20,000 (initial) / EUR 20,000 (own funds)	6-9 months	CSSF

New — what changed recently

2025-04-09Circular CSSF 25/880 — Established new requirements for relationship management of payment service users and ICT assessment.^[1]
2025-04-08Circular CSSF 25/879 — Adopted EBA Travel Rule Guidelines on fund and crypto-asset transfers, repealing previous circulars.^[2]
2025-12-23Circular CSSF 25/903 — Updated annual reporting and auditor engagement rules for support Payment Financing Services entities.^[3]

Market-entry checklist

1Establish legal entity in LuxembourgIncorporate a company with a registered office and effective direction in Luxembourg.
2Secure minimum capitalDeposit EUR 300,000 for Payment Institutions or EUR 350,000 for E-Money Institutions.
3Appoint fit and proper directorsEnsure management body members have sufficient experience and good repute.
4Submit authorisation applicationFile a detailed application with the CSSF including business plan and governance structure.
5Implement AML/CFT frameworkEstablish robust anti-money laundering and counter-terrorist financing procedures.
6Register agents with CSSFIf using agents, ensure they are registered with the CSSF before commencing activities.

Sources

This guide is compiled automatically from 3 primary-source documents published by Luxembourg's regulators, reviewed by RegAlert, and refreshed monthly (last updated 2026-07-12). It is not legal advice — always confirm requirements with the regulator or local counsel before acting.