Luxembourg Tightens Governance for Payment and E-Money Institutions

The publication of Circular CSSF 26/906 marks a significant pivot in Luxembourg’s oversight of the rapidly evolving payment services sector. By consolidating and modernizing the regulatory framework for payment institutions (PIs), electronic money institutions (EMIs), and account-information service providers (AISPs), the Commission de Surveillance du Secteur Financier (CSSF) is signaling an end to the era of light-touch governance for non-bank financial entities. This move is not merely a local administrative update; it is a strategic alignment with the European Banking Authority’s (EBA) broader push for harmonized financial stability across the Eurozone, specifically integrating guidelines related to Directive (EU) 2015/2366 (PSD2).

At the heart of the new Circular is the reinforced requirement for 'Central Administration' within the Grand Duchy. The CSSF is making it explicitly clear that authorized institutions must maintain more than just a registered office in Luxembourg; they must house their actual decision-making and administrative core there. This includes the physical presence of supervisory and management bodies, as well as key control functions. While outsourcing remains permissible under the existing framework of Circular CSSF 22/806, the new rules ensure that the 'mind and management' of the firm cannot be entirely delegated or offshored. This focus on substance over form is designed to prevent the use of Luxembourg as a 'brass plate' jurisdiction for firms primarily operating elsewhere, thereby protecting the integrity of the local financial ecosystem.

Internal governance requirements have also been significantly detailed. The Circular demands a transparent organizational structure with a clear segregation of duties to prevent conflicts of interest. For many fintechs that have historically operated with lean, overlapping management roles, this will necessitate a structural rethink. Institutions are now required to document their proportionality assessments annually, justifying how their governance arrangements are appropriate for their size, internal organization, and the nature and complexity of their activities. This 'proportionality' clause provides some flexibility for smaller AISPs, but the baseline for risk management and internal control remains high across the board.