On 20 January 2026, the Commission de Surveillance du Secteur Financier (CSSF) published Circular CSSF 26/906, introducing a reinforced framework for central administration, internal governance, and risk management applicable to electronic money institutions (EMI) and payment institutions (PI). The Circular must be implemented by 30 June 2026.
According to the CSSF communiqué, sustained growth in payment and e‑money services, driven by multiple market factors, has resulted in significantly higher transaction volumes and values. These developments underscore the need for robust governance arrangements that ensure security, operational efficiency and stakeholder confidence.
Clarified Expectations and Reinforced Governance
The Circular sets out the CSSF’s expectations regarding comprehensive governance structures, effective risk identification, management and reporting processes, and adequate internal controls. While certain regulatory requirements are strengthened, the CSSF has made a notable effort to provide clearer and more comprehensive guidance to market participants.
One of the key elements of the Circular is the reiterated importance of the proportionality principle, which remains at the core of compliance and supervision. Institutions may apply this principle either to enhance their governance and risk arrangements or, within limits, to scale them down, for example, when applying the segregation of duties principle, which requires responsibilities to be allocated to avoid conflicts of interest involving the same individual.
For the first time, the CSSF provides a non‑exhaustive list of examples and criteria relevant to the proportionality assessment. While many of these criteria were anticipated, their formalisation brings welcome clarity and allows institutions to consider additional relevant factors where appropriate.
Application Challenges and Supervisory Body Responsibilities
Some practical questions remain, such as how certain quantitative criteria should be interpreted. For example, the Circular refers to an operations volume exceeding 10 billion but does not specify whether this threshold is annual or absolute. The use of the term operations, however, suggests that all payment transactions, including both credit and debit flows, should be taken into account.
The frequency of reassessment of proportionality criteria similarly raises questions. It is unclear whether the assessment should occur annually, when the management body reports to the supervisory body on the adequacy and effectiveness of governance arrangements, or be triggered by specific events. What is clear is that responsibility for applying the proportionality principle lies with the supervisory body.
More broadly, the Circular strongly reaffirms that the supervisory body bears ultimate responsibility for the EMI/PI. It must define, monitor and ensure the implementation of robust central administration, governance, internal control and risk management arrangements that safeguard the institution’s sound and prudent management, continuity and reputation. The supervisory body also defines the institution’s risk strategy, including its risk appetite and overall risk profile. The supervisory body sets the institution’s risk strategy by outlining its risk appetite and overall risk profile. It shall ensure that these align with a thorough analysis of the proportionality principle.
Clarified Substance Requirements
The Circular also provides clarity on substance obligations. EMI/PI must have both their central administration and registered office in Luxembourg, meaning not only the legal seat, but also the decision‑making centre and administrative centre must be physically located in Luxembourg.
The CSSF adopts an explanatory approach, distinguishing between two components of central administration:
· the administration, encompassing the supervisory and management bodies, internal control functions, and what the Circular refers to as executive function, which is a term that appears to cover administrative, accounting, IT functions; and
· the centre, defined as the place toward which the institution’s activities converge and from which they radiate.
The decision‑making centre is the location where strategic and management decisions are taken. The Circular additionally clarifies that personnel overseeing internal control, commercial, administrative, IT, and operational functions are required to be located in Luxembourg, thereby fulfilling the centre of administration requirements.
Supervisory board members are not required to reside in Luxembourg; however, meetings should generally be held in Luxembourg, with a majority of members physically present to ensure meaningful deliberations. Minutes must document all major matters and discussions in detail (which means that a contradictory debate among the supervisory board shall occur). Circular resolutions remain permissible but should be exceptional.
Finally, while the inclusion of independent supervisory board members is not mandatory, the CSSF strongly recommends it to support robust oversight and balanced decision‑making.
Share your thoughts with Dorothée on LinkedIn.