The book is 611 pages long. But the question posed on Thursday 1 October at EY, during the 2026 edition of “Investment Funds in Luxembourg”, could be summed up in a single sentence: how can a sector built on stability remain robust without becoming stagnant?

For more than 30 years, nearly 40 EY staff members from the audit, tax, legal and regulatory departments have been updating what the financial community calls its “Funds Bible”. “Unlike the original Bible, ours is a living document,” remarked wryly Madjid Boukhelifa, a partner at EY Luxembourg. Every year, the regulators provide him with new chapters.

The 2026 edition adds two more, devoted respectively to the fight against money laundering and digital finance. The first notably incorporates the new European framework and the rules laid down by the European Anti-Money Laundering Authority (Amla), which are due to come into force from July 2027. The second brings together developments relating to crypto-assets, virtual assets and artificial intelligence (AI).

EY has also overhauled the section on sustainable finance to reflect the revision of the SFDR and the EU Omnibus Package. The book also incorporates AIFMD II and Ucits VI, along with their implications for services provided to third parties, liquidity management tools and reporting. It updates the rules concerning ETFs, money market funds, the valuation of illiquid assets, securitisation, private credit, the EU’s Faster Directive on withholding tax and the Luxembourg reform of carried interest.

Dependencies and vulnerabilities

However, this regulatory work describes the current landscape more than it reveals the direction of travel. According to Madjid Boukhelifa, managers’ success will now depend on their ability to link “technology, talent, data, governance, customer experience and their strategic purpose”. He used Salvador Dalí’s “Elephant with Long Legs” – a reproduction of which was on display outside EY’s offices – to illustrate the state of the industry. “Strength does not lie solely in size or history. Even the most well-established institutions must constantly adapt, find their balance and remain agile in a changing environment.”

Data sovereignty, infrastructure sovereignty and energy supply sovereignty are issues that we did not view in the same way five years ago.

Jean-Pierre Faber, director , CSSF

The first vulnerability stems from technological dependence. According to figures cited by Jean-Pierre Faber, director and member of the CSSF’s executive committee, 63% of respondents to the surveys mentioned at the conference use major global cloud service providers. For 41%, this dependence is even concentrated on a single hyperscaler. Dora requires financial institutions to regulate their contracts, monitor their service providers and draw up an exit strategy. Jean-Pierre Faber believes, however, that the sector has not yet sufficiently tested the implementation of the latter: leaving a critical provider without compromising the service provided to customers remains a largely theoretical exercise.

“Data sovereignty, infrastructure sovereignty and energy supply sovereignty are issues that we did not view in the same way five years ago,” he observed. This concentration does not only concern the cloud, but also the software, hardware, networks and resources required for data centres to operate.

The CSSF came under attack for six months

The nature of the risk has also changed. The question is no longer whether an organisation will be attacked, but through which channel and with what degree of sophistication. A cybercriminal can now impersonate a senior executive, a supplier, a regulator or even a building contractor.

To test its own defences, the CSSF allowed a specialist service provider to launch attacks against it for six months. Only three people were aware of the exercise. The scenarios included identity theft targeting the chief executive or a supplier, the theft of a computer and several attempts to breach the systems.

Reconstruction is the next step. “A clean room takes 72 hours to become operational again, provided you are very well organised and have tested the system,” explained Jean-Pierre Faber. A clean room allows a system to be restarted in an isolated environment, using components that are presumed to be sound. However, care must be taken to ensure that this restored infrastructure is not immediately contaminated in turn.

You no longer need an army of people to attack a company or even a country.

Abdelhay Toudma, partner, EY

At the same time, AI is reducing both the cost and the level of expertise required to carry out an attack. “You no longer need an army of people to attack a company or even a country,” emphasised Abdelhay Toudma, partner and head of governance, risk and compliance at EY Luxembourg. The methods are accessible, whilst AI automates part of the preparation and social engineering.

Common sense: the first line of defence

A case discussed during the evening shows that the weak link is not necessarily to be found in the IT system. By posing as a regulatory authority, fraudsters persuaded a neobank to hand over the full details of 700 customers, including their identities and investment portfolios. They did not breach the institution’s security defences: its employees handed over the information to them.

“If the CSSF were to ask you for this sort of information, use your common sense and check with us before passing it on,” warned Jean-Pierre Faber. The Commission uses secure channels to receive sensitive data, rather than simply replying to an email.

Fake images and video conferences present a further challenge. Early AI-generated images could be recognised by their distorted hands or characters with six fingers. “Today, it is impossible for a human being to tell the difference between a fake image or video and a real one,” said Abdelhay Toudma.

For the consultant, cybersecurity can, therefore, no longer be treated as a wall built around the organisation. Employees work remotely, data flows between multiple platforms, and every manager relies on a chain of service providers. “You can outsource services and delegate their management, but not the responsibility,” he emphasised. A weakness at a supplier becomes a weakness for all its customers.

The same caution must be applied to AI projects. Abdelhay Toudma recommends starting with the tasks that require the most resources – notably customer knowledge, anti-money laundering controls and due diligence – and then assessing whether AI is actually the right solution. Since the emergence of ChatGPT, he observes, some companies have been opting for this technology even before they have defined the problem to be solved.

AI will amplify both the weaknesses and the strengths of your databases.

Abdelhay Toudma, partner, EY

Data quality: a fundamental principle

The quality of the data will largely determine the outcome. “AI will amplify both the weaknesses and the strengths of your databases,” he explained. Fragmented, inconsistent or poorly managed data will not lead to better decisions: it will simply result in an incorrect outcome being produced more quickly.

Nor can governance be entrusted to a single function. Cybersecurity often falls under the remit of an information systems security manager, whilst data protection is the responsibility of a specialist officer. AI, on the other hand, cuts across all business lines. It therefore requires shared responsibility, shutdown procedures, documented tests and a clear answer to a simple question: who takes action when a system produces an error or causes a data breach?

Private assets are becoming more widely accessible

Beyond these risks, the development that could most profoundly transform the Luxembourg industry remains the combination of tokenisation and retail investors’ access to assets previously reserved for professional investors. Luxembourg has adopted four pieces of legislation on distributed ledger technologies, notes Jean-Pierre Faber. The framework now makes it possible to digitise a large part of a fund’s operations, from the issue of its units to their distribution.

However, technology alone will not be enough to open up private markets. Investors need to understand the product, the risk involved, the exit options and the conditions under which they will recoup their investment. The democratisation of private assets must not reduce distribution to the mere digital provision of complex products.

Stablecoins could accelerate this trend by serving as a settlement instrument for tokenised assets. “It will happen, whether with a European stablecoin or a non-European one,” predicted Jean-Pierre Faber. The question is, therefore, no longer simply whether funds will be channelled through new infrastructure, but who will control the currency, the data and the channels used to do so.

It is in this area that the financial centre will have to defend its position. Luxembourg has a well-established ecosystem of management companies, custodians, directors, solicitors, auditors and regulatory authorities. However, its future advantage cannot rest solely on its ability to apply the rules and administer structures designed elsewhere. It will also need to play a part in designing the products, infrastructure and distribution models that will gradually replace those described in the 600 pages of the 2026 edition.