The Luxembourg Commission de Surveillance du Secteur Financier has published Circular CSSF 26/906 on central administration, internal governance and risk management for payment institutions and electronic money institutions. The circular consolidates and updates the supervisory expectations for these firms and repeals Circulars IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155 for institutions in scope. The circular is intended to clarify how the requirements in the amended Law of 10 November 2009 on payment services should be applied, including expectations for robust internal governance arrangements, effective processes to identify, manage, monitor and report risks, and adequate internal control mechanisms. Institutions covered by the circular must assess and review their central administration, internal governance and risk management framework to ensure compliance by 30 June 2026.
Luxembourg Commission de Surveillance du Secteur Financier 2026-01-20
Luxembourg Commission de Surveillance du Secteur Financier issues Circular 26/906 setting new governance and risk management standards for payment and electronic money institutions with 30 June 2026 compliance deadline
The Luxembourg Commission de Surveillance du Secteur Financier issued Circular CSSF 26/906, updating supervisory expectations for payment and electronic money institutions. This circular clarifies the application of the amended Law of 10 November 2009, focusing on internal governance, risk management, and control mechanisms. It repeals previous circulars and requires compliance by 30 June 2026.