Law Of 5 May 2026 Transposing CRD VI In Luxembourg - Key Provisions And Practical Implications

The Law of 5 May 2026 has been published in the Luxembourg Official Journal introducing amendments to the Luxembourg financial sector supervisory framework (Law). The main purpose of the Law is to transpose Directive 2024/1619 (the sixth Capital Requirements Directive – CRD VI) and is primarily aimed at adapting the rules concerning the internal governance of credit institutions and certain investment firms. In addition, the Law transposes the regulatory framework applicable to third-country branches (TCBs), as well as the new rules governing material transactions and the management of ESG risks and risks related to crypto-assets. The Law mainly amends the Law of 5 April 1998 on the financial sector (LFS). The Law also transposes and implements Regulation (EU) 2024/2987 and Directive (EU) 2024/2994 (EMIR 3 Package).

A. Enhanced governance rules and provisions on suitability assessments

The Law introduces a more proportionate supervisory approach, notably by replacing prior authorisation requirements with notification regimes for certain structural changes, such as the creation or acquisition of subsidiaries and branches, in credit institutions. This shift is justified by the introduction of new rules governing material transactions (as further analysed below), in particular the new provisions on the acquisition of material holdings. The same approach is also extended to Professionals of the Financial Sector (PFS).

The new framework introduces a more harmonised and formalised fit-and-proper framework under the LFS applicable to credit institutions, certain investment firms and (mixed) financial holding companies, extending enhanced suitability, governance and supervisory requirements to both members of the management body and key function holders (including heads of internal control functions and CFOs). Prior to the reform, the Luxembourg fit-and-proper regime under the LFS relied on CSSF guidance and ESAs guidelines to assess the suitability of management body members and key function holders.

The Law introduces, among other changes, a mandatory prior submission of suitability applications at least 30 working days before appointment for Luxembourg credit institutions, more prescriptive documentation and a limited possibility for ex post assessments in specific board replacement scenarios. The reform also expands suitability criteria to expressly include ESG and ICT-related expertise and training and prohibits the combination of the chair and CEO functions. It also requires Institutions to maintain individual statements of roles, duties and reporting lines for management body members, senior management and key function holders.

B. New regime applicable to third country undertakings providing banking services in Luxembourg

Much of the current focus, and regulatory discussion, centres on the new regime for TCBs. The Law introduces a new framework governing the provision of core banking services by third country undertakings (TCUs). Under the new regime, TCUs wishing to provide deposit-taking, lending, or guarantee-granting services (In-Scope Services) in Luxembourg will, in principle, be required to establish and obtain authorisation for a local branch. This requirement applies automatically to deposit-taking activities, while lending and guarantee services are caught where the third-country provider would qualify as a credit institution or large investment firm under the CRR, if established in the EU. Important carve-outs are provided, notably for MiFID II-regulated investment services, reverse solicitation, intragroup and interbank activities.

The Law differentiates between class 1 and class 2 TCBs, with regulatory requirements calibrated to size, complexity and risk profile. Class 1 TCBs include larger or more complex operations (e.g. assets of EUR 5 billion or more, material retail deposit-taking, or non-qualifying third-country status), while smaller, less complex branches fall into class 2. Authorisation is subject to enhanced prudential, liquidity and governance standards, including minimum capital endowment requirements, liquidity coverage obligations, robust local governance arrangements, booking and record-keeping rules, and supervisory reporting to the CSSF.

The CSSF may, on an ad hoc basis, require an authorised TCB to convert into a subsidiary, in particular where the TCB has provided or is providing In-Scope Services to customers or counterparties located in other member states, is assessed as systemically important and poses significant financial stability risks at EU or Luxembourg level, or where quantitative thresholds are exceeded—namely, where the aggregate assets of all EU branches of the same third-country group reach or exceed EUR 40 billion, or where the assets booked by the TCB in Luxembourg reach or exceed EUR 10 billion, taking into account the TCB’s potential systemic importance.

Key implementation milestones include a grandfathering cut-off on 11 July 2026, after which contracts entered into beforehand benefit from transitional protection. The TCB provisions will become fully applicable as of 11 January 2027.

C. Material transactions oversight and sanctions

The landscape for material acquisitions and disposals has undergone a significant transformation. Under the Law, credit institutions, certain investment firms, financial holding companies, and mixed financial holding companies are subject to mandatory prior notification and assessment requirements before acquiring or divesting material holdings. A holding is deemed material once it reaches 15% of eligible own funds, triggering a CSSF review that scrutinises prudential soundness, compliance with EU capital standards, and potential AML risks. The Law also introduces clearly defined assessment timelines and provisions for suspending deadlines when additional information is requested.

Beyond acquisitions and disposals, the Law extends mandatory notification and assessment obligations to material transfers of assets or liabilities, as well as mergers or divisions that could impact the prudential profiles of these entities. The CSSF evaluates such transactions with a focus on financial soundness, governance, implementation plans, and regulatory compliance, coordinating with other competent authorities when cross-border interests are involved. While intra-group transactions may benefit from streamlined procedures, all operations remain subject to CSSF oversight.

Finally, the Law strengthens the CSSF’s supervisory and enforcement powers by extending its administrative sanctioning framework to cover breaches of prudential requirements, including the acquisition or disposal of material holdings, transfers of assets and liabilities, and mergers or divisions. In addition to existing sanctions, the CSSF may now impose periodic penalty payments (astreintes) on both institutions and individuals to compel the cessation of ongoing violations, including failures related to capital, liquidity, governance, remuneration, and reporting obligations.

D. Looking ahead

The Law represents a major regulatory milestone for Luxembourg in 2026, bringing significant changes for domestic financial institutions and reshaping the framework for third-country market access, governance, and prudential oversight.

Non-EU entities currently providing, or intending to provide, In-Scope Services in Luxembourg will need to assess whether their activities fall within the scope of the regime and, where applicable, whether they are required to establish and obtain authorisation for a local branch, taking into account the nature of the services provided and applicable carve-outs. Full clarity will depend on the subsequent guidance by the CSSF, which will be essential for interpreting and implementing the new framework and especially the new TCB regime.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.