The law of 20 May 2021 aims to implement two Directives: Directive (EU) 2019/878 (CRD 5) and Directive (EU) 2019/879 (BRRD). It also amends the law of 5 April 1993 on the financial sector (LFS). In particular, the law introduces changes in respect of: (i) capital conservation measures, by providing flexibility in the use of the systemic risk buffer; (ii) the new approval process for (mixed) financial holding companies, whether existing or newly established (with possible exemptions under certain conditions); and (iii) EU institutions belonging to third-country groups, which must now put in place an intermediate parent undertaking if certain conditions are met. Furthermore, the law introduces new provisions regarding variable remuneration, clarifies remuneration requirements in a group context and provides that remuneration should be gender neutral. The Commission de Surveillance du Secteur Financier (CSSF) published a statement in June to summarise the key points of the law.

Regarding the BRRD, the law of 20 May 2021 aims to implement new provisions in relation to the loss-absorbing and recapitalisation capacity of credit institutions and investment firms. Back to 2020.

New prudential regime for investment firms

The law of 21 July 2021 has implemented Directive (EU) 2019/2034 (the Investment Firms Directive, or IFD), enacted operational requirements in relation to Regulation (EU) 2019/2033 (the Investment Firms Regulation, or IFR) and accordingly also amended the LFS. The new prudential regime takes into account the risks investment firms face, rather than taking a one-size-fits-all approach. Investment firms are now categorised according to their size and complexity, and each category is subject to a specific prudential framework. Class 1 investment firms - that is, so- called "bank-like investment firms" - are subject to the CRD/CRR regime. In addition, so-called Class 1b "CRR investment firms" - that is, investment firms which are not considered credit institutions - nonetheless remain subject to certain CRD/CRR obligations. Finally, IFR investment firms that are small and non-interconnected investment firms are categorised under Class 3, and enjoy less restrictive provisions under the IFD/IFR regime. All other investment firms fall under Class 2 and are subject to the IFD/IFR regime. The new regime also introduces changes regarding capital requirements, remuneration, governance and reporting requirements. Furthermore, the status of certain professionals of the financial sector (PFS) has been modernised and the status of specialised PFS known as "persons carrying out cash exchange operations" has been abolished. Finally, please note that the CSSF has issued further guidance in respect of this law. The CSSF draws attention, among other things, to the requirement to file an updated version of the articles of association with the Trade and Companies Register, which reflects the corporate purpose as amended to align with the new provisions of the LFS. Back to 2020.

MiFID 2 quick fixes

The law of 21 July 2021 (mentioned above) has also implemented the so-called "quick fixes to MiFID 2" (that is, Directive (EU) 2021/338) into Luxembourg law in order to address issues relating to the COVID-19 pandemic and to facilitate recovery from it. Among others, the changes include the following: communications between clients and investment firms must be provided in electronic format (noting that retail clients, exclusively, can still opt for paper format); exemption from ex ante costs and charges disclosure for distance communication, except for investment advice and portfolio management; certain exemptions from product governance requirements and more generally for certain reporting requirements for non-retail clients (but professional clients can still opt in); and temporary suspension of best execution reports for execution venues and systematic internalisers until 28 February 2023.


With CSSF Circular 21/785, the CSSF has introduced a more flexible regime in the case of material IT outsourcings. Credit institutions, PFS, payment and e-money institutions as well as investment fund managers subject to CSSF Circular 18/698 are no longer subject to the requirement to obtain the CSSF's prior approval in case of a material IT outsourcing. The new regime provides for a mere notification requirement, and the above-mentioned firms are now only required to inform the CSSF of the planned material IT outsourcing 3 months prior to its implementation (this notice period is shortened to 1 month when outsourcing to a support PFS). In the absence of a response from the CSSF, the relevant entity may implement the material IT outsourcing after the expiry of the notice period. However, the CSSF retains the power to suspend this period where it deems necessary. It should also be noted that the prior approval requirement remains in place for non-IT related material outsourcings.


In April 2021, the CSSF published Circular 21/769 on governance and security requirements for supervised entities to perform tasks or activities through telework, which is to be applied under normal working conditions (and not in a pandemic situation or other similar exceptional circumstances). The CSSF indicates that its approval is not required for teleworking, and that responsibility for the organisation of a teleworking system lies with the concerned entities - i.e. supervised entities, including their branches in Luxembourg or abroad. The Circular provides guidance, general principles and minimum criteria for teleworking and states that concerned entities must comply with central administration requirements and ensure that they maintain sufficient substance at their premises (please note that labour law requirements also remain fully applicable). Concerned entities will have to establish a teleworking policy, monitor the implementation of that policy, and assess the related risks on a regular basis. In late August the CSSF announced that because the pandemic is still ongoing, the date of entry into force planned initially (i.e. 30 September) will have to be delayed further, until after the pandemic.

Please also refer to the section "Employment Law".


Regulation (EU) 2020/1503 on crowdfunding service providers for business has been directly applicable across the EU since 10 November 2021. It enables crowdfunding platforms to provide their services within the EU. Crowdfunding will provide an alternative source of financing for start-ups and SMEs (small and medium-sized companies). The Regulation sets harmonised rules for the provision of investment-based and lending-based crowdfunding services related to business financing. It enables platforms to apply for an EU passport based on a single set of rules and ensures a high level of protection for investors.


The law of 22 January 2021 modernises the Luxembourg framework on dematerialised securities and confirms the possibility of using distributed ledger technology (DLT). On the one hand, the law clarifies that issuance accounts for dematerialised securities may be kept using DLT. On the other hand, more entities are allowed to act as account keeper for unlisted debt securities - that is, any credit institution or investment firm authorised in a Member State of the EEA when certain conditions are met. Read more.

Virtual assets

The CSSF has announced that in addition to the guidance on virtual assets for UCIs, it will publish guidance for credit institutions during the second half of December. This guidance has not been published at the date of this publication.

Please also refer to the section "Fund Formation - Investment Management".

Modernisation of the Luxembourg securitisation framework

On 21 May 2021, a bill of law amending the law of 22 March 2004 on securitisation was submitted to Parliament. Over the years, Luxembourg- based securitisation vehicles have enjoyed major success, proving to be reliable and flexible instruments that enable a wide range of operations and transactions. The bill of law, which will benefit both existing and new securitisation vehicles, intends to further increase flexibility by (i) creating new opportunities in the active management of securitisation vehicles, (ii) extending financing arrangements for securitisation vehicles, (iii) extending the possibility for securitisation vehicles to grant security, and (iv) making it easier for securitisation vehicles to securitise tangible assets. Read more.

In April 2021, Regulation (EU) 2021/557 amending the Securitisation Regulation ((EU) 2017/2402) and Regulation (EU) 2021/558 amending the CRR were published in the Official Journal of the EU. Both aim to provide measures to address the COVID-19 pandemic and facilitate recovery from it. The main amendments relate, among other things, to implementing a simple, transparent and standardised securitisation framework for balance-sheet synthetic securitisation, and to providing for changes to the securitisation of non-performing exposures (so-called NPEs) by removing some of the existing regulatory obstacles.

Looking forward


In July 2021, the EU Commission released a package of proposed measures to implement a new EU-wide AML/CTF action plan. The legislative proposals, which establish a new framework for the regulation of AML/CTF in the EU, include:

  • A draft regulation establishing the authority for AML/CTF (AMLA).
  • A draft regulation on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing.
  • A draft directive on the mechanisms to be put in place by the Member States for the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and repealing Directive (EU) 2015/849. The draft directive on AML/CTF will replace MLD 4/5.
  • A draft regulation on information accompanying transfers of funds and certain crypto-assets.

The EU Commission anticipates that AMLA will be established in 2023 with a view to starting most of its activities in 2024 and beginning direct supervision of certain high-risk financial entities in 2026. Direct supervision can only start once the harmonised rulebook is completed and takes effect. Read more.

AML criminal sanctions

From a Luxembourg perspective, bill of law 7533 was submitted to Parliament in 2020 to implement into Luxembourg law Directive 2018/1673 on combating money laundering by criminal law. In particular, it aims to extend the scope of Article 506-1 of the Criminal Code to any primary offence falling under the definition of criminal activity. It will also, among other things, amend Article 31 (2) of the Criminal Code on the special confiscation regime. In October 2021, due to a lack of consensus with the Council of State, the Judicial Commission (Commission de la Justice) decided to divide the original bill into two distinct bills to enable faster adoption. Thus, bill 7533A includes the provisions implementing Directive 2018/1673 which have been ratified by the Council of State, whereas bill 7533B only concerns the text of Articles 506-1 and 506-4 of the Criminal Code as well as the relevant provisions of the amended law of 19 February 1973 on the sale of medicinal substances and the fight against drug addiction, which are still being discussed with the Council of State. Bill 7533A should therefore be adopted relatively soon.


The RTS on settlement discipline (Commission Delegated Regulation (EU) 2018/1229) that were due to enter into force on 1 February 2021 have been further postponed and will now enter into force on 1 February 2022. However, in September 2021 the EU Commission, as announced in its 2021 Work Programme, considered presenting a legislative proposal to amend the CSDR to improve its efficiency and effectiveness.


On 27 October 2021, the EU Commission published a banking legislative package to reform the Capital Requirements Regulation (575/2013) (CRR) and the CRD 4 Directive (2013/36/EU). It includes:

  • A proposed regulation amending the CRR as regards requirements for credit risk, credit valuation adjustment risk, operational risk, market risk and the output floor. This proposal largely reflects the EU's implementation of the final Basel III standards.
  • A proposed directive amending the CRD 4 as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance (ESG) risks. This proposal will introduce a new fit and proper framework for key individuals in banking groups, and a regulatory framework for branches of third-country undertakings providing banking activities in Member States.
  • A proposed regulation (the so-called 'daisy chain' proposal) making targeted amendments to the CRR and the BRRD relating to the minimum requirement for own funds and eligible liabilities (MREL).

The proposals are the final step in the reform of the banking regulation and aim to supplement the implementation of Basel III in the EU to ensure that banks are more resilient in the face of potential economic turmoil. Next step: the Council of the EU and the EU Parliament will now consider the legislative proposals.

MiFID 2 - a broader review in the making

In November 2021, the EU Commission adopted legislative proposals to review the Markets in Financial Instruments Regulation (MiFIR) (consolidated tape) and Markets in Financial Instruments Directive (MiFID 2). These proposals are part of the measures that implement the Capital Markets Union. The EU Commission highlights that the proposals will address the following issues: (i) strengthening transparency requirements, (ii) introducing an EU consolidated tape for shares, bonds, exchange-traded funds (ETFs) and derivatives, (iii) focus on retail investment and investor protection, and (iv) increasing competitiveness of EU markets in the global landscape by fine-tuning the derivative trading obligation and the share trading obligation, and by removing the open access obligation. Next step: the Council of the EU and the EU Parliament will now consider the legislative proposals. Back to 2020.

MiFID 2 to integrate ESG factors

Two delegated acts amending two delegated acts implementing MiFID 2 requirements on product governance, organisational requirements and operating conditions of investment firms were published in the Official Journal of the EU in August 2021: (i) Delegated Regulation (EU) 2021/1253 amending organisational requirements (including suitability assessments) under the MiFID 2 Delegated Regulation (EU) 2017/565, and (ii) Delegated Directive (EU) 2021/1269 amending product governance obligations under the MiFID 2 Delegated Directive (EU) 2017/593 (among others). These two pieces of legislation will apply from 2 August 2022 and 22 November 2022, respectively.

Investment firms providing advice and portfolio management will have to collect information about their clients' ESG preferences and include this information in their suitability assessment. In addition, such investment firms will have to adapt their risk management and conflict processes to comply with these delegated acts.

Digital finance strategy

In the context of the digital finance package including a digital finance strategy (Back to 2020), the EU Commission has announced its intention to adopt a legislative proposal for a new open finance framework by mid- 2022. This proposal purports to enable data-driven innovation in finance.

In addition, in November 2021, the Council of the EU published a document containing a mandate for negotiations with the EU Parliament on the proposed regulation on markets in cryptoassets (MiCA), the proposed regulation on digital operational resilience (DORA), and a proposal for a directive amending several Directives (i.e. including but not limited to: CRD 4, PSD 2, MiFID 2) (Amending Directive). As a reminder, the objective of the package is to ensure a competitive, innovative and digital-resilient financial market on the one hand, and on the other hand to ensure consumer protection and financial stability. In this document, the Council of the EU suggests that its Committee of Permanent Representatives agree on the negotiating mandate with the proposed MiCA, DORA and Amending Directive and also invites the Presidency to start negotiations with the EU Parliament, on the basis of the mandate, to reach agreement at first reading.

Finally, the proposal for a regulation on a pilot regime for market infrastructures based on distributed ledger technology (DLT pilot regime) that is part of the digital finance strategy is now under negotiations with the EU Parliament in trialogues.

Securitisation Regulation - the future to be revamped soon

In July 2021, the EU Commission published a consultation on the functioning of the EU securitisation framework. The consultation was part of its Capital Markets Union 2020 action plan. The EU Commission is required to prepare a report to the EU Parliament and the Council of the EU on the functioning of the EU Securitisation Regulation (accompanied by a legislative proposal, if appropriate) by 1 January 2022. The consultation focuses on a range of different issues, including: the effect of the EU Securitisation Regulation, private securitisations, due diligence, disclosure of information on environmental performance and sustainability.

Click here to continue reading . . .

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.