Prudential regulators
CSSF for most financial-sector and fund permissions, CAA for insurance, and the ECB for euro-area bank authorisation decisions.
Jurisdiction dossier
Luxembourg financial permissions and regulator dossier
Luxembourg is not one funds licence. The CSSF supervises banks with the ECB, payment and e-money institutions, investment firms, specialised and support professionals of the financial sector, fund managers, regulated investment vehicles, market infrastructure, crowdfunding and crypto-asset services. The Commissariat aux Assurances (CAA) separately supervises insurance, reinsurance, insurance professionals, intermediaries and part of the pension perimeter. This dossier separates a licensed operator from an authorised, registered or unregulated product as of July 2026.
Route facts
Luxembourg regulatory map
Fund architecture
UCITS, Part II UCIs, SIFs, SICARs, RAIFs and securitisation vehicles do not all have the same approval or supervision status.
Service-provider layer
ManCos, AIFMs, depositaries, administrators, investment firms and PFS need their own permissions where their functions are regulated.
Payment and crypto
PI, EMI, AISP and MiCA CASP are distinct routes; an Article 60 notification is available only to specified existing financial entities.
Capital basis
Legal minimums and ongoing own funds, solvency or expenditure requirements vary by institution, service and fund-management route.
Review date
Last reviewed against official CSSF, CAA and ECB material on 11 July 2026.
Read the structure first
The vehicle, manager and functionary are different permissions
Luxembourg's fund vocabulary can obscure the legal perimeter. A UCITS, Part II UCI, SIF or SICAR follows its product law and, where required, CSSF authorisation. A RAIF is not itself approved by the CSSF before launch, but it must be managed by an authorised external AIFM and use the service-provider architecture required by its law. A fund approval does not authorise its sponsor to manage portfolios, hold client assets or act as depositary. Those functions sit with the appropriately authorised ManCo, AIFM, credit institution, investment firm or PFS.
The same separation controls fintech. A PI provides only approved payment services; an EMI may issue e-money and approved payment services; an AISP registration covers account information. MiCA CASP authorisation covers only the approved crypto-asset services. Luxembourg incorporation, a trade authorisation, a fund launch, an AML registration or use of a regulated service provider never supplies a missing financial permission. The CSSF and CAA registers, the authorisation decision and current licence conditions are the evidence, not a product name.
Permission matrix
Luxembourg financial authorisation and product families
| Permission family | Regulator and instrument | Activities and exclusions | Entry and capital basis |
|---|---|---|---|
| Permission family Credit institutions | Regulator and instrument ECB authorisation with CSSF assessment under the SSM and Law of 5 April 1993 on the financial sector | Activities and exclusions Accept deposits, grant credit and provide only banking and investment services available under law and the grant; third-country branches follow a distinct CSSF route | Entry and capital basis Luxembourg registered office and central administration, qualifying holders, fit-and-proper management, governance and CRR capital, liquidity and recovery evidence |
| Permission family Payment institution | Regulator and instrument Written CSSF authorisation under the Law of 10 November 2009 on payment services | Activities and exclusions The PSD2 payment services printed on the authorisation; excluded and limited-network activity may require notification but is not a PI licence | Entry and capital basis Luxembourg establishment, robust governance, initial and ongoing own funds, safeguarding, security, AML/CFT, incident, agent and outsourcing controls |
| Permission family Electronic money institution and AISP | Regulator and instrument CSSF EMI authorisation or AISP registration under the payment-services law | Activities and exclusions EMI status permits e-money issuance and approved payment services; an AISP registration covers account information only and neither status permits deposit taking | Entry and capital basis EMI capital, own funds, safeguarding and redemption rules differ from AISP professional-cover and registration requirements; scope must be fixed before filing |
| Permission family Standalone cash foreign exchange | Regulator and instrument No current Article 28-2 PFS authorisation after its 2021 repeal; business-permit and AML/CFT rules apply, while payment-linked FX belongs within an eligible bank, PI or EMI grant | Activities and exclusions Buy or sell physical currency only within the applicable commercial perimeter; remittance, accounts, e-money, FX derivatives, investment dealing and deposits each require their own regulated status | Entry and capital basis Confirm the current business permit, professional integrity, fixed establishment, cash, pricing, record and AML/CFT controls, and whether any payment or investment service displaces the commercial route |
| Permission family Investment firms | Regulator and instrument CSSF authorisation under the financial-sector law, MiFID II and the Investment Firms Regulation | Activities and exclusions Dealing, execution, reception and transmission, portfolio management, advice, underwriting, placement, custody or venue functions only where granted | Entry and capital basis Commercial company, Luxembourg registered office and central administration, qualifying holders, management, prudential class, client assets and compensation-scheme participation |
| Permission family Specialised and support PFS | Regulator and instrument CSSF authorisation for the relevant professional of the financial sector category under the 1993 law | Activities and exclusions Category-specific financial, administration, registrar, communication, systems or support functions; PFS status is not a general investment-firm, bank or fund-manager permission | Entry and capital basis Accepted legal form, central administration, managers, owners, professional standing and category-specific capital or insurance follow the exact PFS status |
| Permission family Lending, leasing, factoring and credit intermediation | Regulator and instrument CSSF Article 28-4 authorisation for a professional performing lending operations; credit intermediaries use the separate Consumer Code, mortgage-credit and business-permit route where applicable | Activities and exclusions Grant loans to the public for own account, including qualifying financial leasing and factoring, only within the authorised PFS scope; intermediation does not permit lending, deposits or payments as principal | Entry and capital basis Luxembourg legal form and central administration, suitable owners and managers, statutory own funds, funding, credit governance, risk, consumer treatment and AML/CFT; intermediaries need their own integrity, competence and registration evidence |
| Permission family UCITS management company | Regulator and instrument CSSF Chapter 15 authorisation under the Law of 17 December 2010 | Activities and exclusions Collective portfolio management of UCITS and permitted ancillary functions; a Chapter 16 company has a different and narrower legal basis | Entry and capital basis Luxembourg substance, senior management, risk and compliance, delegation oversight, initial capital and additional own funds follow assets and services |
| Permission family Alternative investment fund manager | Regulator and instrument CSSF authorisation or registration under the Law of 12 July 2013 on AIFMs | Activities and exclusions Portfolio and risk management of AIFs plus authorised ancillary services; sub-threshold registration is not full AIFM authorisation and has different reach | Entry and capital basis Full or registered status drives own funds, substance, valuation, depositary, delegation, leverage, reporting and marketing requirements |
| Permission family UCITS and Part II UCI | Regulator and instrument CSSF product authorisation under the 2010 law | Activities and exclusions Regulated collective investment vehicle within its approved investment and investor perimeter; product authorisation does not license the promoter or service provider | Entry and capital basis Fund constitution, prospectus, manager, depositary, administration, valuation, risk, minimum assets and reporting must satisfy the relevant product regime |
| Permission family SIF, SICAR and RAIF | Regulator and instrument CSSF-authorised SIF or SICAR; RAIF under its 2016 law without direct product approval | Activities and exclusions Alternative fund structures for eligible investors. A RAIF must use an authorised external AIFM and should never be marketed as CSSF-approved | Entry and capital basis Investor eligibility, risk-spreading or risk-capital purpose, manager, depositary, administration, offering document and statutory minimum assets depend on vehicle choice |
| Permission family Securitisation undertaking | Regulator and instrument CSSF authorisation where the securitisation law treats the undertaking as supervised; otherwise statutory vehicle regime | Activities and exclusions Acquire or assume securitisation risks and issue instruments or financing interests; an unregulated vehicle is not a CSSF licensee | Entry and capital basis Public and continuous issuance characteristics determine supervision; governance, compartment, investor disclosure and service-provider arrangements follow the structure |
| Permission family Insurance, reinsurance and captives | Regulator and instrument CAA authorisation under the Law of 7 December 2015 on the insurance sector and Solvency II | Activities and exclusions Life, non-life, reinsurance or captive underwriting within authorised classes; a captive is an insurer, not a lightly registered company | Entry and capital basis Luxembourg head office, qualifying shareholders, fit-and-proper key functions, governance, technical provisions, minimum and solvency capital and reinsurance programme |
| Permission family Insurance professionals and intermediaries | Regulator and instrument CAA authorisation or registration for PSA, brokers, agents and other distribution roles | Activities and exclusions Insurance-sector professional or distribution functions within the category; intermediary status never permits underwriting on the firm's balance sheet | Entry and capital basis Professional competence, good repute, governance, professional cover and financial resources vary between PSA, broker, agent and ancillary intermediary |
| Permission family Crypto-asset service provider | Regulator and instrument CSSF Article 63 MiCA authorisation or Article 60 notification for an eligible financial entity | Activities and exclusions Approved custody, platform, exchange, execution, placing, order, advice, portfolio-management or transfer services; no automatic fiat payment or deposit permission | Entry and capital basis EU registered office and effective management, suitable owners and managers, prudential safeguards, custody, complaints, ICT, conduct, conflicts and AML/CFT |
| Permission family Crowdfunding service provider | Regulator and instrument CSSF authorisation under Regulation (EU) 2020/1503 | Activities and exclusions Operate an ECSPR investment- or lending-based platform; the authorisation does not itself permit deposit taking, balance-sheet lending or a trading venue | Entry and capital basis Prudential safeguards, governance, conflicts, investor protection, credit scoring where used, default management, complaints and continuity |
| Permission family Pension funds and retirement vehicles | Regulator and instrument CSSF or CAA authorisation depending on the statutory pension-fund form | Activities and exclusions Operate the pension arrangement defined by the selected law; pension approval is distinct from portfolio-management, insurance or depositary permission | Entry and capital basis Sponsor, governance, actuarial or funding method, manager, custodian, investment policy, member information and supervisory reporting follow the chosen form |
| Permission family Domiciliation and fiduciary services | Regulator and instrument Regulated status where the financial-sector or professional law reserves the service; otherwise AML and company-law perimeter | Activities and exclusions Company domiciliation and administration only by persons legally entitled to provide them; incorporation alone is not a CSSF trust-company licence | Entry and capital basis Confirm the provider's professional status, good repute, local substance, AML/CFT obligations and whether a PFS or other reserved professional category is triggered |
| Permission family Gambling, sports betting, lotteries and tombolas | Regulator and instrument Ministry of Justice authorisation, or the competent municipality for qualifying lower-value lotteries, under the Law of 20 April 1977 and specialist rules | Activities and exclusions Casino and similar games, sports betting, lotteries or tombolas only where the restrictive national route permits them; there is no CSSF or CAA financial licence or general online-gambling passport | Entry and capital basis Applicant integrity, tourism or public-interest eligibility, concession or authorisation terms, game and prize rules, financial security, tax, AML/CFT and supervision depend on the limited route |
Entry test
Central administration, governance and financial resources
Luxembourg applicants must establish the legal form and local decision-making centre required by the instrument. The CSSF describes central administration as the functions of direction, management, execution and control that allow the institution to control its activities from Luxembourg. The CAA applies equivalent substance and governance scrutiny to insurers and insurance professionals. Both authorities examine direct and indirect qualifying holders, funding, reputation, directors and key function holders. Delegation and outsourcing are possible within the sector rules, but the authorised body retains oversight and accountability.
Financial resources follow the institution and activity. Banks use CRR; PI and EMI use initial and ongoing own-funds calculations plus safeguarding; investment firms use their prudential class; ManCos and AIFMs combine initial capital with additional own funds or cover; insurers use Solvency II. Fund minimum assets are product requirements, not a substitute for the manager's capital. Current CSSF and CAA schedules control application and annual charges. A dossier should name the calculation and source rather than compressing these routes into one EUR figure.
Application path
A Luxembourg authorisation, stage by stage
-
Separate institution, product and service-provider permissions
Map the operating company, credit or FX activity, each fund or token product, manager, depositary, administrator, distributor, gambling function and outsourcing to its own CSSF, CAA, Ministry of Justice or commercial authorisation, registration, notification or exemption.
-
Confirm the competent authority and filing channel
Use CSSF, CAA or ECB pre-filing material. Bank files use the SSM channel; CSSF and CAA routes have sector contacts and electronic submission requirements.
-
Evidence Luxembourg substance
Prepare ownership and funding, central administration, senior-management and key-function files, business plan, projections, AML/CFT, risk, safeguarding or client assets, delegation and ICT controls.
-
Complete regulator review and product sequencing
Answer completeness and substantive questions and align any manager, fund, depositary or insurer approvals. A vehicle cannot launch merely because another participant's file is progressing.
-
Satisfy conditions before regulated activity
Complete capital, appointments, agreements, systems, reporting access and register publication or product formalities before relying on the permission.
After authorisation
Ongoing supervision and change in control
CSSF and CAA supervised entities maintain capital or solvency, governance, AML/CFT, audit, regulatory returns, client-asset or safeguarding controls, complaints, conduct, valuation, delegation, outsourcing and ICT resilience required by their sector. Products maintain their prospectus or offering-document, valuation, depositary, investor-reporting and change mechanics. A variation in activities, new branch, material delegation, manager replacement or restructuring can trigger prior approval or notification.
A regulated entity's shares may change hands, but its permission is not sold separately. Acquisitions and increases or reductions in qualifying holdings follow the CSSF, CAA or ECB controller procedure applicable to the institution. Buyer diligence should cover the exact authorisation, PFS category or product status; capital and liquidity; fund functionaries; client assets; inspections; regulator correspondence; sanctions; outsourcing and remediation. The competent authority decides whether the incoming holder is suitable, and no adviser can guarantee approval.
Territorial reach
Passporting belongs to the authorised scope
Harmonised banks, PI, EMI, investment firms, ManCos, AIFMs, insurers and CASPs can use the EU or EEA cross-border procedures available under their governing legislation after the required notifications. That right follows only the activities and products covered by the home-state permission. A RAIF's existence, a registered AIFM, support-PFS status, an excluded payment arrangement or Luxembourg incorporation creates no general passport. Host-state marketing, consumer, distribution and general-good rules remain relevant, and third-country activity requires a separate market-by-market analysis.
Verify it yourself
Primary Luxembourg sources
-
CSSF authorisation pages and entity search
cssf.lu publishes the legal requirements, filing procedures and official entity search for banks, PI and EMI, investment firms, PFS, managers, funds, crowdfunding and CASPs.
-
Payment-services law and PI or EMI procedure
The CSSF states that no Luxembourg person may provide payment services or issue e-money without written authorisation, subject to defined exclusions and registrations.
-
Fund and manager authorisation catalogue
CSSF product and manager pages distinguish Chapter 15 and 16 ManCos, AIFMs, UCIs, pension funds, securitisation undertakings and EU labels.
-
CAA operator and authorisation material
caa.lu identifies the CAA's remit and publishes insurance, reinsurance, captive, PSA, intermediary and pension operator records and current circulars.
-
ECB Banking Supervision
The ECB licensing and qualifying-holding guides control bank authorisation decisions within the SSM, in cooperation with the CSSF.
-
Lending, commercial and gambling sources
CSSF specialised-PFS material and the current financial-sector law cover Article 28-4 lenders; Guichet.lu publishes business-permit routes, and the Ministry of Justice publishes casino, betting, lottery and tombola authorisations.
01 Is a RAIF authorised by the CSSF?
No direct product authorisation is granted to the RAIF. The structure operates under its statute and must appoint an authorised external AIFM and the required Luxembourg service providers. Those regulated parties do not turn the RAIF itself into a CSSF-approved fund.
02 Does a fund approval let the sponsor manage it?
No. The vehicle and manager are separate. Portfolio and risk management must sit with a ManCo, AIFM or other person authorised for the function, and depositary, administration and investment services require their own eligible providers.
03 Can a Luxembourg CASP provide payment accounts?
Not from MiCA authorisation alone. A CASP grant covers the listed crypto-asset services. Fiat payment accounts, e-money, acquiring or remittance need analysis under the payment, EMI or banking perimeter.
04 Is every PFS an investment firm?
No. The financial-sector law contains investment firms, specialised PFS and support PFS with different permitted functions, prudential requirements and client perimeters. The exact category printed in the CSSF register matters.
05 Can an authorised Luxembourg entity be acquired?
Shares may be acquired subject to the relevant qualifying-holding process. The permission remains with the entity, the incoming holder and funding are assessed, and all product, delegation and supervisory history must be diligenced.
Reviewed by the SKY7 advisory team. Last reviewed: 11 July 2026. This dossier is general information, not legal, regulatory, tax, investment or financial advice. It describes the Luxembourg architecture as of July 2026. Verify the current law, CSSF and CAA rules, entity and product registers, Ministry of Justice and business-permit rules, licence conditions, fee schedules and ECB procedures before relying on a route. No regulator outcome is promised.
Tell us what you need
Build the Luxembourg permission map first
Send the services, vehicle and fund structure, investors, flow of funds, delegation model, target markets and ownership chain. SKY7 will separate institution, manager, product and functionary permissions before a filing or acquisition decision. Fees are on request.