BCL payment statistics: Luxembourg PI and EMI reporting

BCL payment statistics are the monthly V-reports every Luxembourg payment institution and e-money institution owes the Banque centrale du Luxembourg, fraud tables included. The obligation rests on BCL Regulation 2021/N°30 of 12 July 2021, which implements ECB Regulation (EU) No 1409/2013 as amended by Regulation (EU) 2020/2011 (ECB/2020/59) and folds in the EBA fraud-reporting guidelines under Article 96(6) PSD2. The collection, CDDP6, has applied since the January 2022 reference period and runs as XML files, one per table. This guide covers the population, the 33 tables, the two deadlines, the geographical dimensions that catch passporting firms, exemptions and sanctions.

1. The legal stack: ECB regulation, BCL regulation, BCL manual

Three layers decide what you file. The European content sits in Regulation (EU) No 1409/2013 (ECB/2013/43), as amended by Regulation (EU) 2020/2011 of 1 December 2020 (ECB/2020/59). Its Article 3(1) sends each reporting agent to the central bank of the member state where it is resident and leaves the national arrangements to that bank; see the ECB payment statistics regulation.

The national layer is BCL Regulation 2021/N°30 of 12 July 2021 en matière de statistiques de paiement, in French only. It cites the amended ECB regulation, ECB Guideline (EU) 2021/832 (ECB/2021/13), the EBA fraud-reporting guidelines and the Law of 10 November 2009 on payment services. It repealed BCL Regulation 2011/N°9 of 4 July 2011, as amended by Regulation 2015/N°20, which governed the old CDDP5 layout.

The third layer is the BCL Manual on payment statistics, an Excel workbook that Article 9 makes part of the framework and that the BCL may update. The current version is dated 12 December 2023; a separate Q&A was last updated in April 2025. The manual is where the dimensions, codes and examples live.

2. Who reports

Article 2 of the BCL regulation names four types of reporting agent: credit institutions, e-money institutions, payment institutions, and the national postal operator for its payment activities. It applies to Luxembourg-law legal persons and to Luxembourg branches of credit, e-money and payment institutions authorised in another EU member state or in a third country. The manual puts it more simply: all payment service providers and branches located in Luxembourg report their payment activity.

The recitals make the BCL the single point of contact for payment statistics, without prejudice to the CSSF’s collection powers. The CSSF adopted the EBA fraud guidelines through Circular CSSF 19/712 and directed the fraud reporting to the BCL, and Article 7 lets the data serve the BCL, the CSSF, the ECB and the EBA. Since January 2022 the fraud data travel inside CDDP6, in a single data flow to the ECB and on to the EBA. The CSSF’s own periodic tables remain separate; see CSSF legal reporting.

A payment or e-money institution is not a reporting agent for the BOP 1.2 cross-border payments return, which is limited to credit institutions and the postal financial services.

3. What is collected: the 33 V-tables

Article 3 of the regulation lists the subject matter; the manual turns it into numbered tables. Only executed transactions with a non-MFI on at least one side are in scope, except the interbank and intermediated tables.

The manual marks in red what comes from ECB/2020/59; the rest, such as V1.100, are BCL needs, equally binding. Every fraudulent transaction must match a payment row with the same dimensions. For the fraud taxonomy behind the codes, see PSD2 fraud reporting and fraud losses per liability bearer.

4. Frequency and the two deadlines

Everything is monthly. Article 4 of the BCL regulation sets two clocks:

• Transaction and stock tables: within ten working days after the reference month.
• Fraud tables: within two months and ten working days after the reference month.

The BCL’s Q&A puts this at roughly mid-M+1 for payments and mid-M+3 for fraud: January payments go in February, January fraud in April. The lag lets late-detected fraud land in its original month without corrections, so the BCL recommends sending fraud files shortly before the deadline.

That monthly rhythm is tighter than the BCL’s own transmissions to the ECB, which run on quarterly, semi-annual and annual cycles. The BCL collects monthly and aggregates, and the firm-level obligation is the one the BCL sets. Count Luxembourg working days, not calendar days, when you set the internal cut-off.

5. Format, transmission, quality and sanctions

Data go as XML, one file per table and reference period, following the CDDP6 XML schemas published on the BCL site. The BCL’s Q&A counts 33 files a month for an initial transmission. Tables need not arrive together, but each must arrive before its deadline. The Q&A says the BCL checks that every table, empty or not, has been received, and agrees the list of relevant tables bilaterally where there is doubt. An empty table is just the XML header.

The BCL’s technical note fixes the file name (table number with -F for fraud, layout, month, reporter and declarant, creation date, sequence). Identifiers are the nine-digit CSSF number prefixed W for an e-money institution or Z for a payment institution; header type codes are 37 and 38. Values are in the accounting currency, with a separate dimension for the original currency.

Transmission must use the secure electronic channels named in the regulation and in the BCL’s circular letter. Since circular letter ST.24-0013 of 15 January 2024, the BCL no longer accepts statistical reports by e-mail.

Corrections replace, they do not patch: a corrective transmission resends the complete table, and the BCL keeps only the latest version. Article 6 requires reports and supporting documents to be kept for twenty-four months.

Under Article 5 the firm checks quality before sending, against the manual’s verification rules, and must answer the BCL’s quality questions. Circular letter ST.24-0013 applies Regulation (EU) 2022/1917 (ECB/2022/31) on infringement procedures to payment statistics from 30 April 2024. The ECB may impose sanctions of up to EUR 200,000 for breaches of the minimum standards on transmission, accuracy and concepts. Systematic or intentional failures count as serious misconduct; otherwise a warned agent may offer a remedial plan. Article 8 of the BCL regulation also lets the BCL publish breaches.

6. The geographical dimensions that catch passporting firms

CDDP6 has no single “country” field. Each table carries the country dimensions the ECB needs for that instrument, and they are not interchangeable:

• Credit transfers and direct debits (V1.20, V1.21, V1.30, V1.31): the country of the counterparty’s PSP.
• Cards issued (V1.50, V1.50-F): country of the acquirer and country of the terminal; V1.51 splits by MCC and country of terminal.
• Cards acquired (V1.52): country of the issuer and country of the terminal.
• E-money: V1.91 carries the country of the debtor’s and creditor’s e-money scheme and of both parties’ residence; V1.221 counts e-money accounts by country of residence of the account holder.
• Card stocks (V1.200): country of distributor, which is LU when the issuer distributes its own cards.

Residence is the other rule to settle early. Annex I of ECB/2020/59 treats an institution’s branches in other euro area member states as residents of those states, and branches outside the euro area as residents of the rest of the world. Cross-border consolidation is not permitted, so a euro area branch reports to its host central bank, just as a foreign institution’s Luxembourg branch reports to the BCL.

7. Exemptions and derogations

There are two separate routes, and they are easy to confuse.

1. The BCL exemption. The manual allows an exemption for a PSP that offers none of the payment services in Annex I PSD2 and none of the other services the CDDP collects. The Q&A sets three conditions: no Annex I PSD2 payment services, no interbank (V1.41) or intermediated (V1.42) transactions, and no payment accounts. Requests are decided case by case and an exemption lasts at most one year, after which a new request is needed.
2. The ECB derogation. Article 4 of the ECB regulation, as amended, lets central banks grant derogations to PIs and EMIs that meet the small-institution conditions of Article 32(1)-(2) PSD2 or Article 9(1)-(2) EMD2. Article 2 of the BCL regulation provides that a reporting agent holding an ECB derogation is automatically exempt under the BCL regulation too.

The BCL publishes no standing policy for the second route, so ask in writing and keep the answer.

8. Three worked scenarios

Facts: A Luxembourg EMI issues debit-type cards linked to e-money accounts to consumers across the EEA under the freedom to provide services. It has no branches. Its pipeline produces one Luxembourg card file with all activity booked to LU.

Rule: With no branches, the EMI is the only resident reporting agent for all of it, so everything belongs in its BCL file. The country dimensions describe the transaction, not the issuer: V1.50 needs the country of the acquirer and of the terminal, V1.51 the MCC and terminal country, V1.221 the account holder’s country of residence, and V1.91 the residence of both parties. What the practitioner does: takes terminal and acquirer country from clearing data and residence from KYC, and adds V1.90, V1.200, V1.50-F and V1.300-F. Outcome: a tap at a French terminal shows as FR terminal activity in the Luxembourg return.

Facts: A Luxembourg PI runs a money remittance service through agents in Belgium and Portugal, and opens a branch in Ireland.

Rule: The ECB annex speaks of subsidiaries and branches. The Irish branch is resident in Ireland and reports to the Central Bank of Ireland. The annex does not mention agents. An agent acts for its principal and is not itself a PSP, so the working assumption is that agent-originated transactions are the principal’s and belong in its Luxembourg file. The geographical split then comes from the table dimensions, such as the counterparty PSP country in V1.60, not from where the agent’s shop is. What the practitioner does: removes the Irish branch’s activity from the BCL file, checks the agents’ activity is in it, and asks the BCL to confirm how it wants agent-originated remittances shown. Outcome: no double counting with Ireland and no gap for the agents.

Facts: A newly authorised EMI gets its CSSF licence in mid-March and goes live in April.

Rule: Article 2 makes it a reporting agent once authorised. The Q&A puts the duty on the firm to tell the BCL about each new payment service, because it can create new tables. What the practitioner does: contacts payments.statistics@bcl.lu on authorisation, agrees the table list, sets up a secure channel and builds the XML to the published schemas. Outcome: no published BCL text sets the first reference period for a new firm, so it gets the BCL to confirm in writing which month its first file covers.

9. FAQ

10. What to do, today

• Head of regulatory reporting: put the ten-working-day and two-months-plus-ten-working-days deadlines into the Luxembourg reporting calendar, with a buffer for one rejection cycle.
• Data engineering: check every country dimension against its definition (terminal, acquirer, counterparty PSP, residence), and confirm no branch activity outside Luxembourg is in the BCL file.
• Fraud operations: book fraud to the reference month of the original transaction and match every -F row to a payment row with the same dimensions.
• Compliance: file a written exemption or derogation request if you qualify, diary the one-year renewal, and tell the BCL before any new payment service goes live.

Related: ECB payment statistics regulation · BOP 1.2 to the BCL · Luxembourg reporting calendar · NBB payment statistics