Conduct complaints and out-of-court dispute resolution in Luxembourg (CSSF)

Luxembourg’s conduct-complaints regime is unusually clean: one supervisor, one written procedure, and one out-of-court resolution body — the CSSF itself. A firm authorised in Luxembourg has to run an internal complaints function to a defined standard, answer within a month, and then be ready for the customer to escalate to the CSSF’s own alternative-dispute-resolution procedure. Get the internal clock and the signposting right and most disputes never leave the firm; get them wrong and the first the firm hears of it is a CSSF request file. This is the operational walkthrough for a payments or e-money firm.

1. Who supervises conduct in Luxembourg

Unlike France’s ACPR/AMF split, conduct supervision in Luxembourg is concentrated in a single authority:

• The CSSF (Commission de Surveillance du Secteur Financier) supervises conduct across the financial sector — credit institutions, payment institutions and e-money institutions, investment firms and other supervised professionals.
• The same authority also operates the out-of-court complaint-resolution procedure. So the body that supervises whether your complaints function is adequate is also the body a dissatisfied customer escalates to.
• The CSSF does not award damages. Its resolution procedure seeks an amicable settlement; the supervisory interest is whether the firm handled the complaint properly.

That single-authority design means there is no ambiguity about which ombudsman is competent — a contrast with Germany’s patchwork of recognised private schemes.

2. Legal basis

• CSSF Regulation No 16-07 relating to out-of-court complaint resolution — the core instrument setting the firm’s internal-handling duty and the CSSF procedure.
• Circular CSSF 17/671 (as amended by Circular CSSF 18/698) — the detailed rules on complaints handling in the financial sector, specifying the internal organisation, the responsible-person requirement and the reporting expectations.
• Directive 2013/11/EU on consumer alternative dispute resolution — transposed into Luxembourg law and reflected in the Consumer Code; the CSSF acts as the recognised ADR entity for the financial sector.
• PSD2 (Directive (EU) 2015/2366), Article 101 — as transposed in Luxembourg, the statutory reply deadlines for payment-services complaints.

3. The firm’s own complaints-handling function

Under Circular CSSF 17/671, every supervised entity — including a payment or e-money institution — must operate a documented complaints-management procedure and put a person at an appropriately senior level in charge of it. The concrete build:

• A written complaints-handling policy, approved by management, published or made available to customers free of charge;
• A designated person responsible for complaint handling at management level, and a clear internal escalation path;
• A complaints register capturing the complaint, the date received, the handling and the outcome, so the firm can analyse patterns and report to the CSSF on request;
• An acknowledgement to the complainant and a substantive answer within the deadline.

For payment-services complaints, PSD2 Article 101 imposes a shorter, specific clock: a final reply within 15 business days of receipt, extendable to 35 business days in exceptional cases where the answer cannot be given in time, with an interim holding reply explaining the delay. For complaints generally, the CSSF framework sets a one-month response expectation. Run both clocks: the payment-specific 15-day deadline for payment complaints, the one-month standard for the rest.

4. The one-month rule and the escalation trigger

The one-month response duty is not just good practice — it is the gate to escalation. If the firm has not provided a satisfactory answer within one month of the complaint reaching the person responsible for complaint handling, the customer becomes entitled to take the matter to the CSSF. In practice the CSSF will ask the customer to show either the firm’s reply or confirmation that no reply arrived within the month. The lesson: a missed one-month deadline effectively hands the customer the escalation, so the internal clock is the single most important control in the whole regime.

5. The CSSF out-of-court resolution procedure

Where the internal process has run its course, the customer can request the CSSF’s out-of-court resolution. Its features:

• Voluntary and free of charge — the CSSF conducts the procedure in writing, and neither party needs legal representation.
• A one-year window — the customer must bring the request to the CSSF within one year of having filed the complaint with the firm.
• Admissibility filters — the same matter must not already be, or have been, before a court, an arbitrator or another dispute-resolution body.
• A reasoned conclusion — the CSSF issues its reasoned position within around 90 days of confirming the file is complete, extendable for complex cases.
• Non-binding — the CSSF proposes a resolution; it cannot impose a settlement or order compensation.

The request is made on the CSSF’s dedicated out-of-court complaint-resolution form. The firm will be asked for its file and its position, so the quality of the internal complaints record directly shapes how the CSSF procedure goes.

6. The cross-border angle

Luxembourg is a base for firms passporting across the EU, so cross-border complaints are common. Two points matter. First, the CSSF is the competent ADR entity for complaints against a Luxembourg-authorised firm, wherever the customer is located. Second, the CSSF participates in FIN-NET, the European Commission’s network of national financial dispute-resolution schemes, which routes a consumer in one member state to the competent scheme in another. A Luxembourg firm serving customers abroad should therefore signpost the CSSF procedure — and, for cross-border consumers, the FIN-NET route — in its terms and on its website.

7. What the CSSF does with the data

Complaints information feeds the CSSF’s conduct supervision. The regulator can request a firm’s complaints data, and recurring complaint themes or a pattern of escalations are a supervisory signal that can prompt a thematic review or a request for remediation. A firm should treat its complaints register as management information and an early-warning system, not a compliance archive — a cluster of complaints on one product is a supervisory theme in the making.

8. Worked examples

Facts: A Luxembourg-authorised e-money institution receives a written complaint about a frozen account and, amid an internal investigation, sends no substantive reply within a month.

What the rule says: CSSF Regulation 16-07 and Circular 17/671 set the one-month response duty; a missed month entitles the customer to escalate to the CSSF within one year.

What the practitioner does: Fixes the process by hard-coding a day-25 checkpoint that either closes the case or sends a reasoned holding response, and confirms the designated responsible manager is receiving the complaint queue — so future complaints do not silently age past the month.

Facts: A payment institution gets a complaint about an unauthorised card transaction and treats it on the general one-month track.

What the rule says: Payment-services complaints fall under PSD2 Article 101 — 15 business days, extendable to 35 only with a reasoned interim reply — which is shorter than the general month.

What the practitioner does: Routes payment complaints to the 15-day workflow rather than the one-month one, with a checkpoint that fires the holding-reply template before day 15 where the case will run long. Outcome: the correct, shorter clock governs payment disputes.

Facts: A Luxembourg EMI passporting into another member state receives a complaint from a consumer resident there who is unsure where to escalate.

What the rule says: The CSSF is the competent ADR entity for the Luxembourg-authorised firm, and FIN-NET connects the consumer’s national scheme to it.

What the practitioner does: Signposts the CSSF out-of-court procedure and the FIN-NET route in its terms and complaint-response letters, so the customer reaches the competent entity without the firm having to field a jurisdiction argument. Outcome: a clean escalation path and no signposting finding.

9. FAQ

10. What to do, today

• Appoint and document the person at management level responsible for complaint handling, and publish a free complaints-handling policy.
• Run two clocks: the PSD2 15-business-day deadline for payment complaints, the one-month standard for the rest, each with a pre-deadline checkpoint.
• Treat the one-month deadline as the escalation gate it is — a missed month hands the customer the CSSF route.
• Signpost the CSSF out-of-court procedure — and FIN-NET for cross-border consumers — in terms, on the website and in complaint responses.
• Wire the complaints register into management reporting; a product-level cluster is a supervisory theme in waiting.

Related: EMI licence in Luxembourg (CSSF) · How to file a SAR in Luxembourg (CRF, goAML) · Conduct complaints in Germany (BaFin, Schlichtung)