ACD CRS reporting in Luxembourg for EMIs and PIs

CRS reporting in Luxembourg goes to the Administration des contributions directes (ACD), and from the 2026 reporting year it reaches e-money and payment institutions that used to sit outside it. Until the end of 2025 the ACD’s own position was that a Luxembourg payment or e-money institution was not a Depository Institution, because the funds it receives are not deposits. The law of 27 March 2026, which transposes DAC8, changed the definitions with effect from 1 January 2026. The first return under the new rules is due by 30 June 2027, in a new XML schema.

1. The legal basis: two laws and their amendments

Luxembourg runs CRS and FATCA under two separate statutes, both administered by the ACD.

• CRS: the amended Law of 18 December 2015, published in Mémorial A n° 244 on 24 December 2015, which transposed Directive 2014/107/EU (DAC2). Its current title refers to it as the law on the Norme commune de déclaration (NCD). The lists of participating and reportable jurisdictions sit in the amended Grand-Ducal Regulation of 15 March 2016, most recently updated in March 2026.
• FATCA: the amended Law of 24 July 2015, which approved the Model 1 intergovernmental agreement Luxembourg signed with the United States on 28 March 2014.
• 2020 amendments: the Law of 18 June 2020 amended both statutes together. It made nil reporting compulsory, required documented policies, controls, procedures and IT systems, set a ten-year record-keeping period and reshaped the penalties. It applied from 1 January 2021.
• DAC8: the Law of 27 March 2026 transposes Council Directive (EU) 2023/2226. It creates the crypto-asset reporting regime and, in its Article 12, amends the CRS law to bring in the OECD’s 2023 CRS amendments, including the e-money and central bank digital currency rules. Article 17 makes it applicable from 1 January 2026, even though it was adopted after that date.

2. Before 2026: why EMIs and PIs were outside

The ACD’s CRS FAQ set out the earlier position clearly. Under the amended Law of 10 November 2009 on payment services, funds received by payment and e-money institutions are not deposits or other repayable funds within the meaning of Article 2(3) of the Law of 5 April 1993 on the financial sector. Those institutions are also prohibited from taking deposits. They therefore did not meet the CRS Depository Institution test of accepting deposits in the ordinary course of a banking or similar business.

The FAQ added one reservation: an institution whose activities went beyond payment services and e-money issuance could still qualify as a Financial Institution for those other activities. That reservation still applies. What changed in 2026 is the core e-money test.

3. From 1 January 2026: the e-money rules

Article 12 of the 2026 law amends Annex I, section VIII of the CRS law in three ways that matter to an EMI.

• Depository Institution now also covers any entity that holds Electronic Money or Central Bank Digital Currencies for customers. The OECD text calls the same concept a Specified Electronic Money Product.
• Electronic Money is a product that digitally represents a single fiat currency. It must be issued on receipt of funds for making payment transactions, represent a claim on the issuer in that currency, be accepted in payment by someone other than the issuer, and be redeemable at any time at par. A product created only to transfer a customer’s funds on the customer’s instructions is excluded. That exclusion falls away if, in the ordinary course of business, the funds are held for more than 60 days after the instruction, or more than 60 days after receipt where there is no instruction.
• Depository Account now includes an account, or a notional account, representing all the Electronic Money held for a customer, so a customer’s balances form one account.

The ACD’s FAQ, updated in September 2026, draws the conclusion: e-money and payment institutions may now fall within CRS from 1 January 2026.

4. The USD 10,000 exclusion and the account timeline

The same article adds a new Excluded Account. A Depository Account representing all the Electronic Money held for a customer is excluded if its rolling 90-day average end-of-day balance or value never exceeds the euro equivalent of USD 10,000 on any day of the calendar year or other appropriate reporting period.

Read it carefully. The test is a rolling average checked on every day of the year, not the year-end balance. One 90-day window above the threshold brings the account back in. The exclusion applies to the account, not to the institution, so an EMI whose customers are all small is still a Reporting Financial Institution. It simply has nothing to report.

The 2026 law also sets the timeline for accounts that are Financial Accounts only because of the amendments. They are Preexisting Accounts if maintained on 31 December 2025, and New Accounts if opened from 1 January 2026. The ACD’s FAQ adds that a TIN is now required for New Accounts of EU-resident holders opened from 1 January 2026. The placeholder code #NTA001# remains a last resort, but the ACD now flags its use with a warning.

5. What changes in the report itself

For periods from 1 January 2026 the CRS law asks for more data on each reportable account. The return must now show whether a valid self-certification was obtained, the role of each Controlling Person, the account type, whether the account is preexisting or new, and whether it is joint, including the number of joint holders. A new transitional rule lets a Reporting FI that cannot obtain a self-certification in time for a new account apply the preexisting-account procedures until it receives one.

For an EMI, the reported balance is the year-end balance of the customer’s single notional e-money account.

6. Transmission: transmitters, MyGuichet and the schema

The ACD accepts no direct uploads. Files go exclusively over a secure channel, through one of two transmitters the ACD recognises, both private operators. Each offers XML upload and a manual entry form. For nil reports only, a third route exists: a guided MyGuichet procedure on guichet.lu. It does not accept XML.

Circular ECHA n° 4 defines the three message types: CRS701 for new data, CRS702 for corrections and CRS703 for nil reports. It also sets a fixed file-naming convention and requires UTF-8 encoding without a byte-order mark. A nil message carries no account records and uses LU as the destination code. The ACD rejects a nil message for a year in which data was already validated, unless that data has first been cancelled. For each file the ACD returns status messages through the same channel. It warns that batch processing slows down as 30 June approaches. FATCA follows the same pattern under Circular ECHA n° 3 of 10 August 2020, with the FATCA_LUX V3.0 schema, and MyGuichet is again limited to nil reports.

7. Onboarding with the ACD

There is no separate CRS registration. The ACD says a Reporting FI simply contracts with a transmitter of its choice, and advises doing so well before the deadline. What it does need is identifiers:

• The Luxembourg tax number (matricule) of the institution and of the filer, if a third party files. A filer without one applies to the ACD using form 914F.
• The RFI identifier: the 11-character matricule followed by a letter and eight digits. Where an institution has no suitable identifier, it asks the ACD’s Bureau de la retenue d’impôt sur les intérêts for a sequential number by email, and keeps that number in later years.
• A status-change notice: the FAQ strongly recommends telling the same office, before 30 June, of any change in CRS status that affects reporting. The notice should give the new status, the facts behind it and the year it takes effect. An EMI moving into scope for 2026 is exactly that case.

FATCA works differently. A Luxembourg FFI registers on the IRS portal to obtain a GIIN and keeps its details and Responsible Officer up to date there. Whether an EMI is an FFI under the IGA is a separate analysis; the 2026 law amended the CRS definitions, not the IGA.

8. Penalties

As amended in 2020, Article 3 of the CRS law provides a flat fine of EUR 10,000 where an institution files neither data nor a nil message by the deadline. Where an audit finds other breaches of the law, the fine can reach EUR 250,000. It can be increased by up to 0.5% of the amounts that should have been reported but were not, or were under-reported. The FATCA law mirrors these amounts. Fines are set by the Bureau de la retenue d’impôt sur les intérêts. The ACD has access on request to the institution’s records and procedures, and its investigation powers run for ten years from the end of the year in which the report was due. Institutions must keep their due diligence evidence for the same period.

9. Worked examples

A wallet book mostly under the threshold.

Facts: a Luxembourg EMI issues multi-currency e-money wallets to consumers across the EU. Most wallets hold a few hundred euros. Some business customers’ balances peak above USD 10,000 during the year, then fall back.

What the rule says: all of a customer’s e-money is one Depository Account. It is excluded only if the rolling 90-day average never exceeds the USD 10,000 equivalent on any day of the year.

What the practitioner does: computes the daily rolling average per customer, across all currencies, for the full year. Flags every account that breaches it on even one day. Runs due diligence on those holders and reports them by residence.

Outcome: a short, defensible report, rather than an empty one that an ACD audit would reopen.

A payment institution that only moves money.

Facts: a Luxembourg payment institution executes transfers and holds client funds only while a transfer is in progress, usually for a day or two.

What the rule says: a product created solely to transfer funds on the customer’s instructions is not Electronic Money, unless the funds are ordinarily held for more than 60 days.

What the practitioner does: documents the holding periods from the ledger. Records the conclusion that the institution holds no Electronic Money and is not a Depository Institution. Checks that no other activity makes it a Financial Institution, and files the analysis with board sign-off.

Outcome: a reasoned non-FI position on file, reviewed annually, rather than an unreasoned assumption.

A first filing for 2026.

Facts: an EMI concludes in late 2026 that it has been a Reporting FI since 1 January 2026.

What the rule says: the 2026 data is due by 30 June 2027 in the V3.0 schema, or as a nil message if nothing is reportable.

What the practitioner does: notifies the status change to the ACD. Confirms the matricule and RFI identifier, and signs with a transmitter. Tests on the V3.0 pre-validation platform before filing.

Outcome: a return that validates the first time, filed well before the June batch queue.

10. FAQ

11. What to do, today

• Head of compliance: document the institution’s CRS status for 2026 under the amended definitions and notify any change to the ACD before 30 June 2027.
• Data lead: build the daily rolling 90-day balance per customer, aggregated across currencies, back to 1 January 2026.
• Onboarding: collect self-certifications and EU TINs on every new account; track where a self-certification was not obtained, because the report now says so.
• Head of reporting: confirm the matricule, RFI identifier and transmitter contract, and test on the V3.0 pre-validation platform before the spring.
• MLRO and CFO: keep due diligence evidence, policies and controls in a form the ACD can inspect for ten years.

Related: CRS for EMIs · Luxembourg reporting calendar · FATCA and CRS filing in the Netherlands · CRS reporting compared across six EU states · CRS reporting in Ireland (Revenue, ROS)