CSSF · Luxembourg

CSSF Search Entities: Luxembourg PI and EMI register

Fintech Passport

October 27, 2026 · 11-min read

CSSF Search Entities: Luxembourg PI and EMI register

The CSSF entity register, published as the Search Entities application on the CSSF’s eDesk site, is the public record of which payment and e-money institutions Luxembourg has authorised, which services each may provide, and where they operate through agents and branches. For a payment or e-money institution it is a working tool. It shows your own authorisation the way counterparties see it, lists the agents and branches you have passported, and is where you start when you check a Luxembourg counterparty. This article is about using the register, not about getting a licence.

1. What the register is and where the law puts it

The legal basis is Article 36 of the Law of 10 November 2009 on payment services (the LSP), headed “Registration in Luxembourg and protection of the title”. Under Article 36(1) the Commission de Surveillance du Secteur Financier (CSSF) holds the public register of payment institutions and e-money institutions authorised in Luxembourg. The register also covers their agents and branches where these provide payment services or issue e-money in another member state, and persons exempted under Articles 48 and 48-1, with their agents. A separate register covers the account information service providers dealt with in Article 48-1a.

The same paragraph sets out what the registers must show and how they are published:

the payment services for which each institution is authorised, or each exempted person registered;
authorised institutions listed separately from exempted and registered persons;
open to public consultation on the CSSF website, updated without delay, and published in the official journal at least at each year-end.

Article 36(3) requires the CSSF to enter every withdrawal. Article 36(4) requires it to pass register data to the European Banking Authority (EBA) without delay and makes it responsible for that data’s accuracy. Article 36(2) matters in marketing reviews: no one may use their listing, or CSSF supervision, for commercial purposes.

2. Search Entities: the public interface

In practice, the register is the Search Entities application hosted on the CSSF’s eDesk site. The CSSF describes it as information on authorised or registered entities in Luxembourg. You can search by name or code, by type, category or status. You can also list every change since a date of your choice.

The type filter covers the whole financial sector. For payments work, the relevant types are:

EP — payment institutions.
EME — electronic money institutions.
PSIC — account information service providers.
PSE — service providers relying on the limited-network or electronic-communications exclusions in Article 3 LSP. Article 3-1(4) requires the CSSF to publish in the Article 36 registers a description of the activity these providers notify.

Under “View more search options”, EP and EME searches split into two groups. One is the register of institutions authorised under the LSP. The other is branches of institutions from another EEA member state registered in Luxembourg. Results include withdrawn entries, marked as such, and can be exported as CSV. A search on 27 October 2026 returned 29 payment institution entries and 21 e-money institution entries, withdrawn ones included. A population that small is easy to reconcile in full.

3. How to read an entry

Each field of an entry answers a different due diligence question.

N° — the CSSF code. Payment institutions carry a code starting with Z, e-money institutions one starting with W. Quote it in correspondence with the CSSF and record it in your files.
Name and status — the current name, followed by its status in brackets, such as Active or Withdrawn.
Address and constitution date — match these against the trade and companies register. Our guide to the RCS and LBR covers that side.
Group and sub-group — which register the entity sits in (authorised under the LSP, or an EEA branch), and the nature of the entry, for example an authorisation.
Date of authorisation — shown for Luxembourg-authorised institutions.
Services — coded by the numbering in the Annex to the LSP: 3.a to 3.c for direct debits, card transactions and credit transfers, 4.a to 4.c for the same services covered by a credit line, 5 for issuing and acquiring, 6 for money remittance, 7 for payment initiation and 8 for account information. E-money institutions also show the issuing, distribution and redemption of e-money.
Agents or branches — a table of name, an agent or branch mark, country, address and status.
Freedom to provide services — the list of host states notified for cross-border services without establishment.
Name history — earlier names, with dates. Read it before concluding that an old contract names an unknown entity.

The results list has an LEI column, but in October 2026 it was blank for the institutions we checked. Match on code, name and address.

4. Agents and e-money distributors

Agents reach the register through their principal. Under Article 18(1) LSP a payment institution gives the CSSF the agent’s name and address, AML/CFT controls, managers, mandated services and any identification code. The CSSF has two months to say whether the agent has been entered, and under Article 18(2) the agent may start only once it is. The CSSF refuses the listing if it cannot satisfy itself the information is correct. Under Article 24-6(6), e-money institutions using agents for payment services follow the same Article 18 rules and may also use those agents to distribute and redeem e-money.

Agents in another member state go through the passport procedure in Article 23 (Article 24-17 for e-money institutions). The CSSF sends the notification to the host authority within one month and decides within three months. Under Article 23(4) the agent or branch may start in the host state once it is entered in the Article 36 register, and the institution notifies the CSSF of the start date. The CSSF publishes the forms for agent, branch, distributor and services passports, their changes and the start of activity on its European passport page.

Distributors are different. Article 24-6(5) lets an e-money institution distribute and redeem e-money through persons acting on its behalf, but never issue through them. Article 36 names agents and branches, not distributors, and the public entry has columns only for agent and branch. A distributor’s absence from Search Entities proves nothing either way. Ask the issuer for its notification instead. Our piece on agents versus distributors sets out the functional test.

5. EEA firms passporting into Luxembourg

Articles 21 and 24-15 LSP let institutions authorised in another member state serve Luxembourg through a branch, through agents or under the freedom to provide services. They notify their home authority, which passes the notification to the CSSF. The CSSF then has one month to assess it and reply to the home authority.

In Search Entities, an inbound branch appears in its own group, as a branch of an institution from another EEA member state registered in Luxembourg, with a Z or W code and its services. There is no date of authorisation, because the CSSF did not authorise it. The search options have no group for EEA firms serving Luxembourg under the freedom to provide services, or for their agents in Luxembourg. For those, the authoritative record is the home authority’s register, and the EBA register is the cross-check.

6. Search Entities, the EBA register, the RCS and the warnings list

Source	Kept by	What it shows	Use it to
Search Entities (Article 36 LSP registers)	CSSF	Luxembourg-authorised PIs and EMIs with services, agents, branches and cross-border notifications; inbound EEA branches; exempted persons, AISPs and excluded providers	Verify a Luxembourg firm’s authorisation and passports
EBA payment institutions register	EBA, from national authorities’ data	PIs, EMIs, exempted institutions, AISPs, agents and EEA branches across the EEA	Cross-check any EEA firm and its agents abroad
RCS / LBR	Luxembourg Business Registers	Company identity, filings, legal representatives	Confirm the legal entity behind the licence
CSSF warnings	CSSF	Public warnings on unknown or unauthorised entities, websites and impersonation, filterable by entity type	Screen names and domains before onboarding

The EBA register rests on Article 15 of PSD2 (Directive (EU) 2015/2366). The EBA states that it has no legal significance and confers no rights. National authorities supply its data, are responsible for its accuracy and update it at least once a day. If the CSSF and EBA records disagree on a Luxembourg firm, the CSSF register is the national record.

Many recent warnings concern fraudsters using the names of genuine Luxembourg firms, so a name match proves little alone. In its newsletter, the CSSF recommends checking Search Entities and watching for details such as unusual phone numbers or wrong addresses.

7. Using the register for counterparty due diligence

Search Entities is the primary source for checking a Luxembourg payment counterparty. A sound check runs in this order:

Search by name, then confirm the CSSF code, address and name history against your onboarding file and the RCS.
Check the status is Active and the group fits the relationship: authorised in Luxembourg, or an EEA branch.
Check that the services you are contracting for appear in the services list, coded by the LSP Annex.
For a firm serving another country, find that country in the freedom-to-provide-services list or the agents and branches table.
For an agent, find it in the principal’s table with the agent mark, the right country and Active status.
Run the name and website through the CSSF warnings list and the EBA register.
Save the entry with the date of the check. Repeat at each periodic review, using the changes-since-date search to catch movements.

8. Keeping your own entry current

The entry reflects what you have notified and what the CSSF has processed, so a wrong entry is fixed by the right filing:

Agents and passports. New agents, changes and terminations go through the Article 18 or Article 23 procedure and the CSSF’s passport forms. Article 18(1)(b) requires updates without delay when material details change.
Entity data. Changes to name, address and similar details go on the CSSF’s Excel notification form for updating institution information, sent through its MFT channel. The CSSF may decline notifications on the wrong form or channel.
Structure. Article 24-6(7) requires e-money institutions to notify the CSSF in advance of changes to their structure, including the intended use of intermediaries, agents and branches.

No turnaround time is published, so log the request and recheck the entry.

9. Worked cases

A Luxembourg agent that wants to start Monday

Facts: a Luxembourg payment institution signs an agent agreement with a local retail chain and sends the Article 18 notification. The chain wants to start taking payments the following week.

What the rule says: under Article 18(2) LSP the CSSF has two months to confirm the listing, and the agent may start only once it is entered in the register.

What the practitioner does: holds the launch, checks Search Entities until the agent appears in the institution’s table with the agent mark and Active status, then switches on access.

Outcome: no unregistered activity, and a dated record showing that go-live followed the listing.

An EEA branch as a new partner

Facts: a Luxembourg e-money institution is offered settlement services by an EEA payment institution that describes itself as “CSSF-registered”.

What the rule says: an EEA branch operates under its home authorisation. Search Entities lists it in the EEA-branch group with its services, but the CSSF did not authorise it.

What the practitioner does: confirms the branch entry, then checks the home register and the EBA register, recording all three.

Outcome: the file names the home supervisor and the branch’s notified services.

The counterparty that is not there

Facts: an analyst cannot find a supplier’s licensed entity in Search Entities and wants to treat it as unauthorised.

What the rule says: the registers include name history and withdrawn entries, and EEA firms providing services cross-border are recorded by their home authority.

What the practitioner does: searches earlier names and the EBA register, finds an EEA authorisation, and screens the website against the CSSF warnings list.

Outcome: the finding is closed on the facts.

10. FAQ

Which article requires the CSSF register?

Article 36 of the Law of 10 November 2009 on payment services. It requires a public register on the CSSF website, updated without delay and published in the official journal at least at each year-end.

What do the Z and W codes mean?

They are the CSSF codes shown as N° on each entry: Z for payment institutions, W for e-money institutions, inbound EEA branches included.

Are agents of Luxembourg institutions listed?

Yes, in the principal’s agents or branches table, with country and status. Under Article 18(2) an agent may start only once it is entered.

Are e-money distributors listed?

Article 36 names agents and branches, and the entry has no distributor column. Verify a distributor through the issuer’s notification.

Do EEA firms passporting into Luxembourg appear?

Inbound branches do, in a separate group. For firms serving Luxembourg under the freedom to provide services, use the home register and the EBA register.

11. What to do, today

COO: open your own Search Entities entry and confirm the code, services, host states and name history match your authorisation and passport files.
Agent network owner: make every agent go-live depend on its appearance in your table with Active status, and reconcile your agent list against the entry quarterly.
Head of partnerships: make a dated Search Entities, EBA register and warnings check a contract precondition for every payments counterparty.
MLRO: keep agents and distributors in separate inventories, each with its LSP basis and notification evidence.