CSSF legal reporting for a Luxembourg payment or e-money institution — the Z and W tables

A Luxembourg payment institution files four periodic tables; an electronic money institution files six — and every one of them is due on the 20th. The CSSF calls this “legal reporting”: the periodic prudential returns, the annual pack after the financial year closes, and the PSD2 fraud statistics. The tables have codes rather than names, the deadline is a calendar date rather than a working-day count, and the circulars that define them still point at a transmission circular that was repealed in 2023. This walks through the Z and W tables, what each one is really asking, the deadline arithmetic, and where the files actually go.

1. Two circulars, two table families

The periodic reporting scheme sits in two circulars. Circular CSSF 11/511 of 23 May 2011 covers payment institutions — the persons referred to in Article 1(18) of the amended Law of 10 November 2009 on payment services (the LPS). Circular CSSF 11/522 of 24 October 2011 covers electronic money institutions under Article 1(17), following the Law of 20 May 2011 that transposed Directive 2009/110/EC. Both exist so the CSSF can discharge its supervisory mandate under Article 31 of the LPS.

Payment institution tables are prefixed Z; electronic money institution tables are prefixed W. The prefix is the whole taxonomy — there is no separate naming convention to learn. Both circulars note that the requirements are “likely to be adapted according to the specificities of the sector and to the supervisory needs”, which is the CSSF reserving the right to change the scheme without new primary law.

An institution holding both an e-money authorisation and payment services beyond e-money issuance does not file both families. It files the W family, because Article 24-6(1)(a) activities are folded into the EMI tables — but as section 5 shows, its capital table then has to carry two calculations at once.

2. The tables, the frequencies, the deadlines

Every deadline in both circulars is the same construction: the 20th. Monthly tables are due the 20th of the following month; quarterly tables the 20th of the month after the quarter ends; the one annual table the 20th of the month after the calendar year ends. There is no working-day count and no grace mechanism — both circulars simply note that the CSSF “shall be informed beforehand of any delay”.

The version letters are where firms with a footprint outside Luxembourg trip. An institution with branches abroad files three versions: L for the Luxembourg head office alone, S for each foreign branch separately, and N for the global institution including its branches. An institution without foreign branches files a single version L. Capital adequacy is the exception in both families: Z 1.4 and W 1.4 are filed on version N only, because solvency is assessed at the level of the whole institution.

3. What the third-party-funds tables actually ask

Z 1.2 and W 1.2 look like balance-sheet detail. They are safeguarding supervision. Z 1.2 identifies the funds received either directly from payment service users or through other payment service providers that are still held at the closing of the reporting period, and tests them against Article 14(1) of the LPS: separately identifiable in the accounting, never commingled with the funds of anyone other than the users concerned, and either deposited in a separate account at a credit institution or invested in secure, liquid and low-risk assets — or covered by insurance under Article 14(1)(b).

The scheme then asks for something firms rarely expect in a prudential return: it lists the funds by the name of each credit institution where they are invested, and the name of each insurer where they are covered by insurance. W 1.2 does the same for e-money against Article 24-10(1), and additionally captures investments in secure, low-risk assets under Article 24-10(4), which the circular defines by reference to the low-specific-risk asset categories and to UCITS investing solely in such assets.

W 1.3, the quarterly statement of authorised reinvestments, is the concentration lens. It is a two-column table — counterparty name against the internal authorised investment limit the institution has itself decided for that counterparty — and the circular states its purpose plainly: to let the CSSF assess the concentration risk in the investments made to satisfy the safeguarding requirements. This is the same exposure that Circular CSSF 26/906 now addresses from the governance side, recommending a review of the conflicts arising from systematically concentrating segregation accounts with the same credit institutions.

4. Worked example: the counterparty names are the point

Facts: an electronic money institution safeguards float across two credit institutions and reports the aggregate in W 1.2, leaving the per-counterparty lines blank because the total reconciles.

What the rule says: the W 1.2 scheme itemises investment of the received funds by named credit institution, and W 1.3 separately requires the authorised investment limit per counterparty. An aggregate satisfies neither, and the reconciliation is not the test being run.

What the practitioner does: populates both by counterparty and, before the next quarter, gets the internal limits formally set — because W 1.3 asks for a limit that must already exist. Where no limit has been decided, the reporting gap is a governance gap surfacing in a return.

5. Capital adequacy, and the EMI sum rule

Z 1.4 reports own funds against the standards in Article 17(1) of the LPS, and only the lines for the method actually chosen are completed. Method A is 10% of the preceding financial year’s general expenses. Method B works from payment volume — one twelfth of the full amount of payment transactions executed in the preceding financial year — through five slices and the scaling factor k in Article 17(2). Method C works from an applicable indicator built out of interest income less interest expenses, commissions and fees received, and other operating income, again through slices and k; own funds under Method C may not fall below 80% of the average of the previous three financial years for the relevant indicator. Line 9 carries the minimum own funds legally required under Article 15, and the last line carries credit-risk capital where the institution grants credit under Article 10(3).

Two constraints are easy to miss. Interim profits count only where they are net of foreseeable tax and dividends and have been reviewed by the réviseur d’entreprises. And while institutions may in principle choose freely among the three methods, the circular requires them to justify the choice against the risks of their activities and to prove they are able to apply the method chosen. Circular CSSF 10/462 governs the definition and calculation of own funds itself.

W 1.4 is the same table with an extra limb. For Article 24-6(1)(a) activities not linked to e-money issuance, own funds follow one of the three Article 17 methods. For the activity of issuing electronic money, they follow Method D as set out in Article 24-12(4). The last indent of Article 24-12(3) then requires the institution to hold own funds at least equal to the sum of the two — and the overall requirement is the highest of the amounts under Articles 24-12(3) to (6) or Article 24-11.

Facts: a Luxembourg EMI issues e-money and also executes unrelated credit transfers. Its capital model computes Method D on average outstanding e-money, compares it to the Method B figure for the payment services, and holds the higher.

What the rule says: the two are additive, not alternatives. Article 24-12(3) requires own funds at least equal to the sum of the Method D requirement and the requirement for the non-e-money activities, and W 1.4 has separate lines for each before a total line.

What the practitioner does: rebuilds the model to add rather than compare, and re-runs the four preceding quarters to see whether the institution has been reporting below requirement. If it has, that is a finding to raise before the CSSF finds it in the series.

6. Where the files go — and the circular trap

Both 11/511 and 11/522 point to Circular CSSF 08/344 for transmission. That circular no longer exists. Circular CSSF 23/833 of 16 May 2023 repealed both CSSF 08/334 on encryption specifications for reporting firms and CSSF 08/344 on the transmission of reporting files, and replaced them with a list of communication means: eDesk, the API provided by the CSSF, MFT, and external transmission channels — currently eFile and SOFiE. Which one applies depends on the procedure or reporting concerned, and 23/833 does not map them: it directs professionals to the CSSF’s public site and to the eDesk portal to check the applicable procedure for each return.

That is a genuine trap for anyone reading the periodic-reporting circulars in isolation, which is what a new reporting team does. The table definitions in 11/511 and 11/522 remain authoritative; their transmission reference does not.

One more routing detail sits in both circulars and surprises firms: a copy of the relevant reporting tables is transmitted to the Banque centrale du Luxembourg, so that it can discharge its task of ensuring the efficiency and safety of payment and securities settlement systems and the safety of payment instruments. The same data therefore serves a supervisory and a central-banking purpose.

7. The annual pack and the fraud return

Periodic tables are only part of legal reporting. Circular CSSF 15/614 governs the documents due after the financial year closes: a short form report on the annual accounts, at the latest two weeks before the Ordinary General Meeting; the proposed allocation of results; the final periodic reporting tables; the internal auditor’s summary report and the management report on internal control, at the latest on the last day of the third month; the annual long form audit report, at the latest one month after the Ordinary General Meeting, with Circulars CSSF 12/550 and 13/569 governing its content; and the minutes and attendance list of the meeting. The complaints table and summary is separate and earlier — 1 March each year under Circular CSSF 17/671.

Note what has moved. Circular CSSF 26/906 repealed CSSF 04/155 for these institutions and now supplies the compliance and internal audit summary reports directly, together with an annual attestation of compliance signed by all members of the management body and the annual ICT and security risk assessment under Article 105-1(2) of the LPS.

Fraud statistics run on their own clock. Circular CSSF 19/712 applies EBA/GL/2018/05 on reporting requirements for fraud data under Article 96(6) of Directive (EU) 2015/2366, as reflected in Article 105-2(3) of the LPS. A payment service provider reports every six months according to the applicable breakdowns. Providers benefiting from the Article 32 PSD2 exemption, and e-money institutions benefiting from the Article 9 exemption in Directive 2009/110/EC, report annually instead, with the data still broken into two six-month periods. Per the CSSF’s legal-reporting page, the data is transmitted to the Banque centrale du Luxembourg using the CDDP6 template. Where historical figures have to be corrected, Circular CSSF 24/864 applies the EBA guidelines on resubmission of historical data.

8. FAQ

9. What to do, today

• Reporting owner: build the calendar off the 20th, not off a working-day count, and put the internal cut-off far enough back that a monthly three-version submission can be reviewed before it goes.
• Finance: check that Z 1.2 or W 1.2 is populated per named counterparty, and that W 1.3 limits exist as approved internal limits rather than being derived from actual balances.
• Capital: if you are an EMI with activities beyond e-money issuance, confirm the model adds the Method D requirement to the Article 17 requirement rather than taking the higher of the two.
• Before the first live submission: confirm the channel for each return on the CSSF site or eDesk, not from the transmission reference inside the 2011 circulars.
• Branch openings: treat a new foreign branch as a reporting change — it converts a single-version filing into an L, S and N filing from the reference period it opens.

Related: EMI licence in Luxembourg (CSSF) · PI licence in Luxembourg (CSSF) · BSI and MIR — the ECB statistical returns · Outsourcing under Circular CSSF 22/806