EMI licence in Luxembourg — the CSSF application under the 2009 payment services law

Luxembourg’s e-money authorisation runs under the Law of 10 November 2009 on payment services, and the CSSF grants it — the same EMD2 floor as everywhere else, wrapped in the Grand Duchy’s substance-first supervisory culture. A Luxembourg EMI is a passport into all 30 EEA states from a jurisdiction built for cross-border finance, but the CSSF expects genuine central administration in the country, an SA structure, and a governance file that survives close reading. This piece walks through the electronic-money-institution application: authority, legal basis, capital, the file, governance and substance, realistic timing and what switches on at grant.

1. Who grants and who supervises

The CSSF — the Commission de Surveillance du Secteur Financier — is the competent authority for e-money institutions in Luxembourg. It examines the file, runs the supervisory dialogue and, once authorised, enters the institution on its public register and on the EBA’s central register of payment and e-money institutions. AML/CFT supervision also sits with the CSSF; suspicious-activity intelligence goes to the Cellule de Renseignement Financier (CRF), Luxembourg’s FIU, via goAML.

2. Legal basis

• Directive 2009/110/EC (EMD2) — the EU e-money framework
• Directive (EU) 2015/2366 (PSD2) — payment services, transposed alongside e-money in the same national act
• Law of 10 November 2009 on payment services (the “PSL”) — the Luxembourg act; e-money issuance authorisation sits in Article 24-2, with the e-money governance provisions in Articles 24-7 and 24-9
• Law of 12 November 2004 on the fight against money laundering and terrorist financing, and CSSF Regulation 12-02 — the AML/CFT framework
• EBA Guidelines on authorisation under PSD2/EMD2 — directly applicable to the assessment

3. Who can apply

• A legal person incorporated under Luxembourg law, established as a société anonyme (SA) — the PSL restricts the licence to this form
• Initial capital of at least €350,000, fully paid up at grant
• Genuine central administration in Luxembourg — decision-making, key functions and infrastructure located in the country, not a nameplate
• Authorised management resident and effective in Luxembourg, with the four-eyes principle applied from day one

4. What goes in the file

• Programme of operations — the payment and e-money services sought, customer journey, geographies and the passporting plan
• Business plan — three-year projections with capital and own-funds planning
• Fund-flow and data-flow diagrams — the CSSF expects to see exactly how money and data move, and the role of every business partner and contractual relationship
• Governance — authorised management, board, organisational chart and four-eyes evidence
• Internal control — risk management, compliance and internal audit functions, proportionate to the scale of the business
• Safeguarding — segregation of user funds in a separate account at a credit institution, or an insurance/guarantee arrangement, evidenced contractually
• AML/CFT programme — risk appetite, policies, and the named officers: the responsable du respect des obligations (RR) at management level and the responsable du contrôle (RC) operationally, under CSSF Regulation 12-02
• ICT and operational resilience — aligned with DORA and PSD2 operational-security expectations (CSSF Circular 19/713), with an outsourcing register reflecting CSSF Circular 22/806
• Shareholder structure — qualifying-holding information and fitness documentation for holders of 10% or more

5. Own funds

EMD2’s €350,000 initial-capital floor applies. Ongoing own funds are the higher of the floor and the applicable calculation: for the e-money activity, Method D — 2% of the average outstanding electronic money; for any payment services not linked to e-money issuance, Methods A, B or C under the PSL. The CSSF reviews the chosen method against the business plan with worked projections, and expects a capital-planning narrative that holds under stress.

6. Governance and substance — the Luxembourg test

Substance is where Luxembourg files rise or fall. The CSSF applies its central-administration expectations (rooted in Circular IML 95/120) with a clear line: the mind and management of the institution must sit in Luxembourg.

• At least two authorised managers of good repute, with sufficient knowledge, skills and experience, committing sufficient time — and genuinely running the institution from Luxembourg
• A management body with ultimate responsibility and clear, documented lines of reporting
• Compliance, risk and internal-audit functions that are real and resourced, not outsourced away to the point of hollowing out the entity
• The RR/RC AML pairing appointed and evidenced, with the RR sitting at authorised-management level

7. Realistic timing

The EMD2 framework sets a three-month decision period once the file is complete — but, as everywhere, the clock turns on when the CSSF deems the file complete, and question rounds extend the substantive dialogue. Realistic end-to-end for a first-time applicant is nine to twelve months, including pre-application engagement, drafting, and two or more feedback rounds. The file may be prepared in English, French or German; early contact with the CSSF’s Innovation, Payments, Market Infrastructures and Governance department is worth taking.

8. Luxembourg against the other core EMI jurisdictions

The EMD2 substance — €350,000, four-eyes, safeguarding — is identical everywhere. Luxembourg’s differentiators are procedural: the SA-only form, the multilingual file, and a supervisory culture that scrutinises central administration harder than most. See where to base your EMI for the full comparison.

9. What switches on at grant

• Passport notifications to host member states — branch or Freedom of Services
• Your own Luxembourg IBAN range under the LU country code
• AML reporting to the CRF through goAML, and ongoing CSSF prudential and statistical returns
• CESOP once cross-border payment thresholds are met
• Instant Payments Regulation obligations, including verification of payee

10. FAQ

11. What to do, today

• Take a pre-application meeting with the CSSF before drafting; calibrate the substance and governance expectations.
• Incorporate the SA and line up two Luxembourg-based authorised managers early — these are the long-lead items.
• Draw the fund-flow and data-flow diagrams first; the rest of the file follows the flows.
• Design the safeguarding and AML stack (RR/RC, goAML) at build time, not post-grant.

Related: Where to base your EMI · How to issue Luxembourg IBANs · EMI licence in Germany