EMI licence in Luxembourg — the CSSF application file

Luxembourg’s e-money authorisation runs under the Law of 10 November 2009 on payment services, and since 21 July 2021 the CSSF alone grants it — the same EMD2 floor as everywhere else, wrapped in the Grand Duchy’s substance-first supervisory culture. A Luxembourg EMI is a passport into all 30 EEA states, but the law asks for the central administration and the registered office in the country, and for at least part of the e-money issuance itself to happen there. This piece walks the application article by article: who grants it, which legal forms qualify, capital and own funds, safeguarding, the file, the decision clock, and what switches on at grant.

1. Who grants — and who used to

The CSSF — the Commission de Surveillance du Secteur Financier — is the competent authority. Article 24-2 of the law is blunt: no person under Luxembourg law may issue electronic money without a written authorisation by the CSSF. That wording is newer than most guidance admits. Until the Law of 21 July 2021 amended the payment services law, the licence was formally granted by the Minister responsible for the CSSF on the CSSF’s investigation, and the CSSF supervised afterwards. The 2021 amendment struck the ministerial step out of Articles 24-2 and 24-3 and left the CSSF solely competent to grant, refuse and withdraw.

This matters operationally, not just historically. Much secondary material — country guides, primers, internal playbooks written before 2022 — still describes a two-stage ministerial procedure, so applicants plan around a phantom approval gate and brief their board on a decision-maker no longer in the process.

2. The legal basis, mapped to the articles you will be asked about

E-money authorisation sits in its own section of the law, and the CSSF’s questions track the article numbers.

Around that sit Directive 2009/110/EC (EMD2) and Directive (EU) 2015/2366 (PSD2), transposed in the same act; the Law of 12 November 2004 with CSSF Regulation 12-02 for AML/CFT; and the EBA authorisation guidelines.

3. Who can apply — and the legal-form myth

Article 24-5 permits four vehicles: a public-law institution, a société anonyme (SA), a société en commandite par actions (SCA) and a société coopérative. The frequent claim that Luxembourg is SA-only is wrong on the text — though the SA remains the default for a payments group, because it maps cleanly onto a board plus authorised management. Any later change of legal form or name must be notified to the CSSF in advance.

Beyond the vehicle, the gating conditions are: initial capital of at least €350,000 (Article 24-11), central administration and registered office in Luxembourg with at least part of the e-money issuance performed there (Article 24-7), and authorised managers of good repute with adequate knowledge, skills, experience and time, running the institution from Luxembourg under the four-eyes principle (Article 24-9).

4. Initial capital and own funds — two requirements, added together

The €350,000 must be evidenced at authorisation and consist of items listed in Article 26(1)(a) to (e) of Regulation (EU) No 575/2013 — paid-up share capital, share premium, retained earnings, accumulated other comprehensive income and other reserves. A shareholder loan, committed facility or parent guarantee does not count, a common reason a first submission stalls before substantive review.

Ongoing own funds are the higher of the floor and a calculation with two limbs that are summed, not compared:

• Method D for the e-money activity — at least 2% of average outstanding electronic money.
• For payment services not linked to e-money issuance, one of the three methods in Article 17(1) and (2). Note who chooses: the law says the appropriate calculation method shall be determined by the CSSF. You model a method; you do not elect it.

Where outstanding e-money is not known in advance — a launch year, or a new product line — the CSSF allows the requirement to be met on a representative estimate derived from the business plan, which is why those projections must be defensible rather than aspirational.

5. Safeguarding: two statutory methods, one supervisory decision

Article 24-10 gives two routes for funds received in exchange for e-money issued. The segregation route requires that the funds are never commingled with anyone’s funds other than e-money holders’, and are held in a separate account at a credit institution, with a central bank at that central bank’s discretion, or invested in secure low-risk assets. The statutory consequence is the part worth quoting to a treasury team: segregated funds do not form part of the institution’s own assets, are deducted in the holders’ interest against other creditors’ claims, and fall outside the estate on insolvency. Assets a depositary identifies as belonging to e-money holders cannot be pledged for the institution’s or a third party’s obligations, nor seized by its creditors. The alternative route is an insurance or comparable guarantee. The CSSF may determine which method applies.

6. What goes in the file

The file is submitted through the CSSF’s Managed File Transfer (MFT) system on the CSSF’s own forms; free-form or incomplete submissions are not processed. The application form, the declaration of honour for the legal person and a declaration of honour for each natural person in scope are the spine — build the rest around them.

• Programme of operations — services sought, customer journey, geographies and the passporting plan.
• Business plan — three-year projections with own-funds planning consistent with section 4.
• Fund-flow and data-flow diagrams — exactly how money and data move, and the role of every partner and contract.
• Governance and internal control — authorised management, board, org chart, four-eyes evidence, and risk, compliance and internal-audit functions proportionate to scale.
• Safeguarding — the chosen Article 24-10 method, evidenced contractually.
• AML/CFT programme — policies and the named officers: the responsable du respect des obligations (RR) at authorised-management level and the responsable du contrôle (RC) operationally, under CSSF Regulation 12-02.
• ICT and operational resilience — aligned with DORA and PSD2 security expectations (CSSF Circular 19/713), with an outsourcing register reflecting CSSF Circular 22/806.
• Shareholder structure — qualifying-holding and fitness documentation for holders of 10% or more.

7. The decision clock, and the deadline nobody plans for

Article 24-3 sets a reasoned decision within three months of receipt of the application or, where it is incomplete, of the information required for the decision — the familiar restart mechanism. The provision most applicants have never read is the next sentence: a decision must in any case be taken within 12 months of receipt of the application, and absence of a decision implies a refusal. A refusal, express or deemed, may be referred to the Tribunal administratif, which rules on the substance, within one month or it is time-barred.

That makes a drifting question round a legal risk, not merely a commercial delay. Realistic end-to-end for a first-time applicant remains nine to twelve months including pre-application engagement and two or more feedback rounds — uncomfortably close to the backstop if the formal filing goes in early to “start the clock”. The file may be in English, French or German.

8. Three scenarios

Facts: a group capitalises the applicant with €150,000 of share capital plus a €250,000 subordinated shareholder loan, and presents €400,000 as initial capital. Scenario 1 — Article 24-11 requires the initial capital to consist of Article 26(1)(a) to (e) CRR items, and a subordinated loan is not among them. The applicant is short by €200,000. What the practitioner does: converts the loan to share capital or injects fresh equity before filing, and does not rely on the question round to surface it — an incomplete-capital file restarts the three-month clock while the 12-month backstop keeps running from original receipt.

Facts: an EMI projects €40m average outstanding e-money and also plans unrelated money-remittance volume of €300m a year. Scenario 2 — the two limbs are summed. Method D gives 2% of €40m, so €800,000 for the e-money activity, plus whatever the payment-services method the CSSF determines produces on the remittance volume. The €350,000 floor is long since irrelevant. What the practitioner does: models all three payment-services methods rather than the flattering one, because the choice is the CSSF’s, and carries the worst outcome into the capital plan.

Facts: a group intends to book all issuance decisions and platform operations at its existing hub in another member state, with the Luxembourg entity holding the licence and two managers. Scenario 3 — Article 24-7 requires the central administration and the registered office in Luxembourg, and expressly that at least part of the e-money issuance activity is provided in Luxembourg. A licence-holding shell served from elsewhere does not meet it. What the practitioner does: identifies which issuance functions genuinely move — customer acceptance, limit setting, safeguarding reconciliation, incident decisions — and resources them locally before the question is asked.

9. Luxembourg against the other core EMI jurisdictions

The EMD2 substance is identical everywhere; Luxembourg’s differentiators are procedural — the multilingual file, the statutory 12-month outer limit, and closer scrutiny of central administration. See where to base your EMI for the full comparison.

10. What switches on at grant

• Entry on the CSSF’s public register and the EBA’s central register of payment and e-money institutions.
• Passport notifications — branch or freedom of services.
• Your own Luxembourg IBAN range.
• AML reporting to the Cellule de Renseignement Financier through goAML, plus CSSF prudential and statistical returns.
• CESOP once thresholds are met, and Instant Payments Regulation duties including verification of payee.

11. FAQ

12. What to do, today

• Strip any ministerial approval gate out of the project plan and re-baseline on the CSSF-only procedure.
• Test initial capital against the CRR Article 26(1)(a) to (e) list before filing — convert loans to equity rather than arguing it in a question round.
• Model all three payment-services own-funds methods alongside Method D, and plan to the worst plausible determination.
• Decide which issuance functions physically sit in Luxembourg, and staff them, before the Article 24-7 question arrives.
• Work backwards from the 12-month outer limit: file only when the file is genuinely complete.

Related: Where to base your EMI · PI licence in Luxembourg · How to issue Luxembourg IBANs · CASP authorisation in Luxembourg (CSSF, MiCA) · MiFID investment firm in Luxembourg (CSSF) · Conduct complaints in Luxembourg (CSSF) · Circular CSSF 26/906 — internal governance for LU payment institutions · CSSF legal reporting — the Z and W tables · Outsourcing under Circular CSSF 22/806 · Own funds and initial capital for PIs and EMIs · E-money tokens under MiCA · PSD2 passporting — branch, agent and services · What is a safeguarding account · The Luxembourg reporting calendar · Buying an EMI or PI licence — change of control · The CSSF AML/CFT data collection · CSSF Regulation 12-02 — the Luxembourg AML rulebook · CRBA — Luxembourg’s central register of bank accounts