The Luxembourg reporting calendar for a payment firm
Luxembourg’s calendar is dominated by one supervisor, which makes it simpler to map and easier to under-estimate. The CSSF collects the periodic financial reporting, receives the outsourcing notifications, supervises the conduct cycle and sits alongside the financial intelligence unit for AML filings. The result is fewer counterparties than Spain or France — and a higher proportion of obligations that are notifications and registers rather than returns, which are the ones that fail quietly.
1. Who collects what
| Counterparty | What it collects |
|---|---|
| CSSF | Periodic financial reporting, outsourcing notifications and registers, governance attestations, conduct and complaints |
| CRF | Suspicion reporting through goAML |
| BCL | Statistical reporting, where the entity falls within the reporting population |
| RBE | The beneficial-ownership register |
2. The inventory
- CSSF legal reporting — the periodic tables for payment and e-money institutions, with their monthly deadline and submission channel.
- Suspicion reporting to the CRF through goAML, event-driven, with the abstention and blocking powers attached.
- The outsourcing register and notifications under the CSSF outsourcing circular — an advance-notification regime with a maintained register.
- Internal governance — including the annual attestation the governance circular requires.
- Conduct and complaints — the handling duty, the response clock and the out-of-court resolution procedure.
- The DORA register of information and major ICT incident reporting.
- Fraud reporting and the payment statistics that carry it.
- CESOP — quarterly cross-border payment data.
3. Registers are the Luxembourg specialty
Three of the obligations above are maintained artefacts rather than transmissions: the outsourcing register, the DORA register of information, and the beneficial-ownership filing. Each is correct at a point in time and decays continuously as the business changes.
The control for a maintained register is different from the control for a return. It is a periodic completeness reconciliation — comparing the register against an independent source of truth for the same population — plus a change trigger that catches additions between reconciliations. For the outsourcing register the independent source is usually the contract or procurement record; for the DORA register it is the ICT service inventory.
The advance-notification limb needs its own control again, because it binds before an arrangement starts. A register that is accurate after the fact does not evidence that the notification was made in time.
4. Building it
Facts: an EMI authorised in Luxembourg engages a new ICT provider for a function it assesses as important, and adds it to the registers at the next quarterly review.
What the analysis produces: the register entry is necessary but not sufficient. The outsourcing regime operates on advance notification, so the timing of the notification relative to the start of the arrangement is the compliance question, and a register updated afterwards cannot answer it.
What the practitioner does: hangs the notification trigger off the contracting process rather than off the reporting calendar — a gate in procurement, not a task in a quarterly review — and keeps the register reconciliation as a separate detective control behind it.
A closing note on language: Luxembourg accepts filings and correspondence in more than one language, which removes a constraint that binds in Germany, Italy and France. That makes it materially easier to run Luxembourg reporting from a group function without local language capacity — one of the practical reasons groups centralise there.
FAQ
What dominates the Luxembourg calendar?
Notifications and maintained registers rather than periodic returns — outsourcing notification and register, the DORA register of information, and an annual governance attestation.
Why do registers need a different control?
Because they have no filing event to monitor. The control is a periodic completeness reconciliation against an independent source, plus a change trigger between reconciliations.
When must an outsourcing be notified?
In advance of the arrangement, which is why the trigger belongs in the contracting process rather than in a periodic reporting review.
Why do groups centralise reporting in Luxembourg?
Partly because filings and correspondence are accepted in more than one language, which removes the local-language dependency that binds in Germany, Italy and France.
5. The attestation, and what it commits
The governance circular’s annual attestation deserves separate attention because it is the one obligation on this list that puts named individuals behind the rest of it. An attestation signed by the management body is a statement about the state of the firm’s arrangements — which means every register, notification and reconciliation described above becomes evidence supporting a signature rather than a task in a workflow.
Practically, that argues for assembling the attestation evidence continuously rather than annually. A firm that reconstructs a year of registers and notifications in the weeks before signing is doing archaeology under time pressure, and the gaps it finds are gaps it must either remediate or disclose. A firm that keeps the reconciliations current signs on the basis of records it already holds — which is the whole point of the design.
Related: CSSF legal reporting · CSSF outsourcing · The Dutch reporting calendar
