MiFID investment firm authorisation in Luxembourg — the CSSF licence, capital tiers and IFR/IFD classes

A Luxembourg investment firm is authorised by the CSSF under the Law of 5 April 1993 on the financial sector, and the services it chooses set its capital, its prudential class and the shape of its file. Since 2021 Luxembourg has run its investment firms under the EU investment-firm package rather than the banking regime, but the authorisation still lives in the country’s flagship financial-sector law. This piece walks through the CSSF authorisation for a MiFID investment firm — authority, legal basis, the three size classes, the €75k / €150k / €750k capital tiers, the services catalogue, the file, own funds, passporting and timing — with worked examples showing how the service mix fixes the class and the capital.

1. Who grants and who supervises

Anyone providing investment services in or from Luxembourg on a professional basis needs prior authorisation from the CSSF (Commission de Surveillance du Secteur Financier). The CSSF assesses the file, grants the authorisation and is the ongoing supervisor. A structural condition runs through the whole regime: the firm’s central administration and registered office must be in Luxembourg — the decision-making and administrative centre has to sit in the Grand Duchy, not merely a nameplate. On grant the firm is entered on the CSSF’s public register and, for passported services, becomes visible on ESMA’s registers.

2. Legal basis

• Law of 5 April 1993 on the financial sector (LFS), as amended — Articles 13 to 24-9 set the authorisation requirements and procedure for investment firms.
• Law of 21 July 2021 — amended the LFS to transpose the Investment Firm Directive (IFD) and align Luxembourg with the investment-firm prudential regime.
• Regulation (EU) 2019/2033 (IFR) — the directly applicable investment-firm capital regulation, in force since 26 June 2021.
• Directive (EU) 2019/2034 (IFD) — the investment-firm prudential directive, transposed into the LFS.
• Directive 2014/65/EU (MiFID II) and Regulation (EU) No 600/2014 (MiFIR) — the conduct and market-structure framework.
• Regulation (EU) 2022/2554 (DORA) — ICT and operational-resilience obligations.

3. The three size classes

The IFR/IFD proportionality logic, now embedded in the LFS, sorts investment firms into three classes:

• Class 1 — large, bank-like. Firms dealing on own account or underwriting with total assets at or above €15 billion (alone or across the group) are treated like credit institutions under the CRR and, at the top, may require a banking authorisation rather than an investment-firm one.
• Class 2 — medium. Firms above the “small and non-interconnected” thresholds. They compute own funds on the full K-factor methodology and carry the fuller reporting and governance load.
• Class 3 — small and non-interconnected. Firms below the IFR thresholds — on assets under management, client orders handled, assets safeguarded and balance-sheet size — with a lighter own-funds and reporting regime.

4. Initial capital — three tiers by service

The initial-capital floor follows IFD Article 9 and is set by what the firm is authorised to do:

The CSSF’s investment-firm authorisation page frames the everyday split as €75,000 versus €150,000, turning on whether the firm may hold client assets. The €750,000 tier is the IFD floor for own-account dealing and firm-commitment underwriting. Initial capital is the entry ticket; ongoing own funds are then the higher of that floor, a quarter of the prior year’s fixed overheads, and — for Class 2 — the K-factor requirement.

5. The MiFID services catalogue

A Luxembourg investment firm requests one or more MiFID II investment services, each of which shapes the class and the capital:

• Reception and transmission of orders
• Execution of orders on behalf of clients
• Dealing on own account
• Portfolio management
• Investment advice
• Underwriting and/or placing on a firm-commitment basis
• Placing without a firm-commitment basis
• Operation of a multilateral (MTF) or organised (OTF) trading facility

Ancillary services — safekeeping and administration of instruments, granting credit to let a client transact, and investment-linked FX — are requested alongside but do not by themselves make an investment firm.

6. What goes in the CSSF file

The CSSF file mirrors the EMI / PI dossier structure with investment-firm specifics:

• Programme of operations — the investment services and instrument types sought, target clients and geographies.
• Business plan — three-year projections with own-funds planning against the applicable K-factors.
• Substance and governance — central administration and registered office in Luxembourg, day-to-day management entrusted to at least two natural persons of good repute and adequate experience, with at least one resident in Luxembourg or the Grande Région.
• Shareholder and management fit-and-proper — declarations of honour and shareholder information under Implementing Regulations (EU) 2017/1943 and 2017/1946, plus criminal-record extracts.
• Capital proof — evidence of the paid-up initial capital at the correct tier.
• Internal control — risk management, compliance and internal audit proportionate to the class.
• ICT and resilience — a DORA register of information and outsourcing controls.
• AML / CFT — a programme under the Luxembourg AML law with reporting to the Cellule de Renseignement Financier (CRF) via goAML.

7. Worked example — an advisory and portfolio-management firm

Facts: a firm plans discretionary portfolio management and investment advice for private clients, routing all execution and custody to third parties and never holding client money or securities itself. It wonders which capital floor applies.

What the rule says: portfolio management and advice, where the firm may not hold client assets and does not deal on own account, sit in the €75,000 tier. Because it holds no client assets and handles limited order flow, it is a strong candidate for the small-and-non-interconnected Class 3 regime — lighter own funds and reporting.

What the practitioner does: confirms in the CSSF application that it will not hold client assets or deal on own account, files at €75,000, models Class 3 own funds as a quarter of fixed overheads, and keeps a watch on the interconnectedness thresholds so a later move into custody triggers a planned re-tiering.

8. Worked example — holding client assets, then dealing on own account

Facts: a firm authorised at €75,000 decides to take custody of client securities, and later launches a desk that quotes prices from its own book.

What the rule says: the moment it is permitted to hold client money or securities it moves to the €150,000 floor; when it starts dealing on own account it moves again to €750,000 and brings the “risk-to-market” and “risk-to-firm” K-factors into the own-funds calculation. If its balance sheet later reaches €15 billion — alone or across a group — it tips into Class 1 and is treated as a credit institution under the CRR.

What the practitioner does: applies to extend its CSSF authorisation before each new activity goes live, tops up initial capital to the correct tier in advance, and rebuilds its IFR own-funds and reporting around the new K-factors — never letting the activity outrun the authorisation.

9. Own funds and reporting

Under the IFR, a Class 2 firm’s own-funds requirement is the highest of its fixed-overheads requirement, its permanent minimum (the initial-capital floor) and its K-factor requirement. K-factors quantify risk to clients (assets managed, client money held, assets safeguarded, client orders handled), risk to market (net position risk, clearing margin) and risk to the firm (trading counterparty default, daily trading flow, concentration). Firms report own funds, concentration and liquidity to the CSSF on the IFR schedule; Class 3 firms report a reduced set. These returns are the investment-firm analogue of the banking COREP templates.

10. Passporting

A Luxembourg MiFID authorisation passports across the EEA. The firm notifies the CSSF of the host states and services, the CSSF transmits to the host authority, and the firm may then serve clients on a Freedom-of-Services basis or through a branch. The passport covers the investment services in the authorisation — not ancillary activities that fall outside MiFID. See our branch vs Freedom of Services piece for the choice between the two routes.

11. Realistic timing

MiFID sets a statutory six-month decision period from a complete application. As everywhere, “complete” is the operative word — the clock effectively runs once the CSSF has what it needs, and question rounds extend the dialogue. A realistic first-time timeline, including pre-submission engagement, substance build-out and drafting, is nine to twelve months. Early contact with the CSSF to calibrate the class, the capital and the substance expectations before the file hardens is the fastest way to compress the process.

12. Luxembourg against the other MiFID jurisdictions

The IFR/IFD capital tiers are identical across the EEA — the differences are procedural. Luxembourg runs a single-authority CSSF model with a hard central-administration-in-Luxembourg substance test; Germany splits BaFin and the Bundesbank; France divides the AMF and ACPR. The class and K-factors travel with the firm wherever it bases.

13. What switches on at grant

• MiFID passport notifications to host EEA states — branch or Freedom of Services.
• IFR own-funds, concentration and liquidity reporting to the CSSF.
• MiFIR transaction reporting of executed transactions.
• AML / CFT reporting to the CRF through goAML.
• DORA ICT-risk, incident-reporting and register obligations.

14. FAQ

15. What to do, today

• List the exact MiFID services you need — the service mix fixes both the class and the capital tier.
• Decide whether you will hold client money or securities; that single answer moves you between the €75,000 and €150,000 floors.
• Plan the Luxembourg substance early — central administration, two qualifying managers and a resident presence are hard authorisation conditions, not paperwork.
• Model your K-factors if you sit in Class 2 — they, not the floor, often drive the binding own-funds number.
• Take a pre-submission meeting with the CSSF to confirm the class and substance before the file hardens.

Related: EMI licence in Luxembourg (CSSF) · Investment firm in Germany (BaFin) · PI licence in Luxembourg (CSSF)