PSD2 fraud reporting in Luxembourg: CSSF duty, BCL file

PSD2 fraud reporting in Luxembourg is a CSSF obligation, but none of the data goes to the CSSF. Article 105-2(3) of the Law of 10 November 2009 on payment services requires providers to give fraud statistics to the CSSF. Circular CSSF 19/712 applies the EBA guidelines to that duty. Since January 2022, though, the data has travelled to the Banque centrale du Luxembourg (BCL) as the fraud tables of its monthly payment-statistics collection, CDDP6. The EBA guidelines describe a half-yearly return. Luxembourg runs a monthly one, filed three months after the end of the reference month, in XML, through the BCL’s channels. CSSF eDesk is not used for it.

1. The legal chain: PSD2, the LPS and Circular CSSF 19/712

Article 96(6) of Directive (EU) 2015/2366 requires member states to make payment service providers report fraud statistics for each means of payment to their competent authority, at least once a year. The authority then passes aggregated data to the EBA and the ECB. Luxembourg transposed this in Article 105-2(3) of the Law of 10 November 2009 on payment services (the LPS). The paragraph puts the annual-minimum duty on payment service providers, names the CSSF as recipient, and makes the CSSF responsible for sending aggregated data to the EBA and the ECB. Article 105-2 also holds the separate major incident duty.

Circular CSSF 19/712 of 14 March 2019 told payment service providers that the CSSF would comply with EBA/GL/2018/05, the guidelines on fraud reporting under Article 96(6). It applies to providers within Article 1(37) of the LPS for which the CSSF is the competent authority, except account information service providers. It took effect on 1 January 2020. It set half-yearly periods with submission within three months, the first due by 30 September 2020. The CSSF page lists no amending circular. The EU-level substance (definitions, breakdowns, the home and host split) is covered in PSD2 fraud reporting under Article 96(6).

The guidelines were amended by EBA/GL/2020/01, published on 22 January 2020 and applicable to transactions initiated and executed from 1 July 2020. The BCL manual applies the guidelines as amended.

2. Who collects the data: the CSSF’s duty, the BCL’s file

The CSSF’s legal-reporting page for payment and e-money institutions (updated 7 October 2026) explains the split. The obligation is owed to the CSSF. The data goes to the BCL, which under the “single data flow” is the single point of entry for all fraud reporting. From the 1 January 2022 reporting period, providers compile the data and send it to the BCL through CDDP6, the BCL’s payment-statistics reporting framework.

The BCL’s legal basis for collecting it is BCL Regulation 2021/N°30 of 12 July 2021 on payment statistics. Its recitals cite ECB Regulation (EU) No 1409/2013 as amended by Regulation (EU) 2020/2011 (ECB/2020/59), ECB Guideline (EU) 2021/832, the EBA fraud guidelines and the LPS. They also state that the BCL is the single contact point for payment statistics, without prejudice to the CSSF’s own collection powers. Article 7 of the regulation allows the data to be used for the tasks of the BCL, the CSSF, the ECB and the EBA. That use is the legal route that turns one BCL file into the CSSF’s Article 96(6) return.

3. From the half-yearly Excel return to monthly CDDP6

Luxembourg ran two regimes, and old internal procedures often still describe the first one.

Under CDDP6, Article 4 of Regulation 2021/N°30 requires XML files sent through the electronic transmission channels already used for BCL statistical reporting; the BCL Q&A confirms the switch did not change them.

4. Who reports, and the one-year exemption

Article 2 of Regulation 2021/N°30 lists the reporting agents as credit institutions, e-money institutions, payment institutions, and the national postal operator for its payment activities. This covers Luxembourg legal persons and the Luxembourg branches of credit, e-money and payment institutions authorised in another EU member state or in a third country.

A provider can ask the BCL for an exemption from CDDP reporting. It must meet three conditions together: it offers no PSD2 Annex I payment services, no interbank (V1.41) or intermediated (V1.42) payment transactions, and no payment accounts. The BCL decides each request individually. An exemption lasts at most one year and has to be requested again after that. An operating PI or EMI will not qualify.

5. The fraud tables: which “-F” table catches what

In the BCL manual, each fraud table copies its payments table and adds the suffix “-F”. The manual’s index (last update 12 December 2023) lists them as follows:

Each fraud row needs a matching row in the related payments table with the same combination of dimensions. Fraud type is a dimension of its own: issuance of a payment order by the fraudster, modification of a payment order by the fraudster, and manipulation of the payer. The value types split volume and value of fraudulent transactions. The typologies are explained in card fraud typologies and manipulation of the payer, and the liability split in fraud losses per liability bearer.

The BCL’s Q&A answers several questions about the reporting population that EMIs often get wrong:

• Payer acting fraudulently (first-party fraud) is not reported in the CDDP, because the EBA guidelines exclude it.
• E-money fundings and withdrawals are not reported in V1.91-F. A wallet funded by a fraudulent credit transfer goes in V1.20-F, and one funded by a fraudulent card payment goes in V1.50-F and V1.52-F. In each case the provider that executed that payment reports it.
• Blocked attempts are excluded. Only executed transactions are reported, and fraud is counted from the moment it is detected, whether or not the case is closed.
• Acquiring pay-outs to the merchant are not separate credit transfers. Pay-outs, and fraud on them, are kept out of V1.20/V1.20-F, V1.300-F and V1.80, and are reported in V1.100 where that table applies. The BCL states it agreed this answer with the CSSF.

6. Frequency, deadlines and corrections

Article 4 of Regulation 2021/N°30 sets two clocks:

• Payments and stock tables: monthly, within ten working days after the reference period.
• Fraud tables: within two months and ten working days after the reference period. The BCL’s Q&A describes this as M+3, so January fraud data is collected in April.

The fraud tables are a monthly return like the payments tables, with a longer lag. Corrections are sent per reference period. The whole table is resubmitted, not individual rows, and the most recent version replaces the earlier one. Fraud detected after the original submission goes into a revised file for the month in which the transaction was executed. It is not added to a later month.

The BCL applies hard checks when a file arrives. A file that breaks a validation rule is rejected with an error message, and under Article 4 a rejected transmission counts as not made. Reports and supporting documents must be kept for twenty-four months (Article 6). Under Article 8, the BCL can publish breaches and inform the competent authorities, without prejudice to the ECB’s and the CSSF’s own sanctioning powers.

7. How this differs from the BCL payment-statistics return

The fraud tables and the general payment statistics share a regulation, a manual, a channel and a schema family, but meet different obligations. The payments and stock tables serve ECB payment statistics under Regulation (EU) No 1409/2013, due at M+1. The “-F” tables carry the Article 96(6) duty owed to the CSSF under Article 105-2(3) LPS, and they also cover the fraud items in ECB/2020/59. They are due at M+3. Because every fraud row needs a matching payments row, build the two as one dataset with two release dates.

8. Worked scenarios

Facts: A Luxembourg e-money institution filed its January fraud tables in April. In June a customer reports that a January e-money transfer was sent after a fraudster, posing as the customer’s bank, talked them into authorising it.

Rule: Fraud is reported from detection and attached to the month of execution. Corrections replace the whole table for that reference period. The transaction is an e-money transfer sent, so it belongs in V1.91-F with fraud type “manipulation of the payer”, and the loss belongs in V1.300-F.

What the practitioner does: Flags the case, checks a matching V1.91 row exists, and regenerates the complete January V1.91-F and V1.300-F files (loss split by liability bearer) as corrective transmissions.

Outcome: The BCL keeps the corrected January version. Nothing appears in June’s tables.

Facts: A Luxembourg payment institution acquires card payments for online merchants and settles their takings to the merchants’ bank accounts. A merchant’s settlement account was changed by an account-takeover fraudster, and one pay-out went to the wrong account.

Rule: Following the BCL Q&A agreed with the CSSF, acquiring pay-outs are not credit transfers for fraud reporting. They stay out of V1.20-F and V1.300-F and are reported in V1.100 where applicable. Card fraud on the acquired transactions themselves goes in V1.52-F.

What the practitioner does: Logs the case internally, keeps it out of V1.20-F and V1.300-F, checks the pay-out sits in V1.100, and stays ready for any ad hoc BCL or CSSF request on pay-out fraud, which the Q&A expressly reserves.

Outcome: The returns follow the published Luxembourg treatment.

Facts: An e-money institution authorised in another member state serves Luxembourg customers under freedom of services and plans to open a Luxembourg branch next year.

Rule: Regulation 2021/N°30 covers Luxembourg branches of EU institutions. Under the EBA guidelines, an established branch reports to the host authority separately from the home return, while cross-border services and agent activity are reported in the home return.

What the practitioner does: Reports Luxembourg activity in the home return until the branch opens. Beforehand, it sets up BCL reporting for the branch, adds an entity flag to the data model and an M+1/M+3 calendar, then files CDDP6 tables from the branch’s first month and removes branch activity from the home return.

Outcome: There is no gap or double count when the branch opens.

9. FAQ

10. What to do, today

• Head of regulatory reporting: Correct any calendar entry that still shows a half-yearly fraud return to the CSSF. Replace it with monthly BCL dates at M+1 for payments and M+3 for fraud.
• Fraud operations lead: Record the execution date as well as the detection date on every case. Late detections reopen the original month.
• Data engineering: Add a pre-submission check that every “-F” row has a matching payments row with the same dimensions. Exclude first-party fraud, blocked attempts and acquiring pay-outs.
• Compliance officer: File the BCL acceptance or rejection messages with the submitted files and keep both for at least 24 months.
• Country manager for an inbound EEA firm: Before a Luxembourg branch opens, confirm with the BCL that it is set up as a reporting agent and decide how its activity will be removed from the home return.

Related: PSD2 fraud reporting under Article 96(6) · Building the PSD2 fraud return · CSSF eDesk and S3 · The Luxembourg reporting calendar · BCL payment statistics (CDDP6) for Luxembourg PIs and EMIs