On 20 January 2026, the CSSF issued Circular 26/906, a major overhaul of governance, central administration and risk management requirements for payment institutions, electronic money institutions and AISPs.
It becomes fully applicable 30 June 2026.
Here are the essentials 
Who does it apply to?• Luxembourg payment institutions
• Luxembourg electronic money institutions
• AISPs, treated as payment institutions (proportionality applies)
• Lux branches of non‑EEA PI/EMIs
• EEA branches for CSSF‑host areas (AML, redress)
It also repeals IML 95/120, IML 96/126, IML 98/143, CSSF 04/155, and amends CSSF 11/510 & 11/520.
What has changed?
A single, expanded governance rulebookThe circular consolidates and replaces several older texts, delivering a much more granular, prescriptive governance framework. It now details organisational design, committee structures, decision‑making lines, documentation standards, escalation processes, and expectations for policies across risk, compliance, safeguarding, outsourcing and ICT. Supervisory and management bodies must demonstrate active, documented oversight, with explicit duties around strategy, risk appetite, internal control oversight and safeguarding.
Stronger internal control requirementsInternal control functions must be permanent, independent, adequately staffed, and directly connected to governance bodies.
Key reinforcements include:
• A full‑time, dedicated Chief Compliance Officer unless CSSF grants an exception.
• Clear functional independence and unrestricted access for compliance, risk control and internal audit.
• Mandatory annual summary reports from each internal control function submitted to the CSSF.
• More prescriptive methodologies for risk identification, follow‑up, testing, file reviews, thematic controls and reporting.
Enhanced safeguarding of users’ fundsSafeguarding becomes far more operationally detailed. Institutions must ensure:
• Daily reconciliations (weekly only with strong justification).
• Strengthened 4‑eyes principles and access controls on safeguarding accounts.
• Robust due diligence on safeguarding partners and strict criteria for acceptable “low‑risk liquid assets”.
• Continuous monitoring of segregation, timeliness of crediting, and counterparty exposures.
• Specific oversight of agents and distributors handling payment transactions or holding client funds.
Reinforced governance of outsourcing & delegationThe circular aligns PI/EMI expectations with the CSSF’s outsourcing framework:
• Formalised outsourcing lifecycle (pre‑assessment, due diligence, contracting, oversight, exit).
• Increased board accountability for governance of critical/important outsourced functions.
• Detailed requirements for intra‑group reliance (no automatic equivalence).
• Evidence‑based oversight, KPIs, KRIs, and incident tracking.
• Escalation protocols and documented supervisory access rights.
Full integration of DORA & updated ICT expectationsInstitutions must align their ICT governance with DORA, the EU digital operational resilience regime, and applicable CSSF ICT circulars. This includes:
• ICT risk management lifecycle requirements;
• stronger ICT change management and testing;
• ICT third‑party risk controls;
• operational resilience, backup, continuity and recovery expectations;
• incident classification, recording and reporting;
• board‑approved ICT and resilience strategies.
When does it apply?30 June 2026 (single application date).
Annual attestations, internal control summary reports and new governance documentation requirements apply for the first financial year ending after this date.
What should firms do now?• Perform a full governance gap analysis
• Update policies, procedures, committee charters & reporting lines
• Reassess compliance, risk control & internal audit resource sufficiency
• Strengthen safeguarding operations & reconciliation processes
• Review outsourcing arrangements, documentation and oversight
• Align ICT risk & resilience with DORA requirements
• Update internal audit planning with new coverage expectations and ensure proper reporting
