What Changes When CSSF Prudential Reporting Moves to eDesk in 2027?

Key takeaways

• On 10 September 2026 the CSSF announced that prudential reporting by Luxembourg payment institutions, e-money institutions and MiCA crypto-asset service providers will move from Excel templates to a reporting module on its eDesk platform.
• The module is open for testing from 1 January to 31 March 2027, and test submissions are not official regulatory filings.
• From 1 April 2027 eDesk is the only official channel for every report due on or after that date, including March 2027 monthly reports due in April.
• Financial and human resources information becomes quarterly, monthly reporting is kept solely for funds segregation, and a new annual section covers shareholding, branches, agents and distributors.
• A new CSSF circular, still to be published, will replace Circulars CSSF 11/511 and 11/522, which today set the reporting instructions for payment and e-money institutions.

What are the key facts on the CSSF eDesk reporting change?

Luxembourg payment and e-money institutions, and crypto-asset service providers authorised by the CSSF, will file prudential reports through eDesk from 1 April 2027 instead of sending Excel files.

What is the CSSF changing?

The CSSF is replacing emailed Excel templates with structured online forms that check the data as it is entered.

Today, Luxembourg PIs and EMIs complete the Excel tables listed on the CSSF legal reporting page and send them through the external transmission channels set by Circular CSSF 23/833. The templates must keep their structure, and the instructions sit in Circulars CSSF 10/462, 11/511 (payment institutions) and 11/522 (e-money institutions).

Under the CSSF communiqué of 10 September 2026, that process moves to a reporting module on eDesk. Forms will be dynamic, meaning each firm sees only the sections that apply to its licence. The module adds automatic formulas, real-time integrity controls that flag inconsistencies or errors during data entry, a free-text box for comments, and follow-up questions handled inside the platform rather than by email. The CSSF will also collect in one place information it used to request separately, such as shareholding, branch and distributor details.

For CASPs the change brings a first dedicated prudential reporting framework: the forthcoming circular will introduce specific reporting obligations for CASPs authorised under Article 63 of MiCA, alongside replacing Circulars 11/511 and 11/522. Our guide to MiCA reporting obligations covers what CASPs already report under the regulation itself.

When does eDesk reporting become mandatory?

On 1 April 2027, for every report due on or after that date, whatever period the report covers.

The test that decides which channel to use is the report's deadline, not the period it covers. A report due on or before 31 March 2027 is filed through the current channel, even if the firm has already tested it in eDesk. A report due on or after 1 April 2027 goes through eDesk only, even if it covers a period that ended before that date. The CSSF gives March 2027 monthly reports, which fall due in April, as the example.

For groups that file in several countries, this date belongs in the same plan as other regulators' deadlines; our regulatory reporting calendar for payment groups sets out how to run one.

How does current CSSF reporting compare with the eDesk model?

Most of the monthly reporting goes, quarterly reporting stays, and segregation becomes the one monthly report.

The current template set for payment and e-money institutions is shown below, with the reporting frequency the communiqué sets for each type of information under eDesk. The new circular and Annex 1 will define the exact content, so firms should treat the right-hand column as the direction of travel rather than a field-by-field mapping.

Annual documents filed under Circular CSSF 15/614, such as the internal auditor's summary report and the long form audit report, are listed separately on the CSSF reporting page and are not described in the communiqué as moving into the new module.

How will firms submit reports through eDesk?

By typing into the eDesk forms, by sending a JSON file through S3, or through an optional API connection to the firm's own systems.

A JSON file is a structured text file that a system can produce automatically; S3 is a file transfer service the CSSF uses to receive such files. According to the communiqué, the JSON file carries the same data points as Annex 1, the CSSF's overview of data points with preparatory guidance, which the CSSF publishes for information and says may still change. The optional API route lets a firm's internal systems feed quantitative data straight into eDesk.

Access to eDesk is personal. CSSF guidance states that users need a LuxTrust certificate, a Luxembourg digital identity, to identify and authenticate themselves on the portal, and recommends the LuxTrust Mobile identity, ordered online and confirmed by video identification. Firms should check before January 2027 that everyone who will prepare, review or submit reports has working credentials.

What should the monthly segregation figure look like?

One number per reporting date that agrees to the firm's own reconciliation, with every adjustment explained.

Because segregation is the only monthly report, and eDesk checks data on entry, it becomes the figure the CSSF sees most often. Two common problems surface quickly: finance enters a bank total while compliance works from the ledger, and adjustments made at month end cannot be traced back to the daily work. The fix is to report the figure that the 31st-of-the-month reconciliation already produced, not a new calculation.

Worked example. Nexus Payments, a Luxembourg e-money institution, prepares its segregation figure for 31 March 2027, the first monthly report filed through eDesk. Its ledger shows EUR 125.40 million owed to users. Its two segregation accounts hold EUR 84.20 million and EUR 41.90 million.

The arithmetic: EUR 84.20 million plus EUR 41.90 million is EUR 126.10 million; less EUR 0.42 million of Nexus's own fees and EUR 0.28 million of payouts in transit leaves EUR 125.40 million, exactly the amount owed. If finance had reported the EUR 126.10 million bank total while the risk team quoted the ledger, the CSSF would see two figures EUR 0.70 million apart. The fees also matter on their own: they are the firm's money sitting in an account meant only for users, and should be withdrawn promptly. Our guide to Luxembourg EMI safeguarding explains the segregation rules behind each line, and daily safeguarding reconciliation shows how the daily version of this table is built.

Who must review and sign off the reports?

A member of the management body must formally review and validate periodic information sent to the CSSF.

Paragraph 90 of Circular CSSF 26/906 requires the information communicated periodically, or on request, to the CSSF to be systematically and formally reviewed and validated by a member of the management body. Paragraph 89 expects the finance function to produce and transmit this information on time and reliably, in particular on solvency and on the protection of payment service users' funds. Paragraph 108 lists the reconciliation and confirmation of accounts among the critical ongoing controls. For safeguarded funds, paragraph 203 goes further: given the volume and complexity of payment and e-money business, controls must rest on daily reconciliations, with weekly reconciliation allowed only on a justified, documented risk analysis validated by the management and supervisory bodies, and reviewed under the four-eyes principle.

The same circular, which institutions had to comply with by 30 June 2026 according to the CSSF's announcement, also requires the management body to confirm compliance to the CSSF once a year, by the last day of the third month after the financial year end, under paragraphs 71 and 218, alongside summary reports from the compliance and internal audit functions due by the same date. In practice the eDesk submission becomes the last step of a chain: the reconciliation is prepared, reviewed by a second person, and validated by the responsible management body member before anyone presses submit.

What should Luxembourg PIs, EMIs and CASPs prepare now?

Firms should fix data ownership and their segregation figure in the last quarter of 2026, then use the Q1 2027 test window to file real data.

• Read Annex 1 and map every data point to the system, report and person that produces it.
• Name one owner for each section: segregation, financial information, human resources and the annual shareholding, branches, agents and distributors section.
• Define a single segregation figure per reporting date that agrees to the month-end daily reconciliation, with each adjustment listed and evidenced.
• Separate the firm's own fees and commissions from users' funds before month end, so they do not appear as adjustments every month.
• Decide between the interface, JSON by S3 and the optional API, based on the number of entities and how much data is retyped today.
• Obtain LuxTrust credentials and eDesk accounts for every preparer, reviewer and submitter before January 2027.
• Submit January and February 2027 data in the test module and compare the results with the Excel filings made through the current channel.
• Record the management body member who validates each report under paragraph 90 of Circular 26/906, and keep the evidence of that review.
• Update reporting procedures and policies once the new circular replacing Circulars 11/511 and 11/522 is published.
• Confirm that the March 2027 monthly report, due in April, is prepared for eDesk and not for the old templates.

How does Safeheld help?

Safeheld matches bank statements, processor reports and ledgers every day, for each legal entity and in each currency, so the month-end segregation figure is simply the last daily reconciliation of the month.

Breaks such as payouts in transit are raised the day they appear, timing items are cleared by rule, and every other difference is worked to a cause with evidence recorded, which gives the validating management body member a complete trail. Regulatory returns and audit packs are prepared from the same reconciled figures; see daily reconciliation and e-money wallets.

Frequently asked questions

What is CSSF eDesk?

eDesk is the CSSF's online portal for exchanges with supervised entities. From 1 April 2027 it hosts a dedicated module for prudential reporting by Luxembourg payment institutions, e-money institutions and crypto-asset service providers, replacing Excel template submissions.

When does eDesk reporting become mandatory for payment and e-money institutions?

From 1 April 2027 eDesk is the sole official channel for every prudential report whose deadline falls on or after that date, including March 2027 monthly reports due in April. Reports due on or before 31 March 2027 use the current channel.

Can firms test eDesk reporting before it becomes mandatory?

Yes. The module is available to all entities concerned for testing from 1 January to 31 March 2027. Test submissions are not official regulatory filings, so reports due in that period must still be filed through the current channel.

Will Luxembourg PIs and EMIs still report monthly?

Only for funds segregation. Under the CSSF communiqué of 10 September 2026, financial and human resources information becomes quarterly, monthly reporting is kept solely for funds segregation, and an annual section covers shareholding, branches, agents and distributors.

Which circulars will the new CSSF reporting circular replace?

A dedicated CSSF circular, still to be published, will replace Circulars CSSF 11/511 and 11/522, which set the reporting instructions for payment institutions and e-money institutions, and will introduce specific reporting obligations for crypto-asset service providers authorised under Article 63 of MiCA.

How can reports be submitted through eDesk?

Firms can complete the dynamic forms in the eDesk interface, send a JSON file containing the Annex 1 data points through S3, or use an optional API connection that feeds quantitative data from their own systems.

Do eDesk users need a LuxTrust certificate?

Yes. CSSF guidance states that users need a LuxTrust certificate to identify and authenticate themselves on the eDesk portal, and recommends a LuxTrust Mobile identity ordered online and confirmed by video identification.

Who must validate reports sent to the CSSF?

Paragraph 90 of Circular CSSF 26/906 requires periodic information sent to the CSSF to be systematically and formally reviewed and validated by a member of the management body of the payment or e-money institution.

References

• CSSF, Evolution of prudential reporting for payment institutions, electronic money institutions and crypto-asset service providers (10 September 2026)
• CSSF, Évolution du reporting prudentiel pour les établissements de paiement, les établissements de monnaie électronique et les prestataires de services sur crypto-actifs (10 September 2026, French)
• CSSF, Annex 1: Overview of the data points to be reported and preparatory guidance for entities (XLSX)
• CSSF, Legal reporting for payment institutions, e-money institutions and AISPs
• CSSF, Circular CSSF 26/906 on central administration, internal governance and risk management (20 January 2026, PDF)
• CSSF, New Circular CSSF 26/906 applicable to payment and electronic money institutions (January 2026)
• CSSF, LuxTrust: how to get a certificate to access eDesk

About Safeheld

Safeheld is reconciliation and regulatory reporting software for regulated firms that hold client money. For Luxembourg payment and e-money institutions it reconciles users' funds every day by entity and currency, raises breaks the day they appear, and keeps the evidence behind each monthly segregation figure. To discuss your safeguarding reconciliation and reporting, contact us at safeheld.com/contact.

This article is general information on CSSF prudential reporting and is not legal or regulatory advice.