Key takeaways
- Luxembourg payment institutions safeguard under Article 14, and e-money institutions under Article 24-10, of the Law of 10 November 2009 on payment services (the LPS).
- Payment funds still held at the end of the business day after receipt must sit in a separate account at a credit institution or central bank, or in secure, liquid, low-risk assets; e-money funds received by card must be protected within five business days of issuance.
- Circular CSSF 26/906, applying from 30 June 2026, expects daily reconciliations against the banks and insurers holding the funds, with weekly reconciliation only on a documented, board-approved risk analysis.
- The circular recommends holding safeguarded funds in the currency owed to users, and requires extra foreign exchange protection where firms do not.
- Segregation is reported to the CSSF monthly; from 1 April 2027 all prudential reports move to the CSSF's eDesk platform, with monthly reporting kept solely for funds segregation.
What are the key facts on safeguarding in Luxembourg?
Luxembourg payment and e-money institutions must keep users' funds apart from their own, protected from creditors and reconciled every day.
| Item | Position |
|---|---|
| Rule | Articles 14 and 24-10 of the Law of 10 November 2009 on payment services (LPS) |
| Supervisory detail | Circular CSSF 26/906, Chapter 8, applying from 30 June 2026 |
| Regulator | Commission de Surveillance du Secteur Financier (CSSF) |
| Applies to | Payment institutions and e-money institutions with Luxembourg as home Member State, including their branches |
| Payment funds timing | By the end of the business day after receipt |
| E-money received by card | No later than five business days after the e-money is issued |
| Reconciliation | Daily, unless a documented risk analysis justifies weekly |
| Last checked | 26 October 2026, against Legilux and CSSF publications |
What does the Luxembourg payment services law require?
Segregation or insurance, the same two routes as PSD2 and the E-Money Directive, set out separately for payment and e-money institutions.
Under Article 14 of the LPS, a payment institution providing services in points 1 to 6 of the Annex must protect all funds received from users, or through another payment service provider, for executing payment transactions. Either the funds are never mixed with anyone else's and, if not yet paid to the payee or another provider by the end of the business day after receipt, are deposited in a separate account at a credit institution or, at its discretion, a central bank, or invested in secure, liquid, low-risk assets defined by the CSSF; or they are covered by an insurance policy or comparable guarantee from an insurer or credit institution outside the institution's group, for the amount that would otherwise be segregated.
Article 24-10 applies the same two routes to funds received in exchange for e-money. Funds received by a payment instrument, such as a card, need not be protected until they are credited to the institution's payment account or otherwise made available to it, and in any case must be protected no later than five business days after the e-money is issued. Where part of the funds is for future payment transactions and part for other services, the payment portion must be protected, and the CSSF may accept a representative portion estimated from historical data.
Segregated funds are not part of the institution's own estate and fall outside it on liquidation or bankruptcy. Low-risk assets are those with a specific risk capital requirement of no more than 1.6%, and units in UCITS investing only in such assets. An institution must inform the CSSF before changing its safeguarding method. The option of a central bank account was added by the Law of 4 April 2025, alongside the EU instant payments rules. Our guide to PSD2 safeguarding explains the EU model these articles transpose.
| Topic | Payment institutions (Article 14) | E-money institutions (Article 24-10) |
|---|---|---|
| Funds covered | Funds received from users or another provider for payment transactions | Funds received in exchange for e-money issued |
| Deadline | End of the business day after receipt | No separate deadline in Article 24-10; card receipts no later than five business days after issuance |
| Segregation | Separate account at a credit institution or central bank, or secure, liquid, low-risk assets | Separate account at a credit institution or central bank, or secure, low-risk assets |
| Insurance or guarantee | From an insurer or credit institution outside the group | From an insurer or credit institution outside the group |
| Change of method | Inform the CSSF beforehand | Inform the CSSF beforehand |
What does Circular CSSF 26/906 add?
The operating detail: who is responsible, how often to reconcile, how accounts must be documented and how access is controlled.
Circular CSSF 26/906, dated 20 January 2026 and applying from 30 June 2026, consolidates the CSSF's governance rules for payment and e-money institutions and repeals Circulars IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155 for them. Its Chapter 8 sets the safeguarding expectations.
| Paragraph | Requirement |
|---|---|
| 13 | The supervisory body approves in writing the guiding principles on safeguarding. |
| 20 and 51 | If safeguarding compliance is no longer ensured, corrective measures are required without delay and the CSSF is informed. |
| 172 | Internal audit reviews safeguarding every year, including access rights, reconciliation procedures and the monitoring of safeguarding levels. |
| 201 | The institution must always be able to identify all users' funds clearly and precisely, and plan for a bank or insurer ending its contract. |
| 202 | Funds are reconciled with information from the banks and insurers protecting them, under written procedures; a named management body member oversees the controls. |
| 203 | Daily controls and reconciliations; weekly only on a justified, documented and board-validated risk analysis; four-eyes review; IT-based tools recommended, manual processes exceptional. |
| 204 and 208 | Access to accounts and payment powers on safeguarded funds limited to need-to-know, with four-eyes approval by a management body member. |
| 206 and 207 | Segregation accounts opened in the institution's name solely for users, with contracts or written bank confirmations that protect the funds as the LPS requires. |
| 209 | The institution remains fully responsible for funds handled by its agents, distributors and branches. |
| 210 | No mixing at any time, including with fees and commissions the institution has earned. |
| 211 | Review conflicts from concentrating segregation accounts with the same banks or investing in one group's products. |
| 214 | Hold safeguarded funds in the currency owed to users, or add foreign exchange protection. |
| 215 to 217 | Insurance or guarantee cover reviewed regularly, paid into a dedicated account, and its terms examined by a legal expert. |
How often must a Luxembourg institution reconcile?
Every day, against the bank and insurer records, unless a documented risk analysis approved by the management and supervisory bodies supports weekly.
Paragraph 202 of the circular requires processes that reconcile the funds received from users with information from the counterparties holding them, such as credit institutions and insurers, and that identify at any time and without delay any funds not protected under Article 14 or 24-10. Paragraph 203 bases these controls on daily reconciliations, given the volume and complexity of payment and e-money business. Weekly reconciliation is possible only on a justified, documented risk analysis validated by the management and supervisory bodies.
The circular also expects the reconciliations to be reviewed under the four-eyes principle and recommends IT-based control and reconciliation tools, treating manual processes as exceptional. In practice, this makes a spreadsheet reconciliation prepared and checked by the same person hard to defend in Luxembourg. Our guide to three-way reconciliation shows how ledger, processor and bank records are matched in one run, and daily reconciliation in Safeheld shows the same process automated.
Must safeguarded funds be held in the same currency?
The CSSF recommends it, and requires extra foreign exchange protection where an institution does not.
Paragraph 214 recommends holding users' funds, in segregated deposits or low-risk assets, in the currency of the funds owed to users, so the safeguarded assets are not exposed to exchange rate movements. An institution that holds them in another currency must put additional protection in place to limit that exposure. For a multi-currency e-money institution, this means the safeguarding position has to be calculated, and tested for a shortfall, currency by currency rather than as one converted total.
What does a currency shortfall look like?
A balance that covers users one day can be short the next without a single payment moving.
Worked example. A Luxembourg e-money institution owes US customers USD 40.0 million of e-money. Instead of a dollar account, it holds the cover in a euro segregation account: EUR 36.8 million, worth USD 40.0 million at 1.0870 dollars per euro. The next day the euro weakens to 1.0650.
| Item | Day 1 | Day 2 |
|---|---|---|
| E-money owed in USD | 40.00m | 40.00m |
| Euro segregation account | EUR 36.80m | EUR 36.80m |
| Exchange rate, USD per EUR | 1.0870 | 1.0650 |
| Account value in USD | 40.00m | 39.19m |
| Position | Covered | Short by USD 0.81m |
The account value on day 2 is EUR 36.80 million multiplied by 1.0650, or USD 39.19 million, leaving USD 0.81 million, about 2%, unprotected. Under paragraph 202 the institution must be able to see that gap at once; holding the cover in dollars, as paragraph 214 recommends, removes it. The same logic applies to every currency a firm issues e-money in.
What must be reported to the CSSF?
A monthly table on third-party funds, quarterly prudential tables, and annual attestations; all moving to eDesk from 1 April 2027.
The CSSF's legal reporting page lists a monthly balance sheet and a monthly table identifying third-party funds held (Table Z 1.2 for payment institutions, W 1.2 for e-money institutions), a quarterly statement of authorised reinvestments for e-money institutions (W 1.3), and quarterly capital adequacy and profit and loss tables, submitted as unaltered Excel templates.
On 10 September 2026 the CSSF announced a new reporting module on eDesk. Testing runs from 1 January to 31 March 2027, and from 1 April 2027 eDesk becomes the only official channel, including for reports on periods ending before that date. Reporting becomes quarterly for financial and staffing information, with monthly reporting kept solely for funds segregation, and an annual section on shareholders, branches, agents and distributors. Firms can submit through the interface, by a JSON file, or through an optional API connection to their own systems.
| Report | Frequency | Who signs or submits |
|---|---|---|
| Segregated funds (Z 1.2 or W 1.2 today; eDesk segregation section from April 2027) | Monthly | Periodic information validated by a management body member (paragraph 90 of Circular 26/906) |
| Authorised reinvestments, e-money institutions (W 1.3) | Quarterly | The institution |
| Annual attestation of compliance with Circular 26/906 | Annually, by the end of the third month after year end | All management body members |
| Compliance and internal audit summary reports | Annually, by the end of the third month after year end | Chief Compliance Officer and Chief Internal Auditor |
Because the monthly segregation figures will be structured data checked automatically on entry, a figure that does not agree with the institution's own daily reconciliation will be visible to the CSSF without an inspection.
What should a Luxembourg PI or EMI check?
These checks follow Chapter 8 of the circular point by point.
- Guiding principles on safeguarding approved in writing by the supervisory body.
- A named management body member responsible for safeguarding controls.
- Daily reconciliation of users' funds to each bank and insurer, or a documented, board-approved case for weekly.
- Four-eyes review of every reconciliation and every movement of safeguarded funds.
- Segregation accounts in the institution's name for users only, with contracts or written bank confirmations on file.
- Fees and commissions withdrawn from segregation accounts promptly and never left mixed with users' funds.
- Safeguarded funds held in each currency owed, or foreign exchange protection documented.
- Agents and distributors monitored, since the institution stays fully responsible for their funds.
- Monthly segregation figures agreed to the daily reconciliation before submission.
Our guides to EU safeguarding by country, DNB safeguarding and the PSD3 timeline cover neighbouring regimes and the changes ahead.
How does Safeheld help?
Safeheld reconciles users' funds to every segregation account each day, for each entity and in each currency, and raises any shortfall as a break for same-day resolution.
Each reconciliation and each proposed movement of safeguarded funds is approved by a second person, and the break history is kept for the annual internal audit review. Platforms that hold users' funds through distributors or several entities can see each one separately; see platforms and marketplaces.
Frequently asked questions
Which Luxembourg law governs safeguarding?
Article 14 (payment institutions) and Article 24-10 (e-money institutions) of the Law of 10 November 2009 on payment services, with Chapter 8 of Circular CSSF 26/906 setting the supervisory detail.
When must Luxembourg payment institutions safeguard funds?
Funds not yet paid to the payee or another provider by the end of the business day after receipt must be in a separate account at a credit institution or central bank, or in secure, liquid, low-risk assets, unless covered by insurance or a guarantee.
What is the deadline for e-money funds received by card?
They must be protected once credited to the institution's payment account or otherwise made available to it, and in any case no later than five business days after the e-money is issued.
Does the CSSF require daily reconciliation?
Paragraph 203 of Circular CSSF 26/906 bases safeguarding controls on daily controls and reconciliations. Weekly reconciliation is possible only on a justified, documented risk analysis validated by the management and supervisory bodies.
When does Circular CSSF 26/906 apply?
From 30 June 2026. It was issued on 20 January 2026 and replaces Circulars IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155 for payment and e-money institutions.
Can safeguarded funds be held in a different currency?
The CSSF recommends holding them in the currency owed to users. An institution that does not must add foreign exchange protection to limit the exposure, under paragraph 214 of the circular.
How is safeguarding reported to the CSSF?
Monthly, in the table identifying third-party funds held (Z 1.2 or W 1.2). From 1 April 2027 reporting moves to eDesk, where monthly reporting is kept solely for funds segregation.
Who is responsible for safeguarding at a Luxembourg institution?
The supervisory body approves the safeguarding principles, a named management body member oversees the controls, and internal audit reviews safeguarding every year.
References
- Legilux, Law of 10 November 2009 on payment services, consolidated version applicable from 11 April 2025 (French)
- CSSF, Law of 10 November 2009 on payment services, English coordinated text (PDF)
- CSSF, Circular CSSF 26/906 on central administration, internal governance and risk management (20 January 2026, PDF)
- CSSF, Legal reporting for payment institutions, e-money institutions and AISPs
- CSSF, Evolution of prudential reporting for PIs, EMIs and CASPs (10 September 2026)
- Directive (EU) 2015/2366 (PSD2)
- Directive 2009/110/EC (EMD2)
About Safeheld
Safeheld is reconciliation and regulatory financial control software for regulated firms that hold client money. For Luxembourg payment and e-money institutions it reconciles users' funds to segregation accounts every day by entity and currency, records the second-person review, and keeps the break history internal audit reviews each year. To discuss your safeguarding operations, contact us at safeheld.com/contact.
This article is general information on Luxembourg safeguarding rules and is not legal or regulatory advice.