Fintech & payments regulation in Luxembourg (2026)
Fintech and digital payments in Luxembourg: licensing regime.
Luxembourg operates a clear, well-established licensing regime for digital payments and fintech. Payment institutions (PIs), e-money institutions (EMIs) and AISPs require authorisation/registration from the CSSF under the Law of 10 November 2009, while crypto-asset service providers fall under directly-applicable EU MiCA with the CSSF as competent authority. EU-wide rules on open banking (PSD2) and mandatory SEPA instant credit transfers (Regulation (EU) 2024/886) are fully applicable.
Legal framework
Law of 10 November 2009 on payment services (transposing PSD2 / EMD2), supervised by the Commission de Surveillance du Secteur Financier (CSSF); complemented by EU Regulations MiCA (crypto-assets, with CSSF designated as competent authority by the Law of 6 February 2025) and the Instant Payments Regulation (EU) 2024/886.
How to get an EMI license in Luxembourg
To provide electronic-money or payment services in Luxembourg you need authorisation as an Electronic Money Institution (EMI), supervised by the Commission de Surveillance du Secteur Financier (CSSF), under the EU E-Money Directive (2009/110/EC) and the Second Payment Services Directive (PSD2).
- Authority
- the Commission de Surveillance du Secteur Financier (CSSF)
- License required
- authorisation as an Electronic Money Institution (EMI)
- Framework / law
- the EU E-Money Directive (2009/110/EC) and the Second Payment Services Directive (PSD2)
- Minimum capital
- €350,000 initial capital for a full (Authorised) EMI; a lighter Small EMI regime exists below an average €5m of outstanding e-money
- Timeline
- roughly 3–12 months; the regulator has up to 3 months to decide once the application is complete
- Cost
- application and supervisory fees that vary by country (often €5,000–€25,000), plus safeguarding and audit costs
- Passporting
- Yes: an EMI authorisation passports across the whole EEA (all 27 EU states plus Norway, Iceland and Liechtenstein).
What an EMI license in Luxembourg covers
- Issuing electronic money and maintaining payment accounts
- Executing payment transactions: credit transfers, direct debits and card payments
- Issuing and/or acquiring payment instruments
- Money remittance
- Payment initiation services (PIS)
- Account information services (AIS)
Step by step: getting an EMI license in Luxembourg
Incorporate in the member state and establish real local substance (registered office and part of the business conducted there).
Build the application file: programme of operations, three-year business plan, governance, AML/CFT, safeguarding and security policies.
Deposit and evidence the €350,000 initial capital.
Submit the application to the national competent authority.
The authority has three months from a complete application to grant or refuse.
On authorisation you are entered in the national and EBA registers, then passport into other EEA states before serving them.
Documents required in Luxembourg
- Programme of operations listing each payment service you will provide
- Business plan with a three-year budget forecast
- Evidence of the €350,000 initial capital
- Governance arrangements and internal-control mechanisms
- AML/CFT policy and appointment of a compliance officer
- Safeguarding arrangements for client funds (segregated account or insurance)
- Security policy, incident management and ICT resilience procedures
- Fit-and-proper documentation for directors and qualifying shareholders
- Description of any outsourcing, agents or distributors
- Professional indemnity insurance where you provide PIS or AIS
Ongoing obligations in Luxembourg
- Maintain own funds under the applicable calculation method (A, B or C)
- Safeguard client funds at all times, segregated or insured
- Apply strong customer authentication (SCA) under PSD2
- Run continuous AML/CFT monitoring and reporting
- Report major operational and security incidents to the regulator
- Submit annual audited accounts and periodic regulatory reporting
Key points: digital payments & fintech in Luxembourg
Regulator & core law
The CSSF is the single competent authority for payments and e-money. The Law of 10 November 2009 on payment services (as amended) transposes PSD2 (Directive (EU) 2015/2366) and the E-Money Directive 2009/110/EC; no entity established in Luxembourg may provide payment services or issue e-money without CSSF authorisation.
PI / EMI licensing process
Prospective PIs and EMIs file a detailed application with the CSSF; the licence is formally granted by the Minister on the CSSF's recommendation. Minimum initial capital ranges from EUR 20,000-125,000 for PIs (depending on services) and EUR 350,000 for EMIs, with head office and central administration required in Luxembourg.
Open banking (PSD2)
Instant payment rails
The EU Instant Payments Regulation (EU) 2024/886 applies directly: euro-area banks had to receive SEPA instant credit transfers from 9 January 2025 and send them from 9 October 2025 (PIs/EMIs by 9 April 2027), with no surcharge above standard transfers. Luxembourg banks settle via the ECB's TIPS platform, accessed through the Banque centrale du Luxembourg (BCL).
Crypto-assets (MiCA)
Crypto-asset service providers (CASPs) and ART/EMT issuers are regulated under EU Regulation (EU) 2023/1114 (MiCA), in force since 30 December 2024. The Law of 6 February 2025 designated the CSSF as the sole national MiCA authority; pre-existing VASPs benefit from a transitional/grandfathering period until 1 July 2026.
BNPL & PSD3 horizon
Buy-now-pay-later credit is being brought under the revised EU Consumer Credit Directive (Directive (EU) 2023/2225), to be transposed nationally and applied by November 2026. The EU is also negotiating PSD3 and a Payment Services Regulation that will eventually supersede the current PSD2-based regime.
EMI license in Luxembourg: FAQ
Do you need a license to run an e-money business in Luxembourg?
Yes. To provide electronic-money or payment services in Luxembourg you need authorisation as an Electronic Money Institution (EMI), supervised by the Commission de Surveillance du Secteur Financier (CSSF), under the EU E-Money Directive (2009/110/EC) and the Second Payment Services Directive (PSD2).
Which authority issues EMI licenses in Luxembourg?
The Commission de Surveillance du Secteur Financier (CSSF).
How much does an EMI license cost in Luxembourg?
Application and supervisory fees that vary by country (often €5,000–€25,000), plus safeguarding and audit costs.
How long does it take to get an EMI license in Luxembourg?
Typically roughly 3–12 months; the regulator has up to 3 months to decide once the application is complete.
What documents do you need for an EMI license in Luxembourg?
The application file centres on programme of operations listing each payment service you will provide; business plan with a three-year budget forecast; evidence of the €350,000 initial capital; governance arrangements and internal-control mechanisms; plus fit-and-proper evidence for directors and qualifying shareholders.
What is the application process for an EMI license in Luxembourg?
Incorporate in the member state and establish real local substance (registered office and part of the business conducted there). Build the application file: programme of operations, three-year business plan, governance, AML/CFT, safeguarding and security policies. The authority then assesses the file and, once authorised, you can begin operating.
Does an Luxembourg EMI license work in other EU/EEA countries?
Yes: an EMI authorisation passports across the whole EEA (all 27 EU states plus Norway, Iceland and Liechtenstein).
Timeline of decisions
- Guidance · officialCSSF Circular 26/906: Consolidated Governance Framework for Payment and E-Money Institutions
The CSSF published Circular 26/906, a sweeping update establishing unified central-administration, internal-governance and risk-management rules for Luxembourg payment institutions, e-money institutions and AISPs, effective 30 June 2026. It formalises the three-lines-of-defence model, mandates daily client-fund reconciliations, introduces transfer-pricing obligations, and requires annual compliance attestations submitted to the CSSF.
CSSF
- Law · officialDORA Enters into Application, CSSF Oversees ICT Operational Resilience for Fintechs
Regulation (EU) 2022/2554 on Digital Operational Resilience (DORA) became directly applicable on 17 January 2025, with the CSSF as Luxembourg's competent authority for payment institutions and fintech entities. DORA requirements on ICT risk management, incident reporting, resilience testing and third-party provider risk take precedence over overlapping CSSF circulars from that date.
CSSF
- LawBlockchain Law IV Enters into Force, Expanded DLT Tokenisation and Smart-Contract Payments
The Law of 20 December 2024 (Blockchain IV) entered into force on 31 December 2024, amending the Law of 6 April 2013 on dematerialised securities to allow issuance and custody of equities, fund units and tokenised physical assets via DLT. It introduced a new 'control agent' role, enabled multi-custodian EU-wide settlement chains, and permitted smart-contract-automated payment obligations (interest, dividends, repayments).
Goodwin Law
- LawBlockchain Law III, EU DLT Pilot Regime Transposed and Digital Collateral Arrangements Recognised
The Law of 14 March 2023 (Blockchain III) transposed the EU DLT Pilot Regime (Regulation 2022/858), enabling firms to operate licensed DLT-based trading and settlement venues in Luxembourg under a flexible regulatory framework effective 23 March 2023. It also amended the Law of 5 August 2005 on financial collateral to explicitly recognise DLT-registered instruments in collateral arrangements, providing legal certainty for digital-asset financing.
Luxembourg for Finance
- Law · officialAuthorisation Law, CSSF Becomes Sole Licensing Authority for Payment and E-Money Institutions
The Law of 21 July 2021 entered into force on 30 July 2021, transferring from the Minister of Finance to the CSSF the exclusive power to grant, refuse and withdraw authorisations for payment institutions and e-money institutions. This streamlined fintech licensing, created a single regulatory point of contact, and aligned Luxembourg with best European practice for centralised financial supervision.
CSSF
- LawBlockchain Law I, DLT Legally Recognised for Securities Circulation in Luxembourg
The Law of 1 March 2019 (Blockchain I) amended the Law of 1 August 2001 on the circulation of securities, making Luxembourg one of the EU's first member states to grant DLT-based issuance and transfer of securities the same legal standing as traditional book-entry transactions. This foundational step underpins all subsequent blockchain legislation and Luxembourg's strategy as a European DLT and fintech hub.
Luxembourg for Finance
- Law · officialLaw of 20 July 2018, PSD2 Transposition Introduces PISPs, AISPs and Strong Customer Authentication
Luxembourg amended the 2009 Payment Services Law to transpose PSD2 (EU Directive 2015/2366), more than six months past the January 2018 EU deadline. The amendment created two new licensed third-party provider categories, payment-initiation service providers (PISPs) and account-information service providers (AISPs), mandated strong customer authentication, and tightened operational-security incident reporting obligations for all payment institutions.
CSSF
- Law · officialLaw of 10 November 2009, Foundational Payment Services Law (PSD1 Transposition), PI and EMI Licensing Established
The Payment Services Law (PSL) of 10 November 2009 transposed PSD1 (EU Directive 2007/64/EC) and established Luxembourg's core licensing framework for payment institutions and e-money institutions under CSSF supervision. It defines authorisation requirements, passporting rights, conduct-of-business rules and client-fund safeguarding obligations that remain the bedrock of the country's PI/EMI regulatory architecture today.
CSSF
Sources
- cssf.lu/en/payment-institutions-electronic-money-institutions-aisp/
- cssf.lu/en/authorisation-procedure-payment-institution-or-electronic-money-in
- cssf.lu/wp-content/uploads/L_101109_psd_eng.pdf
- cssf.lu/en/markets-in-crypto-assets-mica-micar/
- cssf.lu/en/crypto-assets-service-providers-casp/
- bcl.lu/en/payment-systems/systemes_paiement/paiment_masse/index.html
- dlapiper.com/en/insights/publications/2025/04/luxembourg-implements-eu-regulation-
Next for Luxembourg: Digital Nomad & ResidencyVia other route
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 23 May 2026. Methodology & how to cite · State of Technology Regulation 2026