CRD VI implementation in Luxembourg: the clock has started ticking!

On 2 October 2025, bill of law 8627 (Bill) implementing Directive (EU) 2024/1619 (CRD VI), and part of the EMIR 3 Package on the concentration risks arising from exposures to third-country central counterparties,[1] was officially submitted to the Luxembourg Parliament.

CRD VI is the sixth Capital Requirements Directive and constitutes, together with Regulation (EU) 2024/1623 of 31 May 2024 amending Regulation (EU) No 575/2013 (CRR), a new banking package aimed at further harmonising the banking supervisory framework within the European Union (EU).

Key developments

The Bill, which mostly concerns credit institutions and (mixed) financial holding companies (Institutions), introduces significant changes to Luxembourg’s banking and financial regulatory framework, most notably regarding the following topics:

Material (corporate) operations under enhanced scrutiny

Material operations undertaken by Institutions will now be subject to enhanced supervisory scrutiny, ranging from a mere notification up to a prior approval process. This reflects CRD VI’s objective of ensuring that corporate transactions do not undermine the prudential soundness of supervised entities.

The new regime applies to three different categories:

• Mergers and divisions: Institutions must obtain a prior approval from the Commission de Surveillance du Secteur Financier (CSSF) for mergers and divisions as defined in CRD VI, with the exclusion of resolution-related operations. Institutions must notify the CSSF once the draft terms of the proposed transaction have been adopted, but prior to completion, and provide all necessary information.
• Acquisitions or divestitures of material holdings: Institutions must notify the CSSF of any planned acquisition (or divestitures) of what is considered a material holding.[2] This non-objection regime offers some alignment with the existing notification regime for the acquisition (or disposal) of qualifying holdings in credit institutions.
• Material transfers of assets and liabilities: Institutions must notify the CSSF of any planned transfer of assets or liabilities considered to be material,[3] except where such a transfer relates to non-performing assets, assets intended for inclusion in a cover pool or to be used for securitisation, or where it is completed in a resolution context.

Enhanced internal governance

In order to foster regulatory convergence and avoid a fragmented EU-wide “fit and proper” framework, CRD VI lays down much more harmonised requirements relating to internal governance, including for key function holders. In addition to the measures that are already provided in various regulatory instruments used by the CSSF in its administrative practice[4] and which will now receive a clear legal basis in the Financial Sector Law,[5] the Bill provides additional changes and adds further granularity to assessing the suitability of members of the management body and key function holders. This covers notably the obligations for certain Institutions to draw up, maintain and update individual statements setting out the roles and duties of all members of the management body in its management function, of senior management and of key function holders. A separate mapping of duties, including details of the reporting lines and of the lines of responsibility, is also required to ensure that individual functions and responsibilities are clearly and consistently defined.

Comprehensive integration of ESG risks

The Bill strengthens requirements for credit institutions and certain investment firms to integrate environmental, social and governance (ESG) risks across short, medium and long-term horizons, thus reflecting the growing recognition of ESG risks as material financial risks that require robust prudential oversight. As such, Institutions must identify, assess and manage ESG risks across their internal organisation and activities, including risk management processes, governance structures and disclosure practices, and this obligation will become subject to a more granular legal basis.

Third-country branch (TCB) regime

The cross-border provision of core banking services[6] in Luxembourg by a third-country firm (TCF) will become subject to a newly defined TCB regime, pursuant to which such a firm will have to establish a locally licensed TCB in order to be able to validly continue providing such services.

While deposit-taking activities provided by any type of TCF will trigger the TCB requirement, the granting of loans and/or the issuance of guarantees or commitments will only require a TCB where such activities are provided by a TCF which would either qualify as a credit institution (if based in the EU) or which would meet certain other conditions. Otherwise said, non-banking entities domiciled in third countries, including investment funds and other non-bank entities, may then, depending on the specific circumstances, continue to provide loans or guarantees in Luxembourg on a cross-border basis without the need to establish a TCB.

Nevertheless, several exemptions to this TCB regime are predicted, for example whenever these core banking services are provided either to other credit institutions, on a reverse solicitation basis, or in an intragroup context, or where they are performed on an ancillary basis to MiFID investment services, or where they are also ancillary to services relating to custody, administration and safekeeping of financial instruments.

In line with Article 21c(5) of CRD VI, the Bill also provides for a grandfathering regime to preserve legal certainty for any agreements concluded by the TCF before 11 July 2026, which will thus not become subject to the TCB regime on the basis of the implementing provision.

Regarding the scope of the TCB, it is worth highlighting that the Bill adds a territorial component to this requirement, specifying that the obligation to establish a TCB only applies to core banking services when carried out in Luxembourg, by reference to an interpretative communication on banking services issued by the EU Commission.[7]

Finally, and given the so far fragmented regulatory landscape for branches of third country credit institutions, in line with CRD VI, the Bill provides that, at the same time, these TCBs will now be subject to a much more harmonised and enhanced set of common rules at EU level, covering authorisation, prudential standards, internal governance and supervision and reporting aspects. TCBs will also be classified either as class 1 or class 2, depending on their size, systemic relevance and balance sheet. Heightened prudential, governance and reporting obligations will be imposed on class 1 TCBs.

Sanctions

Breaches of the newly applicable banking package will be subject to an extended sanctions framework to be used by the CSSF, which includes the following:

• As a new enforcement tool, periodic penalty payments may be imposed on Institutions, as well as on the members of management body, senior management, key function holders and other staff materially impacting the institution’s risk profile.
• The application of periodic penalty payments will not prevent the CSSF from imposing administrative penalties or other administrative measures for the same breach.

Legislative process

It is important to note that the Bill remains at an early draft stage, having only recently been submitted to Parliament. The legislative process will thus have to be closely monitored, particularly as the Bill will be the object of many comments by stakeholders involved in the process and therefore may be subject to further amendments. It is only once the opinion of the Council of State (Conseil d’État)[8] is known that there will be greater clarity, as to whether the Bill can be considered (more or less) in its final form so that implementation efforts can then be accelerated or even finalised by the Institutions.

1. Directive (EU) 2024/2994 of 27 November 2024 and Regulation (EU) 2024/2987 of 27 November 2024

2. Which is threshold based

3. Which is threshold based

4. CSSF Circular 12/552 on central administration, internal governance and risk management, as amended / CSSF’s prudential procedure for the appointment of members of the management body and key function holders in credit institutions / Guidelines from the European Banking Authority (EBA) on internal governance under Directive 2013/36/EU (EBA/GL/2021/05) / Joint Guidelines from the EBA and the European Securities and Markets Authority (ESMA”) on the assessment of the suitability of members of the management body and key function holders under Directive 2013/36/EU and Directive 2014/65/EU (EBA/GL/2021/06 and ESMA35-36-2319)

5. Law of 5 April 1993 on the financial sector, as amended

6. As listed in Annex I of the Financial Sector Law: “1. Acceptance of deposits and other repayable funds”, “2. Lending, including, inter alia, consumer credit, mortgage credit, factoring, with or without recourse, financing of commercial transactions (including forfeiting)” and “6. Guarantees and commitments”

7.Commission interpretative communication: Freedom to provide services and the interests of the general good in the Second Banking Directive (97/C 209/04)

8.Which plays a crucial advisory role in the legislative process as it may induce further changes to the final text of the Bill