CSSF Governance Expectations in 2026: Lessons from Circular 26/906
- Katia Ciesielska
On 20 January 2026 the CSSF published Circular 26/906 on central administration, internal governance and risk management. Its formal scope covers payment institutions, e-money institutions and account information service providers, which must comply by 30 June 2026. In consolidating and replacing four older texts (IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155), it also does something quietly significant: it gathers the regulator’s governance thinking into a single, current reference. So why should fund boards, management companies and their independent directors care about a circular addressed to someone else?
Because the CSSF rarely writes for one sector alone. Its circulars are the clearest available record of what the regulator considers sound and prudent management, and those expectations travel. Reading 26/906 through the eyes of a fund governance practitioner, I see five themes that every Luxembourg board should take seriously, whatever its sector.
Key takeaways
- Circular CSSF 26/906, published on 20 January 2026, consolidates the regulator’s governance expectations for payment institutions, e-money institutions and AISPs, with a compliance deadline of 30 June 2026.
- Its formal scope is the payment sector, but it reads as the clearest current statement of what the CSSF considers sound governance across the whole financial centre.
- The direction of travel is personal accountability — from “the board approved it” to “which director owns this?”
- Independent control functions, a living conflicts register, and documented follow-through are the evidence supervisors now look for.
- Fund boards and management companies should map their own framework against it now, even though they sit outside its scope.
1. Central administration means real presence
The circular is explicit that central administration involves more than a registered address. Decision making and administrative functions must genuinely sit in Luxembourg. This is the same substance logic the CSSF has long applied to investment fund managers: enough qualified people, real decision making on the ground, and the ability to demonstrate both when asked.
A useful test for any board is simple. If the CSSF visited tomorrow, could you show where decisions are actually made, who makes them, and on what information? If the honest answer involves a pause, the framework needs work before the regulator supplies the deadline.
2. The board owns the framework, and ownership is becoming personal
Under 26/906 the supervisory body bears ultimate responsibility for approving the business strategy, the risk appetite, and the policies on conflicts of interest, outsourcing, information security and AML/CFT. The circular also introduces notification requirements when key control function holders are appointed or leave, and expects named senior responsibility for critical areas such as AML/CFT compliance.
The direction of travel is unmistakable. Accountability is shifting from the collective to the individual. The old comfort of “the board approved it” is giving way to a sharper question: which director owns this? In my experience independent directors should welcome that shift. Clear ownership protects the diligent. It only threatens those who accepted a mandate without understanding what came with it.
3. Control functions must be independent and properly resourced
The circular reaffirms the classic three lines model. Operational controls sit in the first line, an independent compliance and risk function forms the second, and internal audit provides the third. It goes further by requiring internal control arrangements that prevent fraud and ensure AML/CFT compliance, and by restricting how far these core functions can be outsourced.
For fund structures the parallel question is pointed. Are your second line functions genuinely independent, adequately staffed, and able to escalate to the board without filtering? A compliance function that reports through the very people it is meant to challenge fails this test, whatever the organisation chart claims. Boards should ask when compliance or risk last brought them unwelcome news directly, and reflect on how that news was received.
4. Conflicts of interest are under the microscope
Circular 26/906 requires a conflicts of interest policy that applies to all staff and to members of both the supervisory and management bodies, with serious related party matters escalated to the supervisory body itself. Expect this scrutiny to intensify across the Luxembourg financial centre, including on the perennial question of how many mandates a director can properly hold.
The practical answer is a living conflicts register that the board actually uses. Interests are declared, discussions are minuted, and conflicted directors step back from the relevant decisions. None of this is complicated. What supervisors find, too often, is a register created at incorporation and never touched again.
5. Documentation and follow-through are the evidence
Perhaps the most practical lesson in the circular concerns paper trails. It requires documented remediation and follow up of control weaknesses, along with annual attestations and summary reports from compliance and internal audit. The message is that the regulator judges governance not by the policies on the shelf but by the trail of findings raised, actions assigned, and closures verified.
This matches what happens after any incident. The first question is never whether a policy existed. It is what the board knew, when it knew it, and what it did next. Boards that can answer from their own minutes are in a strong position. Boards that need three weeks and outside counsel to reconstruct the sequence are not.
What boards should do now
A few concrete suggestions, drawn from board practice rather than theory.
Map the circular against your own framework, even if your entity is out of scope. A gap that 26/906 would expose in a payment institution is usually a gap in a management company or fund board too.
Confirm named ownership of AML/CFT, risk management and outsourcing oversight at board level, and record it.
Test escalation by asking your control functions how bad news reaches the board, and how long it took the last time.
Refresh the conflicts register and check that it covers every mandate and related party relationship of every board member, including the recently added ones.
Audit your paper trail. Pick three findings from the last internal audit or compliance report and verify that each was tracked to a documented closure. The result of that small exercise tells you most of what you need to know about your governance culture.
Conclusion
Circular 26/906 will be remembered as a payment sector text, but its real significance is broader. It consolidates, in a single document, the CSSF’s current view of what good governance looks like: substance in Luxembourg, personal accountability, independent control functions, managed conflicts, and evidence of follow-through. Boards across the financial centre would be wise to read it as a preview of their own next supervisory review. The same supervisory direction is already visible in the 2026 AMLA data collection.
If you would like an independent view of how your board measures up, or are considering appointing an independent director with a governance and AML background, feel free to get in touch.
Frequently asked questions
Does Circular CSSF 26/906 apply to investment funds or management companies? No. Its scope covers payment institutions, e-money institutions and account information service providers. It nonetheless codifies governance principles that the CSSF applies, in adapted form, across the whole financial sector, which makes it valuable reading for any Luxembourg board.
What is the compliance deadline? In-scope institutions must align their central administration, internal governance and risk management frameworks with the circular by 30 June 2026.
What does the CSSF mean by central administration? Genuine decision making and administrative presence in Luxembourg, supported by qualified people, real authority and documentation to prove it. A registered office alone does not qualify.
Which circulars does 26/906 replace? It consolidates and repeals several older texts for these institutions, including IML 95/120, IML 96/126, IML 98/143 and CSSF 04/155, bringing their requirements into one up-to-date framework.
How does this affect independent directors? It reinforces the trend toward named individual accountability for key oversight areas, stricter management of conflicts, and governance judged on documented follow-through. Directors should make sure their responsibilities, declarations and remediation actions are clearly recorded.
Where can I read the circular? The circular and the CSSF’s accompanying communication are available on the CSSF website in its regulatory framework section.