Luxembourg

Warning: Afitaustin.com Operating Without Authorization in Luxembourg

The CSSF issued a warning on April 10, 2026, that the website www.afitaustin.com and its operators are not authorized to provide investment services or other financial services in or from Luxembourg. The entity used the name 'Afitaustin' and contact details including support@afitaustin.com and phone number +54 351 5938 2741. The CSSF has not granted any authorisation to this entity and it is not supervised by the CSSF.

LMT Activation Module Launch for Luxembourg UCITS and AIFMs

The CSSF has launched the LMT activation module for Luxembourg-domiciled UCITS and authorised AIFMs managing open-ended AIFs. Affected entities must notify the CSSF of liquidity management tool activations or deactivations, including subscription suspensions, repurchases, redemptions, and side pockets, via the dedicated eDesk procedure. Notifications for non-ordinary course LMTs must be submitted with reasonable timeframe before activation.

CSSF Prospectus Approvals Monthly Statistics March 2025 to March 2026

The CSSF published monthly prospectus approval statistics covering March 2025 through March 2026, showing 13 monthly data points ranging from 59 approvals in January 2026 to 177 in May 2025. The data reflects activity across the Luxembourg fund and securities industry during this period.

Monthly Notifications Received from EEA Competent Authorities - Prospectus Statistics

CSSF published monthly statistics on prospectuses and base prospectuses received from competent authorities of other EEA Member States covering March 2025 to March 2026. The data shows 310 total notifications received, with monthly figures ranging from 6 to 55. This is routine statistical reporting providing transparency on cross-border prospectus activity.

Law on Credit Institution and Investment Firm Failure (Consolidated)

CSSF published the consolidated version of the Law of 18 December 2015 on the failure of credit institutions and certain investment firms, updated through April 2026. The law establishes the legal framework for managing the resolution and orderly winding-up of failing credit institutions and investment firms in Luxembourg, transposing relevant EU directives including BRRD. The consolidated text applies to credit institutions, investment firms, and consumers under CSSF supervision.

CNPD Attends IAPP Global Summit 2026 Washington DC

The Luxembourg data protection authority (CNPD) announced its participation in the IAPP Global Summit 2026 held in Washington, DC from March 30 to April 2, 2026. CNPD President Tine A. Larsen represented Luxembourg at the gathering, which convened 42 data protection authorities, US privacy officials, federal representatives, Congressional members, and FTC commissioners. The summit addressed data protection priorities, the US legislative agenda, and international cooperation frameworks.

List of EuVECA Fund Units

CSSF published its monthly statistical list of fund units subject to Regulation 2013/345 on European Venture Capital Funds (EuVECA). The list, published April 3, 2026, is available in XLSX format (15.64Kb). This is a routine monthly update from Luxembourg's financial regulator.

List of Fund Units Subject to EuSEF Regulation 2013/346

The CSSF published its monthly statistics listing fund units subject to EU Regulation 2013/346 on European Social Entrepreneurship Funds (EuSEF). The document provides an XLSX download containing the current registry of EuSEF fund units under Luxembourg supervision. This is a routine statistical update with no new regulatory obligations.

List of European Long-Term Investment Fund Units Subject to Regulation 2015/760

The CSSF published its monthly statistical update listing fund units subject to Regulation 2015/760 on European Long-Term Investment Funds (ELTIFs), as amended by Regulation 2023/606. The list is available in XLSX format (27.55Kb). This publication supports transparency and monitoring of ELTIF products available in Luxembourg.

Active Supply Chain Attack Targeting Axios NPM

The CSSF issued an urgent advisory on 3 April 2026 regarding a critical supply chain attack targeting two versions of the Axios HTTP client library (1.14.1 and 0.30.4). Threat actors compromised maintainer accounts to inject the malicious dependency plain-crypto-js (version 4.2.1). Supervised entities that performed npm install between 00:21 and 03:25 UTC on March 31, 2026 should assume their systems are compromised. Affected entities must report this major ICT incident under DORA (Circular CSSF 25/893) or Circular CSSF 24/847.