The Provision of Financial Services in Luxembourg on a Cross-Border Basis by Non-EU Firms

The access to the EU market by non-EU firms and the related provision of cross-border financial services has become a hot topic in the aftermath of Brexit. It is still eminently relevant today, at a time when EU Member States are trying to further protect access to the single market, with the most recent example being the proposed revision of Directive 2013/36/EU on access to the activity of credit institutions (CRD), where further constraints on non-EU banks servicing EU clients are to be expected.

While the provision of regulated financial services by entities based in the EU on a purely cross-border basis within the EU is largely subject to harmonised rules, the situation is different for non-EU firms willing to provide the same services in the EU on a cross-border basis. The rules applicable to those firms remain (more or less) at the discretion of each EU Member State, resulting in a fragmented legal landscape across the EU.

Conscious of the divergent approaches in the EU Member States, the EU legislature recently signalled its intention to tighten its regulatory framework and the supervision of non-EU firms in order to safeguard the stability of the EU financial market and investor protection.

This article provides an overview of the key considerations non-EU firms should bear in mind when looking to provide regulated financial services in Luxembourg without establishing a local presence in the country (including an overview of possible evolutions of the legal framework in light of EU legislative developments). This article does not detail the authorisation requirements applicable to a non-EU firm looking to establish a Luxembourg branch or a subsidiary to provide such services in Luxembourg.

Different Regulatory Regimes for Different Types of Financial Services

Currently, the various types of financial services are regulated through different regulatory regimes. In a nutshell, the following core categories of financial services are regulated under Luxembourg law:

• Banking services within the meaning of Annex I to the Act of 5 April 1993 on the financial sector (the “Banking Act”): This annex replicates the list of activities set out in Annex I to CRD. It typically includes services such as deposit taking and lending activities.
• Investment services and related ancillary services within the meaning of the Banking Act: The Banking Act replicates the list of activities set out in Annex I to Directive 2014/65/EU on markets in financial instruments (MiFID). This includes wealth management and broker-dealer activities, such as the execution of investment orders, discretionary portfolio management and investment advice.
• Specialised and support activities of the financial sector (“PFS activities”) within the meaning of the Banking Act: Such activities include, among others, the activities of registrar agents, professionals performing lending operations or corporate domiciliation agents.
• Payment services within the meaning of the Act of 10 November 2009 on payment services (the “Payments Act”) and issuance of electronic money and related services (together the “E-Money Services”): The Payments Act replicates the list of services annexed to Directive (EU) 2015/2366 on payment services (PSD). The definition of electronic money in the Payments Act mirrors the definition of the same term in Directive 2009/110/EC on the business of electronic money institutions (EMD). Payment services include, among others, credit transfers, direct debits, issuance of payment instruments (for instance, credit cards) and merchant acquiring services.

In order to assess the regulatory regime (including potential authorisation requirements) applicable to the provision of financial services in Luxembourg on a cross-border basis, a non-EU firm must first assess and categorise its contemplated service offering in light of the above categories of regulated financial services.

Authorisation Requirements Applicable to the Provision of Banking Services

The regulation of banking services largely derives from the transposition of the CRD rules into the Banking Act. However, at present the CRD does not specifically regulate the provision of banking services within the EU by non-EU firms. Therefore, each EU Member State has a discretion to set out and enforce such rules on its territory.

The applicable regime for non-EU firms willing to operate in Luxembourg without a local presence is set out in Article 32 (5) of the Banking Act. This article provides that a non-EU firm intending to provide banking services in Luxembourg must first obtain authorisation from the Luxembourg financial sector regulator – the Commission de surveillance du secteur financier (CSSF).

However, the need for authorisation only applies where the relevant banking services are provided (or deemed to be provided) in Luxembourg, which must be assessed on a case-by-case basis. In this respect, non-EU firms may look at CSSF Circular 11/515 to assess whether a banking service is deemed to be provided on the Luxembourg territory. Among others, the circular clarifies that:

• the mere fact of having customers domiciled in Luxembourg does not, per se, mean that the relevant services are provided in Luxembourg; and
• the mere canvassing of Luxembourg customers or advertising and organisation of a “road show” in Luxembourg fall outside the scope of the authorisation requirement.

Where authorisation is required, it is subject to the filing of an application with the CSSF including all necessary information and documentation to evidence that the non-EU firm complies with a series of regulatory conditions, and in particular that:

• it does not have an establishment in Luxembourg;
• it performs and is authorised to perform the relevant banking activities in its home country; and
• it is subject to authorisation and supervisory rules in its home country in respect of the banking services it intends to provide in Luxembourg and these rules are considered equivalent to the requirements of the Banking Act.

This authorisation can be sought only if staff or representatives of the non-EU firm come occasionally and temporarily to Luxembourg to provide the relevant banking services. In case of frequent visits or even permanent presence by staff or representatives of the non-EU firm in Luxembourg, the non-EU firm will have to establish an authorised subsidiary or, at least, an authorised branch to carry out the relevant regulated banking activities in Luxembourg (such authorisation requirements are outside the scope of this article).

However, authorisation requirements do not apply to banking services provided on a pure intra-group basis within the meaning of the Banking Act (which a non-EU firm must assess on a case-by-case basis).

Authorisation Requirements Applicable to the Provision of Investment Services and Ancillary Services

The Luxembourg authorisation requirements for the provision of investment services and ancillary services on a cross-border basis from outside the EU largely derive from the implementation of the MiFID rules into the Banking Act.

MiFID and Regulation (EU) No 600/2014 on markets in financial instruments (MiFIR) provide for a harmonised regime regarding the provision of these services within the EU by non-EU firms. However, the requirements under this regime vary depending on the MiFID categorisation of the targeted clients.

Provision of services to retail clients and opt-in professional clients

The provision of investment/ancillary services to Luxembourg retail clients and opt-in professional clients (that is, retail clients that elected to become professional clients) requires that non-EU firms establish an authorised subsidiary or, at least, an authorised branch, in Luxembourg to carry out the relevant investment/ancillary activities in Luxembourg.

However, authorisation requirements do not apply if non-EU firms provide the relevant investment/ancillary services at the exclusive initiative of Luxembourg clients (the so-called “reverse solicitation exemption”). Non-EU firms must assess whether this condition is met on a case-by-case basis, bearing in mind that competent authorities have a restrictive interpretation of this exemption.

In the same vein, authorisation requirements do not apply to services provided on a pure intra-group basis within the meaning of the Banking Act (which a non-EU firm must assess on a case-by-case basis).

Provision of services to per se professional clients and eligible counterparties (ECP)

Pursuant to Articles 46 to 49 of MiFIR, a non-EU firm can provide investment/ancillary services to per se professional clients and ECP (that is, essentially, institutional and large corporate clients) throughout the EU on a purely cross-border basis subject to prior registration in a dedicated ESMA register. Such registration is only possible if:

• the European Commission has adopted an equivalence decision in accordance with Article 47(1) MiFIR in relation to the third country in which the non-EU firm is established;
• the non-EU firm is authorised in its home country to provide the investment/ancillary services to be provided in the EU and is subject to effective supervision and enforcement ensuring full compliance with the requirements applicable in that third country; and
• co-operation arrangements are established between ESMA and the relevant competent authority/ies of the third country.

However, to date, the European Commission has not adopted any equivalence decisions, meaning that the above registration regime is not yet available for non-EU firms.

In the absence of a European Commission decision, EU Member States have the possibility to establish their own national regime for the provision of investment/ancillary services to per se professional clients and ECP.

The Luxembourg legislature exercised this option and designed a local authorisation regime in Article 32-1 (1) (§2) of the Banking Act. This provision sets out conditions for non-EU firms to apply for authorisation with the CSSF, namely that:

• the non-EU firm must be authorised to provide the relevant investment and ancillary services in its home country;
• the CSSF considers that the non-EU firm is subject to supervision and to authorisation rules deemed equivalent to those set out in the Banking Act; and
• the co-operation between the CSSF and the supervisory authority of the non-EU firm is ensured (notably through the establishment of a Memorandum of Understanding (MoU) between the CSSF and the relevant third-country authority, or by the signature of a specific addendum to an existing MoU).

The CSSF provided guidance in CSSF Circular 19/716 to clarify its expectations with regard to the equivalence condition. The CSSF also adopted CSSF Regulation 20-02, which lists countries that are considered as applying equivalent supervision and authorisation rules (currently, this list includes: Canada, the Swiss Confederation, the United States of America, Japan, Hong Kong, the Republic of Singapore, the United Kingdom, the People’s Republic of China and Australia).

However, the authorisation requirements do not apply if:

• the non-EU firm provides the relevant investment/ancillary services on a pure intra-group basis (which must be assessed on a case-by-case basis); or
• the reverse solicitation exemption applies.

Territoriality aspects regarding investment/ancillary services

Interestingly, CSSF Circular 19/716 specifies that investment/ancillary services are deemed provided in Luxembourg where at least one of the following conditions is met:

• the non-EU firm has an establishment (eg, a branch) in Luxembourg;
• the non-EU firm provides the relevant services to retail clients in Luxembourg; or
• the place where the “characteristic service” is supplied – ie, the essential service for which payment is due, is Luxembourg (which must be assessed on a case-by-case basis).

Accordingly, this means that there are situations where the investment/ancillary services are not considered as being provided “in Luxembourg”, notwithstanding the fact that the recipient of the service(s) may be based in Luxembourg. These situations may relate to per se professional clients, ECP, but also to opt-in professional clients. It is the responsibility of the non-EU firm to assess whether the relevant services are provided in Luxembourg or not and to document and record such assessment before providing the relevant services to Luxembourg-based clients.

Authorisation Requirements Applicable to PFS Activities

The Banking Act regulates other types of financial services which are not subject to harmonised requirements at the EU level.

As these services fall within the scope of the Banking Act, non-EU firms willing to provide these services in Luxembourg on a purely cross-border basis will be subject to the authorisation regime set out in Article 32 (5) of the Banking Act.

Therefore, the provision of these services in Luxembourg by a non-EU firm on a purely cross-border basis is governed by the same rules already described above (see Authorisation Requirements Applicable to the Provision of Banking Services).

Authorisation Requirements Applicable to the Provision of Payment Services and E-money Services

Neither the Payment Services Act nor PSD and EMD provide for a regime regarding the provision of payment services and E-Money Services in the EU by non-EU firms.

However, payment services (within the meaning of the Payments Act) and E-Money Services are also listed in Annex I to the Banking Act relating to banking activities. The authorisation regime of Article 32 (5) of the Banking Act applies to all services qualifying as banking activities, unless such services are subject to a specific regime, as is the case for the investment/ancillary services described above (see Authorisation Requirements Applicable to the Provision of Investment Services and Ancillary Services).

Therefore, the provision of payment services and/or E-Money Services in Luxembourg by a non-EU firm on a purely cross-border basis will be governed by the same rules already described above (see Authorisation Requirements Applicable to the Provision of Banking Services).

Luxembourg Rules of General Good Applicable to Non-EU Firms Providing Services on a Purely Cross-Border Basis

Non-EU firms providing regulated financial services in Luxembourg on a cross-border basis will, on top of the above considerations, have to abide by certain rules of general good.

Some of these rules will apply to both non-EU firms that can provide the relevant financial services without a Luxembourg authorisation and those that need to obtain one. For example, in any instance, the relevant non-EU firm will have to comply with the provisions of the Luxembourg Consumer Code when dealing with clients that can be considered as consumers from a Luxembourg law perspective.

Other rules of general goods will be applicable only when the services are regarded as being provided in Luxembourg. This is the case with Luxembourg anti-money laundering and counter-terrorism financing requirements, as primarily derived from the Luxembourg Act of 12 November 2004 on this topic. These requirements apply when dealing with all types of clients.

Expected Developments as Regards the Provision of Cross-Border Services in Luxembourg

Discussions are currently taking place at the EU level to revise some of the provisions of the CRD. As part of the proposed reform, it is contemplated to introduce a harmonised regime for the provision of banking services within the EU by non-EU firms. While the final text is still being negotiated between EU institutions, it seems clear that, at least for a subset of banking services (including deposit taking, lending, payment services and E-Money services), the provision thereof on a cross-border basis by non-EU banks and large non-EU investment firms in the EU will become prohibited (if not performed in an intra-group or interbank context) unless those banks or investment firms have established a branch in the EU.

If this new regime is effectively adopted in the final text of the revised CRD, the regime currently set out in Article 32 (5) of the Banking Act (see        Authorisation Requirements Applicable to the Provision of Banking Services) will have to be reviewed and adjusted. Accordingly, the possibility of providing banking services (including payment and E-Money Services) in Luxembourg on a purely cross-border basis will become subject to stricter and more cumbersome requirements.