Circular CSSF 26/913: Application of the Guidelines of the European Banking Authority on ancillary services undertakings specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013 (EBA/GL/2026/01) in Luxembourg. Do you understand the framework?

Luxembourg Financial Regulatory News:

The circular CSSF 26/913 outline the regulatory framework established by the European Banking Authority (EBA) to identify ancillary services undertakings (ASUs) within the financial sector. The Circular CSSF 26/913 formalizes the adoption of these standards in Luxembourg, ensuring that local credit institutions and investment firms comply with unified European criteria. Central to these guidelines are the definitions of activities that constitute a direct extension of banking or provide essential support to financial operations, such as data processing and property management. By clarifying these classifications, the EBA aims to improve supervisory convergence and ensure that risks from innovative business models, including fintech, are properly captured during prudential consolidation. Ultimately, these rules create a level playing field across the EU by providing a consistent method for determining which entities must be included in a banking group’s capital requirement assessments.

Summary of Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

This briefing document outlines the regulatory framework established by Circular CSSF 26/913 and the associated European Banking Authority (EBA) Guidelines (EBA/GL/2026/01). These regulations specify the criteria for identifying “ancillary services undertakings” (ASUs) as defined in Article 4(1)(18) of Regulation (EU) No 575/2013 (CRR).

The primary objective is to harmonize the identification of ASUs across the European Union to ensure that risks associated with their activities are integrated into the prudential consolidation and risk management frameworks of banking groups. The guidelines categorize ASU activities into three main branches: direct extensions of banking, activities ancillary to banking, and other similar activities. Notably, the revised framework addresses digital business models, including FinTech and BigTech, to ensure that technology-driven services functionally connected to banking are appropriately captured within the supervisory perimeter.

Activity Category	Activity Type	Identification Criteria	Illustrative Examples	Link to Banking Requirement
Direct Extension of Banking	Fundamental to the value chain of core banking services	Activities fundamental to the value chain of core banking services referred to in points 1, 2 and 6 of Annex I to Directive 2013/36/EU; Article 4(1)(18)(a) of Regulation (EU) No 575/2013.	Brokerage of commercial or residential loans or deposits; loan servicing (including by credit servicers); creditworthiness assessment of individual clients; debt recovery; valuation of collateral; acquisition, ownership, management, and liquidation of repossessed assets.	Required to be mainly provided to or in the interest of institutions or financial institutions.
Direct Extension of Banking	Innovative lending channels	Functions that are operationally and economically equivalent to core banking activities; Article 4(1)(18)(a) of Regulation (EU) No 575/2013.	Loan intermediation and distribution through crowdfunding services, peer-to-peer platforms, or marketplace lending.	Material connection to banking group not required for qualification (assessed on intrinsic financial nature).
Ancillary to Banking	Supports banking	Activity significantly improves the efficiency and effectiveness of banking processes, or enables/facilitates the delivery of banking products/services; Article 4(1)(18)(b) of Regulation (EU) No 575/2013.	Operational support (process optimisation), customer relationship support (service platforms), risk management, regulatory compliance support, big data analytics, market research, back-office (HR management, document management).	Limited to undertakings that have to or may be subject to prudential consolidation (banking group).
Ancillary to Banking	Complements banking	Allows an institution to expand offers via undertaking’s channels or provides undertaking’s non-banking products to institution’s customers; Article 4(1)(18)(b) of Regulation (EU) No 575/2013.	Cross-selling practices, specific distribution and marketing channels allowing expansion of banking or ancillary services offers.	Limited to undertakings that have to or may be subject to prudential consolidation (banking group).
Ancillary to Banking	Relies on banking	Significant dependence on relevant banking products/services (KYC, loan applications) or on funding from a group institution; Article 4(1)(18)(b) of Regulation (EU) No 575/2013.	Undertakings dependent on group funding or services like credit risk assessment and management of loan applications.	Requires a material link (funding or service dependence) within a banking group.
Ancillary to Banking	Specific activities (Leasing, Property, Data)	Tests for operational leasing, ownership/management of property, and data processing services; Article 4(1)(18)(b) of Regulation (EU) No 575/2013.	Operational leasing of buildings to institutions; property management for real estate funds; data processing supporting lending operations or payment data analytics.	Must demonstrate functional link (support, complement, or rely) to the banking group.
Similar Activities	EBA-determined similar activities	Case-by-case assessment by the EBA following notification by competent authorities; Article 4(1)(18)(c) of Regulation (EU) No 575/2013.	Emerging sources of risk or innovative business models not fully meeting points (a) or (b).	Determined by EBA based on similarity to functional connections or direct extensions.

1. Regulatory Context and Scope under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

The amendments to Regulation (EU) No 575/2013, introduced by Regulation (EU) 2024/1623, revised the definitions of “ancillary services undertaking” and “financial institution.” These changes aim to eliminate inconsistencies in interpretation across Member States and allow supervisors to better detect consolidated risks.

Scope of Application

• Competent Authority: The CSSF has integrated these guidelines into its administrative practice.
• Addressees: All credit institutions designated as Less Significant Institutions (LSIs) under the Single Supervisory Mechanism and all CRR investment firms incorporated under Luxembourg law.
• Implementation Date: Circular CSSF 26/913 applies with immediate effect (issued June 22, 2026). The EBA Guidelines specify a general application date of May 4, 2026.

2. Categories of ASU Activities under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

The identification of an ASU depends on whether its “principal activity” falls into one of three categories defined under Article 4(1)(18) of the CRR.

2.1 Direct Extension of Banking

These activities are fundamental to the value chain of core banking services. They are considered ASUs when they are mainly provided to, or in the interest of, institutions or financial institutions.

Activity Type	Description/Examples
Loan & Deposit Services	Brokerage of commercial or residential loans or deposits; loan servicing (including by credit servicers).
Risk & Asset Management	Creditworthiness assessment of individual clients (excluding credit rating agencies); valuation of collateral; risk management and regulatory compliance support.
Recovery & Liquidation	Debt recovery; acquisition, ownership, management, and liquidation of repossessed assets (particularly for non-performing loan recovery).
Innovative Channels	Loan intermediation and distribution through crowdfunding, peer-to-peer platforms, or marketplace lending.

2.2 Ancillary to Banking

An activity is “ancillary to banking” if it supports, complements, or relies on core banking services (as listed in Directive 2013/36/EU or 2014/65/EU).

• Supports Banking: Activities that significantly improve the efficiency of banking processes or facilitate the delivery of products to clients.
• Complements Banking: Activities that expand the offer of banking services through cross-selling or specific distribution/marketing channels.
• Relies on Banking: Activities that depend significantly on relevant banking products/services or on funding provided by an institution within the group.

Specific activities explicitly named in this category include operational leasing, ownership or management of property, and the provision of data processing services.

2.3 Other Similar Activities

The EBA may identify additional activities similar to those in the first two categories. This process can be triggered by a competent authority or an institution. The EBA performs a case-by-case assessment to determine similarity and may update the list of activities to remain responsive to emerging risks.

3. Determining “Principal Activity” under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

An undertaking is qualified as an ASU only if the relevant activities constitute its “principal activity.” The guidelines establish the following principles for this assessment:

1. Threshold Indicators: The assessment uses indicators similar to those for identifying “financial holding companies” (excluding equity indicators).
2. Cumulative Assessment: If an undertaking performs multiple activities falling under the ASU definition, these must be considered collectively. This prevents undertakings from avoiding ASU status by splitting activities into units that individually fall below thresholds.
3. Case-by-Case Discretion: If standard thresholds are not met, an activity may still be regarded as a principal activity to the satisfaction of the competent authority based on a transparent, case-by-case assessment.

4. Exclusions and Integrity of Consolidation under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

To maintain proportionality and clarity, certain entities and conditions are specifically addressed:

• Explicit Exclusions: Pure industrial holding companies, securitisation special purpose entities, and certain insurance/mixed-activity insurance holding companies are generally not regarded as ASUs.
• Pre-existing Status: Entities already defined as institutions, financial institutions, or financial sector entities for reasons other than being an ASU are excluded from this specific ASU classification.
• Collective Investment Undertakings (CIUs): CIUs are considered financial institutions only if their principal activity is listed in Article 4(1)(26)(b)(i) of the CRR or if they meet the specific ASU criteria.
• Consistency Principle: An ASU included in the consolidated situation of one institution must be regarded as an ASU for any other undertaking to ensure supervisory convergence.

5. Compliance and Reporting under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

Competent authorities are required to notify the EBA of their compliance status by May 4, 2026. Failure to notify by this deadline results in the authority being considered non-compliant. For Luxembourg entities, the CSSF’s immediate application of these guidelines necessitates prompt adherence by LSIs and CRR investment firms to ensure that all functionally connected undertakings are appropriately included in the prudential scope of consolidation.

This news related to Circular CSSF 26/913 on Application of the Guidelines of the European Banking Authority on ancillary services undertakings specifying the criteria for the identification of activities referred to in Article 4(1)(18) of Regulation (EU) No 575/2013 (EBA/GL/2026/01) in Luxembourg can be considered beneficial under CSSF-Circulars, Credit Institutions News, Investment Firms News,  EU Regulations.

At https://Ratiofy.Lu/, we defend your hard-earned money with our free daily news platform and expert-vetted templates. Need more help? Request access to our hands-on expert Advisory, Training and Coaching Services (very limited availability) related to CSSF Circulars and EU Regulations.

The pre-filled example templates for many CSSF Circulars should be available at https://ratiofy.lu/templates/ from the summer of 2026.

5 Surprising Ways New EU Guidelines Are Redrawing the Map of Banking under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

Introduction: The Blurred Lines of Modern Banking under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

In today’s digital ecosystem, the question of where a “bank” ends and a “service provider” begins has become a strategic minefield. As banking groups increasingly weave BigTech subsidiaries and specialized fintechs into their operational fabric, the traditional regulatory perimeter has begun to fray. Regulators are no longer content to watch from the sidelines as critical banking functions migrate to unregulated entities.

To close these gaps, the Luxembourg CSSF has formally adopted the European Banking Authority’s new Guidelines (EBA/GL/2026/01) regarding Ancillary Services Undertakings (ASUs). This is not merely a technical update; it is a fundamental expansion of the “prudential consolidation” net. By integrating these guidelines into its administrative practice, the CSSF is signaling a move toward total supervisory convergence across the EU. For groups operating in Luxembourg, the message is clear: if an entity is functionally critical to the banking value chain, it will likely be pulled into the regulatory spotlight, regardless of its corporate label.

Takeaway 1: Your Tech Stack Might Be “Ancillary to Banking” under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

The most significant shift in these guidelines is the move away from a rigid “tick-box” list toward a functional, risk-based assessment. Historically, firms could often avoid consolidation by ensuring their subsidiaries’ activities didn’t perfectly match a narrow list of regulated services. This new regime targets that “regulatory isolation” strategy head-on.

The focus has shifted to the degree of interconnectedness. If a technology provider’s failure would jeopardize the core banking operations—due to data processing dependencies or integrated fintech services—the entity can no longer sit outside the scope of consolidation. This ensures that tech-heavy groups can no longer use specialized subsidiaries to shield capital from banking-grade oversight.

“The Guidelines also address innovative and digital business models, including fintech and technology-driven services, which may introduce new forms of ancillary risks within banking groups.” (Section 2.1.3)

Takeaway 2: The “Direct Extension” List is More Specific Than You Think under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

Under Section 4.2, the EBA has identified activities that are so fundamental to the value chain that they are considered a “direct extension of banking.” However—and this is a critical nuance for B2B vs. B2C strategy—these activities are generally captured only when they are mainly provided to or in the interest of institutions or financial institutions.

The list of captured activities now explicitly includes:

• Brokerage of commercial or residential loans or deposits.
• Loan servicing, including activities by credit servicers.
• Creditworthiness assessments of individual clients (excluding market-facing credit rating agencies).
• Risk management and regulatory compliance support.
• Debt recovery and the valuation of collateral.
• Management and liquidation of repossessed assets: The acquisition and ownership of collateral taken back by the group.

The inclusion of risk management and compliance support is a major development for tech-driven service providers. It signals that the EBA intends to capture firms that provide the “brains” of the banking operation, even if they never touch the actual movement of money.

Takeaway 3: The “Support, Complement, Rely” Trifecta under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

While the “Direct Extension” list covers specific functions, the “Ancillary to Banking” test (Section 4.3) provides the mechanics for a much wider capture. For an activity to be deemed ancillary, it must meet one of three prongs:

• Support: Does the activity significantly improve the efficiency of banking processes (e.g., dedicated data processing for lending)?
• Complement: Does the activity enable cross-selling or expand the banking offer through specific marketing channels?
• Rely: Does the activity depend significantly on core banking products or—most critically—on funding provided by a bank within the group?

This “reliance on funding” criterion is a direct strike against “shadow banking” structures, where a group uses an unregulated subsidiary as a funding vehicle to bypass capital ratios.

Note on Negative Scope: Importantly, this net is not infinite. The guidelines explicitly exclude pure industrial holding companies and insurance-specific entities (like insurance holding companies), ensuring the focus remains strictly on the banking-adjacent ecosystem.

Takeaway 4: The Power of Cumulative Principal Activity under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

To prevent “regulatory arbitrage,” the EBA has introduced a “Principal Activity” test modeled after the indicators used for Financial Holding Companies. In the past, groups might “salami-slice” services across different entities so that no single subsidiary met the threshold for consolidation.

The new cumulative approach mandates that if an undertaking performs multiple ancillary activities, they are assessed collectively. If the total volume—measured by indicators like revenue or assets—meets the threshold, the entity is classified as an ASU. This prevents groups from diluting their risk across various “small” entities to stay below the radar. If the collective weight of these activities is significant to the group, the regulator will treat the entity as an ASU to ensure the consolidated capital position is accurate.

Takeaway 5: A Living Regulation (The “Similar Activities” Clause) under Circular CSSF 26/913 on Application of Guidelines on Ancillary Services Undertakings (EBA/GL/2026/01) in Luxembourg

The regulatory perimeter is no longer a static line; it is a responsive boundary. Under Section 4.4, the guidelines are “future-proofed” through the “Similar Activities” clause.

This is not a nebulous power; it is a specific process. If a competent authority (like the CSSF) identifies a new, emerging digital activity that poses risks similar to those already listed, they trigger a case-by-case assessment. The EBA then makes the final decision on whether to identify this new activity as ancillary. This allows the regulatory net to adapt to new fintech innovations without waiting years for a total overhaul of primary legislation (the CRR).

Conclusion: Beyond the Balance Sheet in Luxembourg

The shift toward a holistic regulatory assessment has massive implications for corporate strategy. Once an entity is classified as an ASU, it is treated as a “Financial Institution” under Article 4(1)(26) of the CRR. This moves the entity into the “deduction regime” and subjects it to credit risk frameworks that can significantly impact the group’s overall capital requirements. The question for leadership is no longer just “Is this subsidiary a bank?” but “Is this subsidiary’s function inextricably linked to our banking risk?” Is your current corporate structure prepared for this level of scrutiny? Ultimately, these guidelines eliminate jurisdictional arbitrage and ensure that where there is banking-grade risk, there is banking-grade oversight.