Agefi Luxembourg - mai 2026

AGEFI Luxembourg 10 Mai 2026 Économie & Banques By Eric CENTI, Partner and Anthony TREMBLIER, Director, Deloitte Luxembourg I nternational tax transparency has shifted decisively from rulemaking to enforcement, with tax authorities increasingly scrutinizing how regimes are implemented in practice. The Luxembourg Tax Authorities (LTA) have nota­ bly intensified FATCA and CRS reviews across the financial sector, particularly in the banking and fund industries. For affected insti­ tutions, the key question is no longer whether policies exist, but whether they can demonstrate effective implementation, robust gover­ nance, and adequate oversight of any out­ sourcing arrangements. International context: Peer reviews driving enforcement The OECD expects jurisdictions to regularly verify that reportingfinancial institutions complywithCRS requirements, maintain effective mechanisms to address noncompliance, and impose penalties (1) where appropriate. In this context, theGlobal Forum on Transparency and Exchange of Information for Tax Purposes reviews jurisdictions committed to the Automatic Exchange of Information (AEOI) Standard.Itspeerreviewsassessboththelegalframe­ works underpinningAEOI and how the Standard is implementedinpractice,includingdomesticcompli­ ancemeasuresapplicabletofinancialinstitutionsand the effectiveness of information exchanges. For Luxembourg, this means that the LTA must demonstrate that they actively ensure, in practice, that reporting financial institutions correctly apply due diligence procedures to identify financial accounts and determine which accounts are reportable. The LTA must also evidence effective enforcement mechanisms and the use of all appro­ priatemeasures under Luxembourg law to address errors and noncompliance. Beyond the OECD peer review process, FATCA is also facing increased legal and regulatory scrutiny within the EU. On 24 April 2025, the Belgian Data Protection AuthorityfoundthatFATCAdatatransfersbreached severalGDPRrequirementsandimposedaoneyear (2) compliance deadline. Inparallel, the Cour des marchés de Bruxelles referred questions to the CJEU regarding FATCA’s compatibility with the GDPR, the EU CharterofFundamentalRightsandtheEUrulesgov­ erning international data transfers. These developments have also prompted debate in Luxembourg, where parliamentary questions were submitted to the Ministers of Justice and Finance on the legal compatibility of FATCA transfers with the GDPR.Inresponse,thegovernmentemphasizedthat the Luxembourg–US FATCA agreement, signed in 2014 and implemented by the law of 24 July 2015, constitutes an international agreement involving transferofpersonaldatatoathirdcountryconcluded before24May2016,andthereforefallswithinthespe­ cific regime providedunderArticle 96 of GDPR. The government also referred to Luxembourg AdministrativeCourtcaselawrecognizingthatsuch transfers pursue an “important public interest” and are therefore justifiedunder that directive (3) . LTAcontrols:More frequent, more detailed In recent years, the LTA have noticeably intensified their controls in the investment management and banking sectors. In 2024, 469 (4) Luxembourg entities weresubjecttoFATCAandCRScompliancereviews. In2025,thisnumberincreasedto836entities (5) through thematicand/orindepthauditsassessingcompliance with reporting and due diligence obligations, an increase of nearly 80%yearonyear. The LTAcurrently conduct three main types of con­ trols, eachdiffering in scope anddepth (6) : Classification checks aim to identify Luxembourg financialinstitutionsandverifythattheirFATCA/CRS statusisconsistentwiththeiractualactivities.Inprac­ tice, the LTA issue information requests to assess whether an entity’s classification (typically as a Non­ Reporting financial institution or nonfinancial (for­ eign) entity) is appropriate. Thematic controls focus on specific issues, often across one or more tax years, such as the application of due diligence or reporting procedures. Indepth controls assessoverallcompliancewithduediligence, reporting and recordkeeping obligations. These reviews may target a single institution or a group of entities managed by the same Luxembourg institu­ tionsandtreatedasfinancialinstitutions.Insuchcases, the LTA look beyond formal policies and examine how FATCA and CRS obligations are implemented inpracticeacrossgovernance,systems,processesand outsourced arrangements. Indepth controls: Phases and documentation requested TheLuxembourgreportingfinancialinstitutionunder reviewreceivesanotificationletterinformingitthatit issubjecttoanindepthcontrolandsettingadeadline (typically around six weeks) to provide documents andinformationenablingtheLTAtoassessitspolicies, controlsandpracticalimplementation.Thisgenerally includes: The latest versionofwrittenprocedures andmanu­ als; The Register of Actions taken and supporting evi­ dence; Training records; The list of financial accountsmaintainedduring the review period (typically covering three tax years), including reportable, nonreportable and excluded accounts. Thisinitialphasecanbeparticularlydemanding, as it requires institutions to centralize uptodate documentation and rapidly extract and recon­ cile FATCA/CRSdata. Interviews and onsite review During FATCA/CRS audits, the LTA often focus on the robustness of the Reporting FI’s operating model and its oversight of outsourced func­ tions, including incident manage­ ment. They may also test key due diligenceprocedures—suchassys­ tem access controls, the handling ofundocumentedaccountholders, the reasonableness test, “Day 2” procedures and themonitoring of changes in circumstances—and, from a reporting perspective, review how financial positions are assessed, and how corrective reporting is performedwhendeficiencies are identified. Outsourcing in the spotlight Responsibility remains with the reporting financial institution Akey takeaway from these indepth controls is that outsourcing arrangements remain a central focus for the LTA. In Luxembourg, many financial institutions rely on service providers to perform FATCA/CRSrelated tasks, including due diligence and reporting obliga­ tions.While this operatingmodel iswidelyused and accepted,itdoesnotdiminishtheresponsibilityofthe reporting financial institution. Effective oversight is therefore particularly important for management companies and investment funds that outsource investor onboarding activities to transfer agents or fund administrators. Financial institutions must be able to demonstrate how they monitor and review the work performed by their service providers, as well as the controls implemented to ensure FATCA/CRS obligations are properly fulfilled. They should also be able to clearly explaintherationalebehindclassificationsandreport­ ing decisions, while maintaining evidence of their oversight activities, such as periodic reviews, sample testing, documentedqueries, and followup actions. Register of Actions: FATCA/CRS Control and Monitoring Luxembourg reporting financial institutions are requiredtomaintainaRegisterofActionsdocument­ ing how FATCA and CRS obligations have been implemented(7). Where service providers are involved, the Register ofActions should also include evidence of the reviews performed on the services provided, togetherwith the conclusions reachedand any corrective actions taken, when applicable. TheRegister ofActions is a recordof activities carried out, together with supporting evidence, to demon­ strate adherence toFATCAandCRS requirements in accordancewiththeinternalproceduresimplemented by the reporting financial institution. In this context, the Register should evidence that processes are alignedwiththeapplicableregulatoryframeworkand have beenproperly executed anddocumented. While the FATCAandCRS Laws do not prescribe a specific format for the Register ofActions, guidance issued by the LTA indicates that it should include, among other elements, updates to written proce­ dures and policies, deficiencies and incidents iden­ tifiedduringdue diligence and reporting processes, related remediation plans, training sessions organ­ ized, and a description of the oversight exercised over activities delegated to service providers. For Luxembourgmarket players, awellmaintained Register of Actions can serve not only as evidence of compliance for the LTA, but also as an effective management tool to monitor implementation efforts, identify recurring issues, and prioritize remediation actions. Looking ahead: Strengthening governance and readiness TheintensificationofFATCAandCRScontrolsbythe LTAreflects both growing international expectations and a broader shift towards more outcomefocused supervision. For Luxembourg’s financial sector, this carries several practical implications: Governanceanddocumentation: FATCA/CRSpoli­ cies and procedures should be reviewed regularly, with any updates appropriately documented in the Register ofActions. Oversight of outsourcing arrangements: Where activitiesaredelegatedtoserviceproviders,oversight responsibilities should be clearly defined, effectively implemented, and properly documented. This may include periodic reviews, sample testing, and the review of reports produced by service providers, together with evidence of followup actions taken in response to identified issues. Data quality and reconciliation: Financial institu­ tions should be able to (i) produce reconciled lists of financial accounts, including reportable, non­ reportable and excluded accounts; (ii) ensure that all relevant data captured in their systems areaccurately reflected in FATCA/CRS reports; and (iii) reconcile reportedfinancial positions. Register of Actions: This Register should be main­ tained as a central compliance document recording bothdaytodayimplementationactivitiesandreme­ diationmeasures. Peopleandtraining: Giventhetechnicalcomplexity of FATCA and CRS obligations, regular training for staffinvolvedinonboarding,documentation,report­ ing, and control functions remains essential. As controls become more frequent and increasingly detailed, Luxembourg financial institutions that can demonstratestronggovernance,cleardocumentation, andeffectiveoversight–particularlyinrelationtoout­ sourcing arrangements–will be better positioned to respondwithinrequiredtimeframesandmitigatethe risk of penalties and reputational damage. In addition, with new information set to become reportable from2027underCRS2.0, financial institu­ tions should already be assessing whether their processes,controls,andsystemsaresufficientlyrobust tomeet these enhanced reporting obligations. 1)OECD,PeerReviewoftheAutomaticExchangeofFinancialAccount Information:2023Update(AEOIPeerReviewReport,2023) 2)Decisionn°792025oftheBelgianDataProtectionAuthority 3) Response by the Minister of Justice and the Minister of Finance to ParliamentaryQuestionNo.3463of14January2026. 4)Administrationdescontributionsdirectes,Rapportannuel2024 5)Administrationdescontributionsdirectes,Rapportannuel2025 6)Administrationdescontributionsdirectes,FAQCRS–NCD(Norme CommunedeDéclaration) 7) Law of 18 June 2020 amending the existing FATCA and CRS legislation FATCA/CRS in Luxembourg: rising scrutiny and key actions for financial institutions P ictet Asset Services (PAS), ligne de mé­ tier du groupe Pictet maîtrisant chaque dimen­ sion de lʹasset servicing, poursuit le développement des services proposés aux assureurs au Luxembourg en renforçant son offre commerciale et son équipe spécialisée dans les assu­ rancesvie. Cette offre ciblée inclut une large palette de services avec des ouvertures de compte facilitées (sous 48h), une connectivité B­ toB performante, une offre de crédits lombards adaptée ainsi quʹune solution de dépôt dʹactifs « private assets » répondant aux exigences de confidentialité et de sécurité, pour tous les types de supports dʹassurance (fonds externes, fonds internes dédiés, fonds internes collectifs, fonds dʹassurance spécialisés). Cette évolution sʹinscrit dans la volonté de PAS de devenir le partenaire de référence des assu­ reurs luxembourgeois, en sʹap­ puyant sur une expertise recon­ nue et une relation historique avec le secteur. ʺNous reconnaissons lʹassureur comme client à part entière et cherchons à nouer des partena­ riats étroits, fondés sur un ser­ vice institutionnel spécifique. Cette approche sʹinscrit dans lʹADNde Pictet. Lʹexcellence du service à la clientèle, héritée de notre longue tradition de banque privée, joue un rôle cen­ tral, même dans un environne­ ment B2B sophistiqué et inté­ gréʺ, affirme ClaudeJoseph Pech, Equity Partner du groupe Pictet et Deputy CEO de PAS. Depuis de nombreuses années, Pictet accompagne les assureurs à travers ses activités de wealth management et dʹasset servicing en proposant des solutions sur mesure et innovantes, que ce soit dans la structuration patrimo­ niale via lʹassurance pour une clientèle privée haut de gamme, ou le développement de rela­ tions de confiance avec les tiers gérants, qui interviennent en tant que mandataires de gestion dans les contrats dʹassurance. LeLuxembourgsʹimpose comme un acteur clé de lʹassurancevie internationale, grâce à la robus­ tessedeson«triangledesécurité», garantissant la protection des avoirs des souscripteurs. Les chiffres records des encours et des primes annuelles témoi­ gnent ainsi du succès de la place, même dans un contexte géopoli­ tiqueincertain:en2025,lesprimes ont atteint 31,1 milliards d’euros (+16%sur unan) et les actifs sous gestion ont progressé à 262,5mil­ liards d’euros (+8,5%). En renforçant son engagement auprès des assureurs luxem­ bourgeois, PAS entend offrir des solutions sur mesure, inno­ vantes et sécurisées, tout en res­ tant fidèle à sa mission dʹêtre un partenaire de confiance, au ser­ vice de lʹexcellence et de la pérennité patrimoniale. Enfin, le travail de lʹACA Luxembourg, lʹAssociation des Compagnies dʹAssurances et de Réassurances, ainsi que les récentes évolutions du FIC, le fonds interne collectif, validées par le CAA, le Commissariat auxAssurances, contribuent eux aussi à assurer une meilleure compétitivité et le développe­ ment de ce produit en Europe. Pictet renforce son pôle assurance-vie au Luxembourg ©Pictet