The main provisions regarding the authorization, supervision and prudential requirements for TCBs will apply from 11 January 2027, aligning with the implementation date of CRD VI. However, certain reporting obligations (notably those relating to regulatory and financial information under new Articles 32-14 and 32-15 of the amended law of 5 April 1993 on the Financial Sector Law (LSF) will apply earlier, from 11 January 2026.

To ensure continuity and legal certainty, the Commission de Surveillance du Secteur Financier (CSSF) may decide that existing authorizations for TCBs granted before 10 January 2027 remain valid, provided those branches comply with the new requirements. Moreover, to protect acquired rights, the obligation to establish a branch under the new regime does not affect contracts concluded before 11 July 2026.

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

Third country branches – new regime

Under the current regime, third-country credit institutions can provide banking services in Luxembourg by doing any of the following:

• Establishing a branch, subject to authorization from the CSSF under Article 32 of the LSF
• Relying on the reverse solicitation exemption, where services are provided at the initiative of the Luxembourg- or EU-based client
• Obtaining written authorization from the CSSF under Article 32(5) of the LSF to provide services without a branch on a temporary and exceptional basis

This flexibility has allowed several non-EU institutions to access the Luxembourg market without establishing a permanent presence.

Obligation to establish a branch and seek authorization

The new regime, as transposed by Article 19 of the draft bill, aligns Luxembourg law with the harmonized EU framework introduced by CRD VI.

Under the new Article 32-3 of the LSF, third-country entities wishing to offer core banking services — namely taking deposits, lending and granting guarantees — must establish a branch in Luxembourg and obtain prior authorization from the CSSF.

The scope of this requirement varies depending on the type of service.

• Deposit-taking: The obligation to establish a branch applies universally to deposit-taking activities, regardless of the nature of the provider.
• Lending and guarantees: These services only trigger the requirement when performed by entities that would qualify as banks under EU standards. Nonbank actors, such as investment funds originating loans, remain outside the scope of the new regime.

Limited exemptions

The obligation to establish a branch does not apply in the following cases:

• Ancillary and investment services: Third-country firms are not required to establish a branch when banking services are provided strictly as ancillary to investment services governed by MiFID II. These cases remain subject to the MiFID II third-country regime.

Interestingly, under the new draft Article 32-2 (2) of the LSF, the exemption is extended to non-EU sub-custodians and brokers acting for depositaries of UCITS and AIFs when they provide ancillary deposit-taking and overdraft facilities alongside safekeeping and custody services. This reflects Luxembourg's broader interpretation of "ancillary services" and its willingness to treat such arrangements as falling outside the scope of "core banking services" under CRD VI.

This is going further than the European Banking Authority (EBA)'s opinion, which, in its July 2025 report, seemed not to endorse broad exemptions where deposit-taking or overdraft elements are intertwined with custody functions. The EBA called for further clarification via its Q&A tool rather than granting blanket exemptions.

The commentaries to the articles section of the draft bill provide several illustrative examples of exempt activities. For instance, deposit-taking is exempt when it is directly linked to custody or administration of financial instruments. Lending or guarantees are also exempt when they form part of treasury management or collateral arrangements associated with safekeeping services. Similarly, a loan granted to an investor to facilitate a transaction in financial instruments — where the third-country firm also provides execution, underwriting or investment advice — falls within the exemption.

Each case must be assessed individually, and the exemption only applies where the ancillary nature of the banking service is demonstrable and intrinsically connected to the investment activity.

• Reverse solicitation: Third-country firms can provide banking services in Luxembourg without establishing a branch when the service is rendered at the initiative of a Luxembourg- or EU-based client. This exemption remains available under the current regime and is preserved in the draft bill.

However, the exemption does not allow for any form of solicitation or marketing by the third-country bank or its affiliates. Consistent with the current regime, the draft bill explicitly prohibits third-country firms from using a client's initial request to promote or offer additional banking products or services. Only services that are strictly necessary or closely linked to the initial request can be provided. The burden of proof lies with the third-country institution to demonstrate that the client's initiative was genuine and unsolicited.

• Interbank and intragroup transactions: The branch requirement does not apply to transactions with EU credit institutions or with group entities.

Branch classification and proportionality

TCBs will be classified into two categories, reflecting their size, complexity and risk profile:

• Category 1: applies to large or potentially riskier branches (e.g., those with assets more than or equal to EUR 5 billion, or significant retail deposit-taking)
• Category 2: covers smaller and less complex branches

The classification determines the level of prudential requirements, governance and reporting obligations. Category 1 branches will be subject to more stringent requirements, including higher minimum capital and liquidity standards.

Authorization and supervision

The authorization process for TCBs is now standardized, requiring the following:

• A comprehensive application, including a business plan, governance and risk management arrangements, and evidence of parent authorization and supervision
• Ongoing cooperation agreements between the CSSF and the third-country supervisor
• Participation in Luxembourg's deposit guarantee and investor compensation schemes

The CSSF is empowered to refuse or withdraw authorization in a wide range of circumstances, including prudential or AML/CFT concerns at the parent/group level.

Practical implications

The new regime represents a paradigm shift for third-country access to the Luxembourg (and EU) banking market.

Key action points include the following:

• Determine whether current activities fall under Annex I, points 1 (deposit-taking), 2 (lending) or 6 (guarantees)
• Evaluate whether the services currently provided cross-border without a branch remain permissible under the new TCB regime
• If subject to the new rules, prepare to establish a Luxembourg branch and initiate the CSSF authorization process, ensuring compliance with governance, capital and reporting requirements
• Review client onboarding processes to align with the new reverse solicitation rules and maintain robust documentation to evidence client initiative
• Clarify whether any services provided qualify as ancillary to MiFID II investment services (e.g., deposit-taking linked to custody or lending for trade execution) and document the basis for exemption.

While the new TCBs regime primarily targets banking activities, its implications extend to the investment fund sector, particularly where funds engage in lending or rely on third-country banks. Funds should:

• Assess whether their activities trigger the TCBs requirement
• Determine whether deposit-taking or lending are strictly ancillary to investment services under MiFID II and document this classification
• Identify any reliance on third-country banks for depositary, lending or guarantee services, and evaluate whether these services fall within the scope of the new regime.