CSSF-CODERES 26/22: SRF Data Reporting Due 15 January 2027

On 29 September 2026 the CSSF’s Resolution Board published Circular CSSF-CODERES 26/22, which launches the Single Resolution Board’s data collection for the 2027 contribution period of the Single Resolution Fund (SRF). The circular requires Luxembourg credit institutions within the Single Resolution Mechanism to send the SRB’s 2027 Data Reporting Form (DRF) to the CSSF in XBRL format by 15 January 2027 at 24:00 CET, through the eDesk portal or the CSSF’s S3 interface.

The deadline applies although no SRF levy has been raised since the fund reached its target level. On 13 February 2026 the SRB confirmed that, for the third year in a row, banks would not contribute, with the fund at more than EUR 81 billion on 31 December 2025. The next target-level verification runs in the first quarter of 2027, and the DRFs filed in January are the data set the SRB would use if it decides to collect. Missing or incorrect information lets the SRB fall back on estimates or its own assumptions under Article 17(1) of Commission Delegated Regulation (EU) 2015/63, and in specific cases assign the highest risk-adjusting multiplier under Article 17(2).

Groups under direct ECB supervision carry a second workstream. An external auditor’s agreed-upon procedures (AUP) report on covered deposits, the derivative adjustment and the intragroup, IPS and promotional loan deductions becomes due for the 2027 data only if the SRB decides to calculate and collect contributions. Any restatements of 2016 to 2023 data follow a separate track, where the assurance applies without that condition and falls due on the same 15 January date.

Related reading: SRB 2025 Annual Report: Resolution and Crisis Readiness

Dates in the 2027 SRF contribution cycle

The circular, the SRB kick-off letter of 10 September 2026 (Annex 1) and the CSSF user guide (Annex 5) set this calendar. Luxembourg filers work to the CSSF dates; the SRB dates show where the file goes next.

• 9 September 2026: SRB decision SRB/ES/2026/41 approves the 2027 DRF, additional assurance requirements and guidance.
• 16 September 2026: date of the CSSF’s list of institutions under direct ECB supervision, directly or through their group.
• 3 November 2026: the CSSF collection portal opens; the SRB’s eReg platform, used by national resolution authorities (NRAs), opens the same day.
• 30 November 2026: date by which the circular asks institutions to inform the CSSF proactively which restated DRFs they intend to send, and for which collection years.
• 15 January 2027: 2027 DRF in XBRL to the CSSF by 24:00 CET, and, for any 2016 to 2023 restatements, additional assurance to the CSSF resolution department.
• 15 January 2027: SRB cut-off for restated DRFs on eReg in the 2027 period.
• 1 February 2027: Article 14(4) deadline for DRFs to reach the SRB via NRAs, since 31 January 2027 is not a business day.
• Early February 2027: SRB data checks, with clarification requests routed through the NRA.
• February to March 2027: SRB publishes the target-level verification results.

One milestone has no date. The circular ties preparation of the 2027 AUP to a CSSF notification that the SRB has decided to calculate and collect contributions on the basis of the 2027 DRFs. For the regular returns running alongside this cycle, see our CSSF Reporting Calendar Q3 2026.

What Circular CSSF-CODERES 26/22 transmits, and whose decision it serves

The circular is the Luxembourg delivery vehicle for an SRB decision. It notifies the SRB’s documents to the institutions concerned and adds the CSSF’s own deadline and transmission mechanics.

The chain of authority starts in Regulation (EU) No 806/2014 (SRMR). Article 67 establishes the SRF, and under Article 69(1) its target level is at least 1% of the covered deposits of all credit institutions authorised in the participating Member States. Article 69(4) requires regular contributions to be raised again when available financial means fall below that level after the initial period. Article 70 bases each contribution on the institution’s liabilities excluding own funds, less covered deposits, relative to the same aggregate across the participating Member States, combined with a risk-adjusted component; the SRB guidance calls the two parts the basic annual contribution and the risk-adjusted contribution.

The methodology sits in Commission Delegated Regulation (EU) 2015/63 and Council Implementing Regulation (EU) 2015/81. Article 14 of the Delegated Regulation obliges institutions to report at least the information in its Annex II at individual entity level, in the formats the resolution authority specifies (Article 14(6)), and Article 6 of Implementing Regulation 2015/81 gives the SRB the task of setting those formats. The SRB did so in decision SRB/ES/2026/41 of 9 September 2026, which approves the 2027 DRF, the 2027 additional assurance requirements and the 2027 guidance document, and which NRAs notify to institutions under its Article 4. Circular CSSF-CODERES 26/22 is that notification for Luxembourg.

Two consequences follow. The CSSF deadline of 15 January 2027 falls more than two weeks before the 1 February date in the SRB’s letter, so a plan built around 1 February leaves no room for a rejected upload. The CSSF’s role is also operational: the kick-off letter recalls that NRAs provide operational support while the SRB alone holds final decision-making power, citing paragraph 47 of the Court of Justice judgment in case C-414/18. The CSSF can clarify how to fill a field; the contribution decision belongs to the SRB.

Luxembourg entities inside and outside the collection

The circular is addressed to all credit institutions subject to the SRMR. Its footnotes translate that into Luxembourg terms: every credit institution established in Luxembourg is in scope, except branches of credit institutions with a head office outside the EU. Branches of banks from another Member State, whether or not it participates in the Banking Union, are covered through their head office.

The Luxembourg branch of a bank headquartered outside the EU is the clearest non-example. The circular leaves it out of the SRF collection and places it under the Luxembourg Resolution Fund (FRL), citing Article 108(1) of the Law of 18 December 2015 on the failure of credit institutions and certain investment firms and CSSF Regulation No 16-06. A Luxembourg subsidiary of a non-EU group is a different case: it is a credit institution established in Luxembourg and falls within the circular.

The SRB guidance (Annex 4) sets the form’s scope at legal entity level: credit institutions as defined in Article 4(1)(1) of the CRR, including central bodies and affiliated institutions but excluding the entities listed in Article 2(5) of the CRD, and investment firms within point (3) of Article 2(1) of the BRRD that are subject to the initial capital requirement in Article 9(1) of Directive (EU) 2019/2034 and covered by the ECB’s consolidated supervision of their parent under Article 4(1)(g) of Regulation (EU) No 1024/2013. The guidance states that institutions authorised under Article 14 of EMIR are out of scope of the SRF contribution and need not provide data, yet field 1C5 and Tab 3 Section A still provide a clearing-liability deduction for a CCP established in a Member State that used the option in Article 14(5) of EMIR. The guidance does not reconcile the two statements, so an institution with CCP status should confirm its position with the CSSF. The CSSF landing page tags the circular for credit institutions and investment firms, while its addressee line names credit institutions only.

Two Tab 1 fields catch changes in the population. Field 1D1 applies to institutions whose supervision started during 2026, which receive a partial contribution under Article 12(1) of the Delegated Regulation, determined by reference to the full months of supervision in the contribution period. Field 1D2 flags a merger with another in-scope institution after the reference date; for each of the three merger patterns in the guidance (A plus B becomes C, one licence retained, both licences retained), the guidance tells the institution to contact its national resolution authority.

Filing a form for a levy that may never be raised

The obvious objection is that the SRB has not raised an SRF levy for three consecutive contribution periods. The SRB’s 2025 Annual Report records EUR 80 billion in the fund at 31 December 2024, enough to meet the target level, so no regular annual contributions were collected in 2025, and the statement of 13 February 2026 extended that to the coming year.

The reporting duty stands on its own footing. The kick-off letter cites Articles 14(1), 14(3) and 14(4) of the Delegated Regulation as requiring institutions to report their data at least annually, the data on which contributions are calculated “when the circumstances for raising them materialise”. It also reminds institutions that the SRB revises the DRF every year, so the 2027 form is the vehicle for the 2027 cycle.

The timing does the rest. The SRB will verify in the first quarter of 2027 whether available financial means still equal at least 1% of covered deposits in the Banking Union and, “unless circumstances change”, assess on that basis whether 2027 contributions are calculated and collected, with a separate decision for any collection. Recital 25 of the SRB decision makes the AUP depend on a decision “to calculate and collect contributions to the SRF based on the data set collected in the 2027 cycle”. A file that is complete and correct on 15 January keeps the Article 17 fallback out of the picture if the verification points to a collection.

Reference date, entity level and default values

Tabs 1 to 4 are completed at the balance sheet date of the latest approved annual financial statements available before 31 December 2026, together with the statutory auditor’s opinion, unless the guidance names another date for a field. A 31 December year end gives 31 December 2025, provided those statements are approved; a 31 March year end gives 31 March 2026, provided approval came before 31 December 2026. Field 1E1 records the date used.

Three general instructions shape almost every cell:

• Consistency: values come from the latest relevant supervisory report submitted for the reference year. On that wording, a resubmitted COREP or FINREP return supplies the figures the DRF should match.
• One measurement basis: “total liabilities” is defined by reference to the applicable accounting framework (Article 3(11) of the Delegated Regulation), and the same principles apply across the contribution, deduction and risk adjustment tabs.
• Individual entity level, with two exceptions: a central body and its affiliates exempted under Article 10 of the CRR file one consolidated form, and where a risk indicator has been waived (Article 8 of the Delegated Regulation) the LCR and NSFR are reported at liquidity sub-group level and other indicators may be reported at consolidated level, with the score attributed to each institution in the group.

Format rules are enforced by the XBRL taxonomy. Amounts are in euros rounded to the nearest unit. The LEI in field 1A7 stays in a text-formatted cell, which matters for an LEI made only of digits. Blank-looking answers have three defaults: “Not applicable” when the field does not apply to the bank; “Not available” when “the field is applicable to the institution but the phenomenon is absent”; and “0” when “the field is applicable to the institution, but the fact does not occur for that specific institution”, as for a bank holding no covered deposits in field 2A3.

Labels deserve a second look. The first instruction pages of the 2027 guidance still carry a “2026 contribution period” footer, and when checked on 30 September 2026 the CSSF landing page listed the PDF form (Annex 3a) under last year’s circular number. The documents themselves are the 2027 versions. One mismatch touches the deadline: the dashboard description in section 4.1.3 of the user guide lists the 2027 cycle deadline as 16/01/2027 and a last-submission window from 01/11/2026 to 16/01/2027, while the circular and the guide’s own introduction give 15 January 2027 and a portal opening on 3 November 2026. This article works to the circular’s date of 15 January 2027 at 24:00 CET.

The four tabs of the 2027 Data Reporting Form

The DRF follows the contribution formula: identification, basic annual contribution, deductions and risk adjustment. The SRB decision puts the total at roughly 150 data points.

Tab 1: identification and calculation specificities

Beyond identifiers (RIAD code or SRB identifier, LEI, national code), Tab 1 asks the questions that switch later sections on or off. Fields 1C3 and 1C4 cover IPS membership and the Article 113(7) CRR permission; a “Yes” in 1C4 opens the IPS deduction and feeds the risk adjustment. Fields 1C5 and 1C6 identify CCPs and CSDs for their deductions. Field 1C7 identifies in-scope investment firms and the new field 1C7_a asks whether the firm is a Class 2 investment firm within Article 11a of the Delegated Regulation. Fields 1C8 and 1C10 route limited-activity investment firms and mortgage credit institutions financed by covered bonds to simplified methods, and 1C9 identifies promotional loan activity.

Tab 2: basic annual contribution and the lump-sum test

Field 2A1 is labelled “total liabilities”, but the guidance defines it as the total balance sheet, the sum of liabilities and equity items in the annual financial statements. Own funds in field 2A2 come from COREP C 01.00, row 010, column 010. Covered deposits in field 2A3 are the yearly average of the four quarterly amounts, using the Article 6(1) definition of the Deposit Guarantee Schemes Directive and excluding temporary high balances under Article 6(2). Our Deposit Guarantee Scheme guide explains the coverage rules behind that figure.

Field 2B2 is computed by the form. Under the guidance’s formula, an institution invited by the SRB under Article 10(8) to complete the full form never qualifies for the lump sum. A limited-activity investment firm (field 1C8) qualifies where total liabilities less own funds less covered deposits do not exceed EUR 300 million. Any other institution qualifies only where total liabilities do not exceed EUR 1 billion and the same net figure does not exceed EUR 300 million. A qualifying institution may still opt in field 2B3 for an alternative calculation under Article 5, supplying the Tab 2 and Tab 3 data in full; under Article 10(7) the lower amount applies.

Tab 3: deductions from the liability base

Tab 3 carries the Article 5 deductions in seven sections: clearing (A, for CCPs only), CSD activities (B), client assets and client money (C), promotional loans (D), IPS (E), intragroup (F) and simplified methods (G). Sections A to F repeat the derivative split, so the derivative floor factor from Tab 2 flows into every deduction containing derivative liabilities. The PDF form carries a warning worth pinning above the working file: the same transaction can only be deducted once, even where it fits several categories.

The intragroup and IPS sections require each liability and asset to be matched to a counterparty’s booked figure. A qualifying intragroup liability requires that each institution is established in the Union, is included in the same consolidated supervision under Articles 6 to 17 of the CRR on a full basis with appropriate centralised risk evaluation, measurement and control procedures, and faces no current or foreseen material practical or legal impediment to prompt repayment. Article 5(2) requires an even deduction, so each counterparty deducts half. Assets are deductible only where they match an eligible liability of the counterparty, and in a mismatch the counterparty’s booked liability value prevails. Neither deduction may be used when testing whether a small institution qualifies for the lump sum.

Tab 4: the risk adjustment and its COREP and FINREP sources

Tab 4 draws almost everything from supervisory templates, and the guidance names the cells; our COREP Reporting Explained guide sets out the template families.

• Risk exposure: leverage ratio from C 47.00, row 340, column 010; CET1 capital from C 01.00, row 020; total risk exposure amount from C 02.00, row 010; CET1 ratio from C 03.00, row 010; total assets, which must equal field 2A1 at individual level.
• Funding: LCR from C 76.00a, row 030, column 010; NSFR from C 84.00, row 220, column 040.
• Interbank activity: loans from the FINREP F 04 breakdowns for credit institutions and other financial corporations, deposits from F 08.01.a.
• Additional indicators: market risk from C 02.00 rows 540, 550, 555 and 580; off-balance sheet nominal amount from C 40.00, row 95, column 070; derivative exposure from C 47.00, rows 061 to 140, with CCP-cleared derivatives entering the ratios at 50%; IPS membership; and extraordinary public financial support.

Waivers change the reporting level, and the effect differs by indicator. For a ratio such as the LCR, the sub-group figure and its score are inherited. For interbank loans and deposits the guidance warns that the data points are amounts: if consolidated figures are used, the SRB is compelled to use them for each institution in the group, which affects each one’s amount.

The derivative adjustment and its 75% floor

Section C of Tab 2 replaces the accounting value of derivative liabilities with a value computed under Articles 5a to 5e of the Delegated Regulation, a part of the text that the SRB’s assurance template notes was amended by Commission Delegated Regulation (EU) 2023/662 of 20 January 2023 (Official Journal of 22 March 2023). Credit derivatives are excluded throughout. The guidance sets five steps:

1. Identify the netting agreements recognised under Articles 5a to 5e; cross-product netting applies in no step.
2. Carve out the derivative liabilities from the same source as the annual financial statements: negative fair values of contracts and netting sets, including off-balance sheet contracts and accrued interest, excluding collateral.
3. Value them under the Mark-to-Market Method in Article 5b (replacement cost plus potential future credit exposure), or, for interest-rate, foreign-exchange and gold contracts, the Simplified Exposure Method in Article 5c where the size conditions of Article 273a(2) CRR are met. Field 2C1 takes the yearly average of quarterly values.
4. Apply the floor: 75% of the accounting value of all derivative liabilities, on and off balance sheet (field 2C4, equal to 2C2 plus 2C3).
5. Adjust: field 2C6 equals 2A1 minus 2C2 plus 2C5, where 2C5 is the higher of 2C1 and 75% of 2C4.

Field 2C1 is a calculation specific to the Delegated Regulation, run on the institution’s own derivative book for each quarter; unlike the Tab 4 ratios, the guidance gives it no COREP source cell, and it accepts gaps in the quarterly series only in exceptional cases such as a licence granted or withdrawn during the year. Where national accounting keeps derivatives off balance sheet, field 2C3 carries the absolute value of their summed negative fair values under IFRS 13 or an equivalent standard. The floor factor, 2C5 divided by 2C1, is then reused in each of Tab 3 Sections A to F.

What changed in the 2027 cycle

The SRB decision calls the 2027 obligations relatively stable and names three legal changes behind the adjustments.

• MREL indicator repealed. Commission Delegated Regulation (EU) 2026/440 of 24 February 2026 removed the risk indicator “own funds and eligible liabilities held by the institution in excess of MREL” from Article 6 of the Delegated Regulation with effect from 1 January 2026, so Tab 4 no longer asks for it. MREL itself is still reported through the channels in our MREL Reporting Requirements guide.
• Certain investment firms. The same regulation introduced Article 11a with new modalities for certain investment firms’ contributions. The DRF adds field 1C7_a and field 2B5, through which a Class 2 investment firm can opt under Article 11a(3) and (4) for an alternative risk-adjusted calculation; a firm answering “No” provides all data points except those in Tab 4.
• Data sharing. Article 5 of Regulation (EU) 2025/2088 of 8 October 2025 inserted Article 31a into the SRMR, requiring the SRB to seek information already held by other authorities before asking institutions.

The data-sharing change leaves the 2027 workload where it was. The SRB found about 60 of the roughly 150 data points already available to other authorities, including COREP and FINREP data, although not for all institutions, concluded that combining those sources could only be done manually with operational risks it could not mitigate, and relied on the second subparagraph of Article 31a(2) to keep requesting the data directly.

The “complexity and resolvability” indicator stays dormant. Its data points are not uniformly available for the 2025 reference period, so the 2027 collection asks for none of its variables; the decision notes that on 21 May 2025 the General Court, in case T-476/23, upheld the SRB’s non-application of this indicator in the 2023 period.

In Luxembourg, the deadline moves from 16 January 2026 under last year’s Circular CSSF-CODERES 25/21 to 15 January 2027, and the user guide moves to version 1.5 for the EACIND 2027 cycle. The 2027 taxonomy is SRB version 12.0.1, and the filing rules are the SRB’s amendment to version 5.9 of the EBA XBRL filing rules of 26 June 2026.

Getting the XBRL file through eDesk or S3

In eDesk, the “Contributions to the Single Resolution Fund (SRF)” procedure sits in the Procedures menu and requires an entity link granted by the entity’s advanced user, so the person uploading in January needs that link before the portal opens. The S3 route is covered by the CSSF’s separate technical guide on transmitting reports via API. Files sent through S3 appear in eDesk once the S3 checks pass; files uploaded in eDesk are not visible in S3.

Each submission is a .zip holding one single .xbrl file, both named to a mandatory convention. The user guide’s example for this cycle is EACREP-B00000XXX-2027-01-EACIND-L-N.zip: reporting type and direction (EACREP), B plus the eight-digit entity number, year, the constant month 01, the table code (EACIND, or EACRST for restatements), the accounting version and a closing “N”. The accounting version needs a deliberate choice: “L” where only the Luxembourg entity is considered, “N” where the Luxembourg entity and its branches are.

The CSSF runs four controls: technical (file name and validity), SRB taxonomy validation rules, a CSSF business control for coherence with data previously reported, and SRB filing rules. A CSV feedback file returns for every upload, and its status decides the next step:

• “Rejected by CSSF”: a blocking rule flagged ERROR failed; nothing is transmitted and the file needs correcting and re-uploading.
• “Warning detected” or “Submitted to CSSF”: transmitted, with any non-blocking findings flagged WARNING.
• “Submitted to SRB”: passed to the SRB for review.
• “Correction expected”: the SRB has raised questions and a corrected file is needed.

The user guide’s formal error codes show where rejections come from, among them EAC001 (naming), EAC003 (entity code differs from the connected user’s entity), EAC008 (more than one XBRL file in the zip), EAC010 (XBRL and zip names differ) and CSSF_2 (period in the report differs from the file name). The CSSF states that it will usually not raise errors for filing rules marked “SHOULD”. If no feedback arrives within a working day, the guide points to eacind@cssf.lu; questions on the circular go to reporting_res@cssf.lu.

Additional assurance: who needs an auditor’s AUP, and when

The requirement applies to each credit institution that, directly or as part of a group, falls under direct ECB supervision, unless it is subject to the lump-sum payment under Article 10(1) to (6) of the Delegated Regulation and has not asked for the alternative contribution under Article 10(7). The circular refers to Annex 6 for the list of such institutions as of 16 September 2026, but the published annexes run from 1 to 6b and Annex 6a, the SRB’s assurance document, contains no list; an institution unsure of its status can confirm it with the CSSF’s Reporting Resolution Team.

For 2027 data the requirement is conditional. Article 2 of the SRB decision makes it effective only once the SRB adopts a decision to calculate and collect contributions on the basis of the 2027 DRFs, and the circular requires institutions to prepare the auditor’s confirmation “only upon the notification by the CSSF that such condition is fulfilled”. In recital 26 the SRB judges that, in case of a collection, an AUP performed by an auditor is the only appropriate way to secure accurate 2027 data, having found that it ensures accuracy better than a mere management sign-off and imposes less burden than an assurance statement. NRAs may extend the data or institutions covered (recital 29); the circular announces no Luxembourg extension.

The SRB describes the AUP scope as data otherwise outside supervisory reporting or auditing. Its template, which becomes Annex I of the auditor’s report, sets seven blocks of procedures:

1. General activities: the DRF, the documented extraction and control procedures, and the management body’s written confirmation that they were executed.
2. Covered deposits (field 2A3), where not provided and verified by the DGS: definition under Article 3(10) of the Delegated Regulation, reconciliation and recalculation.
3. Derivative adjustment (fields 2C1, 2C2 and 2C3): identification of derivatives, netting agreements compliant with Articles 5a to 5e at the reference dates, valuation, reconciliation and recalculation.
4. Promotional loans (field 3D5), only where claimed, including the Article 5(1)(f) euro-for-euro matching rule.
5. IPS deduction (fields 3E5, 3E9 and 3E10), only where claimed.
6. Intragroup deduction (fields 3F1, 3F5, 3F9 and 3F10), only where claimed, including a check that the five counterparties with the highest total liabilities and assets are on the list of eligible entities.
7. Own funds (field 2A2), only where the institution has a waiver from own funds reporting at individual level.

The output is a report of factual findings. The SRB provides no engagement letter template and presumes the illustrative example in Appendix 1 of ISRS 4400 (Revised) will be followed; for the report it lists 17 minimum elements based on Appendix 2, including the full DRF as Annex II, exceptions with the amount calculated by the auditor, and a statement that the procedures are neither an audit nor a review and express no assurance. The report is a PDF printed to PDF (scans are not accepted), qualified electronic signatures are accepted, and the file is named MFI_LEI_AUP_2027, where MFI is the two-letter country code followed by the institution’s identification code. Where the AUP finds an error, the circular asks that the documentation name the field and the amount that should have been reported, so the later restatement needs no fresh assurance.

Restatements of 2016 to 2023 data run on a different clock

Article 14(5) of the Delegated Regulation requires corrections to previously submitted data without undue delay, and under Article 17(3) the contribution is adjusted in the following period. Article 17(5) sets the general window: as the SRB decision summarises it, the window opens with notification of the contribution decision and expires on 31 January of the year following the fourth contribution period after that notification. The guidance calls it a strict, non-interruptible time limit.

The 2016 to 2023 periods follow a transitional time limit instead. Article 20(10) of the Delegated Regulation, inserted by Commission Delegated Regulation (EU) 2026/440 and applicable from 6 June 2026, provides that, notwithstanding Article 17(5), requests for restatement or revision of information submitted for the calculation of annual contributions for contribution periods before the 2026 contribution period are to be submitted by 31 January 2031 at the latest. The limit covers requests made by institutions under Article 14(5) and those initiated by resolution authorities, and it is not subject to interruption. The circular and the SRB’s letter, decision and guidance do not mention the 2031 date.

The circular adds three Luxembourg steps. It asks institutions to inform or re-inform the CSSF contacts proactively, by 30 November 2026, of the restated files they intend to send and the years concerned, and it states no consequence for missing that date. The circular specifies XBRL, with a footnote that restatements up to 2022 are still in Excel; the SRB letter allows Excel or XBRL for 2016 to 2022 and XBRL only for 2023, and each correction goes into the DRF of the period being amended. Where restatements are submitted, the circular has every institution under direct ECB supervision, directly or through its group, unless subject to the lump-sum payment, make additional assurance documents available to the CSSF resolution department by 15 January 2027; the SRB document applies that date to the DRFs submitted for 2016 to 2023 restatements, “if any”. The condition that suspends the 2027 AUP does not apply here.

The restatement assurance is narrower in data and lighter in form. It covers only in-scope data points for which a new value is submitted. For 2016 to 2023 data the SRB accepts the AUP or a sign-off form from a representative of the management body within the meaning of Article 88 of the CRD, a form that cannot be used for 2027 data. No new AUP or sign-off is needed where the restatement follows a previous-cycle auditor’s report that identified the erroneous data point and stated both the former figure and the new value, and that report is attached to the restated DRF. File names follow MFI_LEI_AUP_YEAR or MFI_LEI_SOF_YEAR.

Two cross-references need care. The restatement paragraph points to “Annex 7a and Annex 7b”, yet this circular’s annexes stop at 6b; Circular CSSF-CODERES 25/21 placed the AUP documents in Annexes 7a and 7b, and this year the SRB document, with the sign-off form as its Annex III, is Annexes 6a and 6b. On timing, the circular sets no CSSF date for the restated DRFs themselves, while the SRB letter asks NRAs to upload them to eReg by 15 January 2027 and states that restated DRFs sent to an NRA after that date but not yet reported to the SRB, for example while the NRA is still verifying them, will be considered in a later period if accepted.

After 15 January: data checks, verification and the collection decision

The SRB runs its data checks in early February 2027, comparing DRF fields with sources such as supervisory reporting and the previous cycle, with clarification requests routed through the CSSF. The SRB is explicit about their limits: passing them does not mean the data is fully correct, accepted or validated, and the exercise cannot be understood as an audit under any auditing standard.

The target-level verification follows, with a separate decision if a collection is needed. The SRB’s 2025 Annual Report notes numerous litigation cases on the ex-ante calculation before the European Court of Justice, with most aspects confirmed and some still pending. Article 18 of the Delegated Regulation allows administrative penalties and other measures referred to in Article 110 of the BRRD for breaches, and Articles 34 to 36 of the SRMR let the SRB request information, investigate and inspect on site.

Frequently Asked Questions

Our financial year ends on 30 June. Which reference date goes into field 1E1?

Read literally, the rule points to 30 June 2026 if those statements and the auditor’s opinion are approved and available before 31 December 2026, and to 30 June 2025 otherwise. The guidance only gives worked examples for December and March year ends, so an institution with a late approval timetable has good reason to confirm its reading with the CSSF.

We qualify for the lump sum and belong to a group under direct ECB supervision. Could we still need an AUP?

Yes, depending on field 2B3. The exemption covers lump-sum institutions that have not asked for the alternative contribution under Article 10(7). An institution that answers “Yes” in 2B3 falls back within the additional assurance scope, so the AUP would apply if the SRB decides to collect.

We are a Luxembourg subsidiary of a bank from another Banking Union Member State. Does our parent’s filing cover us?

Only branches are covered through their head office. A subsidiary is a credit institution established in Luxembourg and the form is completed at individual entity level, so it files its own DRF. Group structure still matters for the intragroup deduction, waiver-based risk indicators and additional assurance scope.

Our covered deposits figure comes from the deposit guarantee scheme. Does the AUP still test field 2A3?

The SRB’s covered deposits block applies “when not provided and verified by DGS”. The circular does not say whether that condition is met in Luxembourg, and NRAs may adapt the procedures, so the point is worth settling with the CSSF before an engagement letter is agreed.

If the auditor finds an error after the DRF has been filed, what happens to the file?

The SRB template treats a “Yes” finding as a discrepancy to report, with the data point and new value highlighted, and the AUP is attached when the corrected DRF is submitted.

We miss 15 January but could file before 1 February. Is the SRB date a safety net?

The circular links the consequences to its own date: where not all required information is transmitted correctly by 15 January 2027, the SRB uses estimates or its own assumptions under Article 17(1), and in specific cases may apply the highest risk-adjusting multiplier under Article 17(2). The circular does not treat 1 February as an extension for Luxembourg filers.

How is a restatement uploaded in eDesk?

For a new contribution cycle, the upload action sits on the dashboard row. For a restatement, the user opens the detail screen of the contribution year concerned and uploads a new reporting version there, using the EACRST table code in the file name.

Related Articles

• SRB 2025 Annual Report: Resolution and Crisis Readiness: the SRB’s 2025 report on crisis readiness and the reporting behind resolution planning.
• MREL Reporting Requirements: MREL reporting, which continues after the indicator left the SRF risk adjustment.
• COREP Reporting Explained: the templates that feed Tab 4 of the DRF.
• Liquidity Reporting: LCR, NSFR and ALMM Explained: the LCR and NSFR returns behind the funding pillar.
• SRB Liquidity and Funding in Resolution Guidance 2026: the SRB’s expectations on liquidity and funding capabilities in resolution.

Key Takeaways

• Plan to the CSSF’s 15 January 2027, 24:00 CET cut-off; 1 February belongs to the NRA-to-SRB leg.
• Before 3 November 2026: confirm the eDesk entity link or S3 access and choose “L” or “N” for the file name.
• Tell the CSSF by 30 November 2026 which 2016 to 2023 restatements are coming and deliver them early; the SRB will not process in the 2027 period restated DRFs uploaded to eReg on or after 15 January 2027.
• ECB-supervised groups outside the lump-sum exemption: the 2027 AUP starts only on the CSSF’s notification, and assurance for any 2016 to 2023 restatements submitted is due by 15 January 2027 whatever the SRB decides.
• Reconcile field 2A1 to the total balance sheet and floor derivative liabilities at 75% of their accounting value before any Tab 3 deduction.
• Drop the MREL-excess indicator from the 2027 Tab 4 build; complexity and resolvability variables are still not collected.
• Watch the SRB website between February and March 2027 for the target-level result that triggers any 2027 levy and AUP.

Sources and References

• CSSF, Circular CSSF-CODERES 26/22 and annexes (29 September 2026): landing page, circular (PDF)
• Annex 1, SRB kick-off letter (10 September 2026): PDF
• Annex 2, SRB decision SRB/ES/2026/41 (9 September 2026): PDF
• Annex 3a, 2027 Data Reporting Form: PDF
• Annex 4, SRB 2027 Guidance: PDF
• Annex 5, CSSF User Guide for Ex-ante Contributions Reporting, version 1.5: PDF
• Annex 6a, SRB Additional Assurance Requirements 2027: PDF
• CSSF, Circular CSSF-CODERES 25/21 (29 September 2025): PDF
• CSSF, methods of transmitting reports via API: cssf.lu
• Law of 18 December 2015 on the failure of credit institutions and certain investment firms (English version): PDF
• Regulation (EU) No 806/2014 (SRMR): EUR-Lex
• Commission Delegated Regulation (EU) 2015/63: EUR-Lex
• Council Implementing Regulation (EU) 2015/81: EUR-Lex
• Commission Delegated Regulation (EU) 2023/662: EUR-Lex
• Commission Delegated Regulation (EU) 2026/440: EUR-Lex
• Regulation (EU) 2025/2088: EUR-Lex
• Directive 2014/59/EU (BRRD): EUR-Lex
• Regulation (EU) No 575/2013 (CRR): EUR-Lex
• Directive 2013/36/EU (CRD): EUR-Lex
• Directive (EU) 2019/2034 (IFD): EUR-Lex
• Council Regulation (EU) No 1024/2013 (SSM Regulation): EUR-Lex
• Regulation (EU) No 648/2012 (EMIR): EUR-Lex
• Directive 2014/49/EU (DGSD): EUR-Lex
• SRB, “For the third year, the SRB will not impose Single Resolution Fund levies” (13 February 2026): srb.europa.eu
• SRB, Annual Report 2025: PDF
• IAASB, ISRS 4400 (Revised), Agreed-Upon Procedures Engagements, as referenced in Annex 6a of Circular CSSF-CODERES 26/22
• CSSF Regulation No 16-06, as cited in footnote 3 of Circular CSSF-CODERES 26/22
• Court of Justice, case C-414/18 (paragraph 47), as cited in Annex 1, and General Court, case T-476/23 (21 May 2025), as cited in Annex 2 of Circular CSSF-CODERES 26/22

Before the CSSF portal opens on 3 November 2026

The weeks before the portal opens are the time to settle the choices that decide the file: the reference date against the approval timetable of the accounts, the lump-sum test and any alternative-contribution election, the quarterly derivative valuation and its floor, the intragroup and IPS counterparties, and the accounting version code. Restatement plans go to the CSSF by 30 November 2026. Nothing in the circular requires AUP work on 2027 data before the CSSF’s notification, although an ECB-supervised group can already map which fields its auditor would test. The operative date remains 15 January 2027, with the 2027 DRF in XBRL on eDesk or S3 by 24:00 CET and any restatement assurance lodged with the CSSF resolution department.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.