CSSF Long Form Report 2027: What the SAQ Asks of Banks and Auditors

The CSSF opened the 2027 Long Form Report (LFR) campaign on 3 November 2026, and the self-assessment questionnaire (SAQ) is now available in eDesk. For entities whose financial year ends on 31 December 2026, the CSSF’s communication fixes the SAQ reference date at 31 December 2026 and the submission date at 31 March 2027. This year’s CSSF Long Form Report questionnaire carries three new modules: mortgage credit, protection of clients’ financial instruments and funds, and out-of-court complaints.

Two of them reach past the questionnaire. The client-asset module aims to standardise the descriptive part of the separate report that the institution’s approved statutory auditor (réviseur d’entreprises agréé, REA) prepares on the same subject, and the complaints module moves an existing annual filing into eDesk. Luxembourg branches of EU credit institutions also face two different deadlines in two CSSF texts.

Related reading: CSSF Reporting Calendar Q4 2026: Seven Filing Dates From 15 October

CSSF Long Form Report 2027 dates by entity type

The dates assume a 31 December 2026 year-end. “My count” marks a date I derived from a “months after year-end” rule.

• 3 November 2026: SAQ open in eDesk.
• 31 December 2026: SAQ reference date.
• 1 March 2027: out-of-court complaints table and summary report, on the existing basis: Circular CSSF 17/671, citing Article 16 of CSSF Regulation No 16-07, sets 1 March each year, covering the previous calendar year (for 2027, complaints registered in calendar year 2026). This date is not tied to the financial year-end.
• 31 March 2027: SAQ submission date in the communication. For Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions, it matches the three-month rule in section 4.1 of Circular CSSF 22/821.
• 31 May 2027: for Luxembourg credit institutions and Luxembourg branches of non-EU credit institutions, submission of the REA’s AML/CFT report and, where applicable, its separate client-asset protection report, within five months after year-end under section 4.2 of Circular 22/821 (my count).
• 30 June 2027: the six-month submission deadline for the EU-branch REA report or reports under point 37 of Circular CSSF 07/325 (my count). Point 29 of that circular also provides six months for the branch SAQ, but the CSSF’s 3 November 2026 communication specifies 31 March 2027 for the 2027 SAQ campaign, including EU branches. Pending clarification from the CSSF, branches should plan their SAQ submission for 31 March rather than rely on the June date.

Why three new modules arrived without a new circular

The communication still cites Circular 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897. The last of those, dated 31 October 2025, added the UCI administration and EMIR modules, dropped the IFRS 9 credit risk and DORA preparedness modules (DORA moved into the IT risk modules), and took the module list out of the circular. Section 2 now says the SAQ content is adapted yearly, with modules, levels of application and exemptions recorded directly in the CSSF’s digital solution and reflected on the CSSF website. Circular CSSF 25/898 did the same for the branch SAQ under Circular 07/325.

The 2027 additions therefore came by communication, website table and eDesk update, and a change log built only from new circulars would show nothing. The CSSF also says several existing modules were clarified, simplified or extended, without naming them; the eDesk questionnaire is where those edits show.

Client-asset protection: the new module and the REA’s separate report

The new module replaces the former section 5 of the MiFID module with a harmonised set of questions. It covers, among others, Article 37-1(7) and (8) of the Law of 5 April 1993 on the financial sector, Article 13(4) of the Law of 5 August 2005 on financial collateral arrangements, and Section 2 of Chapter 1 of the Grand-ducal Regulation of 30 May 2018.

The REA already reports on those provisions. Under section 3.1 of Circular 22/821, institutions, where applicable, mandate their REA to prepare an annual separate report on the adequacy of their client-asset arrangements under the same three texts; Article 7 of the Grand-ducal Regulation requires that report. The authorised management supplies the information for the report’s descriptive parts, and the REA may include those elements but has to verify that they are correct and adequate, amending them where needed. The circular states the report’s purpose as, in particular, ensuring the reliability of the institution’s SAQ answers on client-asset protection.

The communication says the new module aims to standardise the descriptive part of that report. I read this as management’s module answers becoming the standard descriptive material the REA verifies; section 3.1 was not amended, so the verification duty stands as written. The SAQ answers go in by 31 March, and the REA report testing them follows two months later with the digital signature of the partner in charge. The REA hands it to the institution, which uploads it (section 4.2), so any REA amendment to a descriptive element reaches the CSSF in a file the institution submits itself.

On 4 November 2026 the CSSF summary table still showed a separate level of application for “Section 5” of the MiFID module, which the communication says has been removed. Circular 22/821 records modules and exemptions directly in the digital solution, so eDesk is the reference for which MiFID sections an institution sees. The CSSF MiFID II/MiFIR FAQ update covers separate 2026 changes for the same business lines.

Mortgage credit module: scope first, and no exemption listed

The mortgage credit module assesses compliance with the Law of 23 December 2016 on credit agreements for consumers relating to residential immovable property, which transposes Directive 2014/17/EU (the Mortgage Credit Directive). It covers the scope of application of the MCD, governance and compliance arrangements, internal audit oversight, and the institution’s own assessment of its compliance.

Two details in the summary table set it apart. Its level of application reads “including their branches located in Luxembourg”, where most modules say “including their branches, if any”; read literally, a Luxembourg bank’s branches abroad fall outside it. And the exemptions column is empty, while the MiFID, PSD 2, depositary bank and UCI administration modules each exempt institutions that do not provide the service. My working assumption is that an institution with no consumer residential mortgage lending still meets the module and records its position under the scope questions. The communication does not address that case.

Complaints reporting moves into eDesk; the deadline is a separate question

The out-of-court complaint module lets institutions submit through eDesk the annual table of complaints registered during the year, with the summary report on complaints and the measures taken, under CSSF Regulation No 16-07 and Circular CSSF 17/671. The CSSF says Circular 17/671 “will be updated soon” to reflect the new channel.

The filing predates the module. Circular CSSF 17/671, referring to Article 16 of CSSF Regulation No 16-07, requires the complaints table and summary report by 1 March each year, covering the previous calendar year; for the 2027 filing, that means complaints registered during calendar year 2026. This deadline is distinct from the SAQ deadline, which is linked to the institution’s financial year-end. The communication changes where the filing goes and says nothing about when, so until Circular 17/671 is updated I would not treat the 1 March date as withdrawn. The communication does not say whether eDesk accepts the complaints module before the rest of the questionnaire is signed, and the practical-rules guide that section 4.3 of Circular 22/821 points to is version 2.3 dated 11 November 2024, which predates the module, so confirm the sequence with the CSSF before relying on a separate submission.

EU branches: 31 March in the communication, six months in Circular 07/325

The communication applies the LFR to Luxembourg branches of credit institutions headquartered in another Member State under Circular CSSF 07/325, as amended by Circulars CSSF 21/765, 22/827 and 25/898, and gives one submission date: 31 March 2027. Point 29 of Circular 07/325, as amended by Circular 25/898 on 31 October 2025, says the branch SAQ is reviewed and electronically signed by the authorised management and transmitted via eDesk within six months after year-end.

The communication does not say it changes point 29, and I am treating the conflict as unresolved. The 31 March date satisfies both texts; a branch planning to 30 June 2027 relies on the circular over the later communication. Pending clarification, branches should plan for 31 March and confirm the position with the CSSF before the year-end close.

The branch questionnaire is narrower. The summary table exempts EU branches established in Luxembourg from many modules, including client-asset protection, internal governance and EMIR, while the MCD and complaints modules carry no exemption. Under points 34 and 37 of Circular 07/325, the branch’s REA reports yearly on AML/CFT and on the conduct of business rules for investment services, may split this into two reports, and the branch submits them within six months after year-end.

Sign-off and the figures behind the answers

Section 4.1 of Circular 22/821 requires the SAQ to be reviewed and electronically signed by the authorised management before submission. Section 2 requires the information to be accurate, as concise as possible and a true and fair view, based on the prudential reporting figures (FINREP/COREP/LAREX) under IFRS as at the closure of the financial year. The SAQ shares its March window with the ICAAP and ILAAP filings under Circular 07/301.

AML/CFT stays outside the questionnaire. The REA covers it in a separate annual AML/CFT report under Articles 49(2) and (3) of CSSF Regulation No 12-02, and section 3.2 of the circular requires that report to explain how the REA selected its sample of files and to avoid imprecise negative formulations such as “We did not encounter serious weaknesses”. Our Luxembourg AML reporting guide covers the institution-side filings alongside it.

Frequently Asked Questions

Our financial year ends on 30 June. Do the 2027 campaign dates apply to us?

The communication states its dates for a 31 December 2026 year-end. Circular 22/821 ties the cycle to each institution’s own closure: the SAQ becomes accessible within three months before year-end and is due within three months after it, with the REA reports within five months. Where the year-end does not line up with a prudential remittance date, footnote 4 bases the SAQ on the last prudential reporting submitted before the closure.

Does a significant institution send its SAQ to the ECB?

The circular applies to significant and less significant institutions alike, and the CSSF’s summary of annual documents lists the CSSF as recipient of the SAQ and of both REA reports for significant institutions. Section 2 of the circular places the MiFID, PSD 2, UCI depositary and EMIR modules under the CSSF’s exclusive competence.

Does the REA still run agreed-upon procedures on the SAQ?

No agreed-upon procedure reports have been foreseen since the Circular 23/845 amendment. For institutions subject to Circular 22/821, the REA prepares an annual AML/CFT report and, where applicable, a separate client-asset protection report. The REA may carry out assessments beyond the SAQ in the latter. For EU branches subject to Circular 07/325, the REA instead covers AML/CFT and applicable investment-services conduct-of-business requirements in a single report or two separate reports.

Related Articles

• CSSF Reporting Calendar Q4 2026: Seven Filing Dates From 15 October: the quarter’s CSSF filing dates.
• CSSF ICAAP and ILAAP: Filing Under Circulars 07/301 and 20/753: the annual ICAAP and ILAAP reports.
• CSSF MiFID II/MiFIR FAQ: The 13 July 2026 Transparency Rewrite: the CSSF’s 2026 transparency FAQ rewrite.
• EMIR Reporting Requirements: What You File, When, and How: the regime behind the SAQ’s EMIR module.
• CSSF Table B 4.6 Reporting: The 22 Named Functions Due by 20 January: another annual eDesk filing for Luxembourg banks.

Sources and References

• CSSF, Self-assessment questionnaire (revised Long Form Report), communication of 3 November 2026: cssf.lu
• CSSF, Prudential reporting for credit institutions, section “Self-assessment questionnaire (revised Long Form Report)” with the module summary table: cssf.lu
• Circular CSSF 25/897 of 31 October 2025, annexing Circular CSSF 22/821 as amended by Circulars CSSF 23/845, 24/865 and 25/897 (PDF): cssf.lu
• Circular CSSF 25/898 of 31 October 2025, annexing Circular CSSF 07/325 as amended by Circulars CSSF 21/765, 22/827 and 25/898 (PDF): cssf.lu
• CSSF, Summary of documents to be submitted on an annual basis (page published 23 December 2025, linking the summary spreadsheet; current list per Circular CSSF 25/902): cssf.lu
• Circular CSSF 17/671 on out-of-court complaint resolution, specifying CSSF Regulation No 16-07: cssf.lu
• CSSF eDesk, LFR practical rules documentation referenced in section 4.3 of Circular CSSF 22/821: edesk.apps.cssf.lu
• CSSF Regulation No 16-07 of 26 October 2016 on out-of-court complaint resolution (Article 16): cssf.lu
• CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended (Article 49): cssf.lu
• Directive 2014/17/EU of 4 February 2014 on credit agreements for consumers relating to residential immovable property (Mortgage Credit Directive): EUR-Lex

Three decisions before the 31 March 2027 SAQ submission

The 2027 questionnaire leaves three calls to make before the authorised management signs. First, whether the complaints table goes in by the 1 March date under Circular 17/671 while Circular 17/671 awaits its update. Second, whether the client-asset module answers are in a form the REA can verify for its report two months later. Third, for Luxembourg branches of EU credit institutions, whether the CSSF confirms 31 March 2027 or the six-month date in point 29 of Circular 07/325, a question to put to the CSSF before the 31 December 2026 close.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.