CSSF SREP 2025 Supervisory Disclosure: The ICARA Bar for Investment Firms

ByOfficer

The CSSF SREP 2025 supervisory disclosure, published on 29 June 2026, is a short spreadsheet that describes, in the regulator’s own words, how the CSSF runs the supervisory review and evaluation process (SREP) for Luxembourg investment firms. It carries no firm names and no individual scores. For a Class 2 investment firm it is still unusually useful: it publishes the criteria the CSSF applies before deciding whether a firm needs capital above its Pillar 1 requirement.

The document sits under Article 57 of the Investment Firms Directive (Directive (EU) 2019/2034, the IFD), the transparency obligation that requires every EU competent authority to publish the general criteria and methodologies behind its SREP. It is the investment firm counterpart of the Article 143 disclosure that applies to banks, and a separate exercise from the ECB and CRD SREP that governs credit institutions. Read closely, it works as a checklist for aligning the next Internal Capital Adequacy and Risk Assessment (ICARA) with the CSSF’s supervisory method, not an ICARA filing template.

Related reading: ICAAP and ILAAP explained, the bank-side processes that the investment firm ICARA combines into a single exercise.

What the CSSF SREP 2025 supervisory disclosure sets out

The disclosure is Annex III of the CSSF’s investment firm supervisory disclosure package, which also covers the transposition of the IFD, the options and national discretions the CSSF has exercised, and the rules and guidance it applies. Article 57(1) of the IFD groups these into four categories: the texts of laws and guidance, the manner of exercising options and discretions, the general criteria and methodologies used in the SREP, and aggregated statistical data on implementation. The technical format is fixed by Commission Implementing Regulation (EU) 2022/389.

The file will not show your own result. A supervisory disclosure describes method across the whole population, so no firm’s score, letter or measure appears in it. The CSSF states that SREP outcomes are communicated to each firm by letter and that individual decisions stay confidential. Treat the disclosure as the marking scheme, then read your own SREP letter for the mark.

Every investment firm is in scope; proportionality only sets the intensity

The common misreading of an investment firm SREP is that a small or simple firm sits outside it. The CSSF closes that door in the first line of the template: the SREP applies to all investment firms, and proportionality cannot be used to exempt any firm from it. Proportionality instead drives how intense, how frequent and how broad each assessment is, through the SREP categories the CSSF assigns by size, risk profile and complexity.

Two levers decide where a firm lands. The first is the nature and scale of activity, so a simple firm receives a lighter assessment than a complex one. The second is history: the previous SREP score sets the supervisory engagement level for the next cycle. A weaker score last time means closer attention this time, so one clean cycle does not buy a permanent lighter-touch status.

How the CSSF scores the four SREP elements

The SREP under Article 36 of the IFD breaks into four elements: business model analysis, internal governance and firm-wide controls, risks to capital, and risks to liquidity. The CSSF scores each on a scale from 1, meaning low risk, to 4, meaning high risk, combining inherent risk with the strength of risk controls and using pre-defined key risk indicators and supervisory judgment to keep scores comparable across firms.

The inputs are worth mapping against your reporting cycle, because they are the evidence base for the score. The CSSF lists them: the closing documents, including the long-form report, compliance and risk management reports and internal audit findings; the periodic prudential reporting and key figures; for Class 2 firms, the ICARA report; on-site inspection results; and other information gathered off-site. A gap or a late filing in any of those streams is one of the panels the supervisor reads the firm through.

What the CSSF says it looks for in your ICARA

For a Class 2 firm, the ICARA is where the capital conversation happens. The internal assessment duty comes from Article 24 of the IFD, transposed in Luxembourg by Article 53-40 of the Law of 5 April 1993 on the financial sector, and it requires the firm to assess and maintain, on an ongoing basis, the amounts, types and distribution of internal capital and liquid assets adequate to the risks it runs and poses. The CSSF’s review focuses on that ICARA, tested for its soundness, effectiveness and “comprehensiveness”.

Reliability of the numbers is where firms lose ground. For investment firms, the applicable reference is the Joint EBA and ESMA Guidelines on common procedures and methodologies for the SREP under the IFD, read with the CSSF disclosure. The practical point for the ICARA is simpler: the firm must show how each material risk is identified, quantified or otherwise assessed, linked to internal capital or liquid assets, and reconciled with reporting, governance evidence and management action. If the CSSF cannot trace the method and evidence, the firm loses the chance to defend its own assessment and gives the supervisor more reason to rely on supervisory judgement or measures.

When the SREP turns into additional own funds

The output that matters for capital planning is the additional own funds requirement, which sits apart from the Pillar 1 own funds requirement. That Pillar 1 requirement is set by the Investment Firms Regulation (Regulation (EU) 2019/2033, the IFR) as the highest of the K-factor requirement, the fixed overheads requirement and the permanent minimum requirement under Article 11(1). The additional own funds requirement is imposed under Article 40 of the IFD, using the supervisory power in Article 39(2)(a), where the CSSF finds that material risks a firm runs or poses go beyond what the IFR requirement covers. This add-on is the investment firm analogue of a bank’s Pillar 2 requirement.

The composition rules are specific. Article 40(4) requires the requirement to be met at least three quarters with Tier 1 capital, and at least three quarters of that Tier 1 to be Common Equity Tier 1, and the same own funds cannot also cover the IFR Article 11 requirement. Above it sits Article 41 guidance on additional own funds, a cushion set so cyclical fluctuations do not push a firm through its requirements or threaten an orderly wind-down. Where liquidity is the concern, Article 42 lets the CSSF impose a specific liquidity requirement met with IFR-defined liquid assets. Small and non-interconnected firms are not automatically outside this: Article 40(7) of the IFD allows the CSSF to impose an additional own funds requirement on them case by case where justified.

What this signals for your next ICARA and capital plan

The CSSF has named the inputs it scores and the qualities it demands, so the strongest response is to build the next ICARA to that list: a quantification defensible risk by risk, a clean and on-time reporting record, and a capital plan that holds above the requirement, and any Article 41 guidance, through a downturn and an orderly exit. Keep the frameworks straight, because this is the IFD SREP for investment firms, distinct from the CRD and ECB SREP behind bank capital. A firm that reads across from the ECB SREP priorities as if they bound it picks up obligations it does not have. Checked against the EBA supervisory convergence work, this disclosure is the reference that applies.

Frequently Asked Questions

Does the CSSF SREP 2025 supervisory disclosure show my firm’s SREP score?

No. The disclosure under Article 57 of the IFD publishes population-level criteria and methodologies, not individual outcomes. Your score and any resulting measure are communicated privately, by letter, and individual decisions stay confidential.

Which investment firms have to prepare an ICARA?

The CSSF names the ICARA report specifically for Class 2 investment firms as a SREP input. Class 3 firms, small and non-interconnected under Article 12(1) of the IFR, face a lighter engagement. Article 40(7) of the IFD gives the CSSF the legal power to impose an additional own funds requirement on them case by case, though the CSSF’s current national-discretions disclosure records this power as not generally exercised.

What is the difference between the K-factor requirement and additional own funds?

The K-factor requirement, with the fixed overheads and permanent minimum requirements, forms the IFR Pillar 1 own funds requirement. The additional own funds requirement under Article 40 of the IFD is a firm-specific add-on for material risks the IFR requirement does not capture; Article 41 guidance is a separate cushion for cyclical stress and orderly wind-down.

How is an additional own funds requirement made up?

Article 40(4) of the IFD requires at least three quarters of the requirement to be met with Tier 1 capital, and at least three quarters of that Tier 1 to be Common Equity Tier 1. The same own funds cannot be counted twice against the IFR Article 11 requirement, so the add-on is capital held on top of Pillar 1.

Is this the same SREP the ECB runs on banks?

No. The ECB and CRD SREP applies to credit institutions and feeds a bank Pillar 2 requirement and guidance. This disclosure covers the IFD SREP under Article 36, run by the CSSF for investment firms, with additional own funds under Article 40 and guidance under Article 41.

Where is the IFD transposed in Luxembourg?

The IFD is transposed by the Law of 5 April 1993 on the financial sector. The Article 24 internal capital and liquid assets duty sits in Article 53-40 of that Law, and the SREP under Articles 36 and 37 sits in Articles 53-44 and 53-45.

Related Articles

Key Takeaways

  • The CSSF SREP 2025 supervisory disclosure, published 29 June 2026 under Article 57 of the IFD, sets out population-level methodology and carries no firm-specific score.
  • The SREP applies to every investment firm; proportionality sets the intensity, frequency and scope of the assessment, not an exemption.
  • The CSSF scores four SREP elements from 1 to 4, and a firm’s previous score drives the supervisory engagement level for the next cycle.
  • The ICARA is judged on soundness, effectiveness and “comprehensiveness”, and the CSSF cross-checks it against reporting, on-site and off-site inputs, so the numbers must be defensible risk by risk.
  • Additional own funds under Article 40 of the IFD cover risks the IFR requirement misses, met at least three quarters with Tier 1 and three quarters of that with CET1; Article 41 guidance and Article 42 liquidity sit above Pillar 1.

Sources and References

Turning a methodology file into a capital plan

The CSSF publishes this disclosure once a year and expects firms to work backward from it. A Class 2 investment firm that maps its ICARA, its periodic reporting and its governance evidence onto the CSSF’s stated criteria gives the supervisor fewer reasons to reach for a benchmark or an add-on when the next SREP cycle lands.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.

Similar Posts