CSSF Fit and Proper Declaration: Revised Forms Apply From 15 October

On 15 October 2026 the CSSF updated the four forms that Luxembourg credit institutions file when they appoint management body members and key function holders, and replaced its prudential appointment procedure with a version that applies from the same day. The CSSF fit and proper declaration set has two families: a KFH declaration that the forms themselves reserve for entities other than the large entities listed in Article 91a(5) of Directive 2013/36/EU (CRD), and an MB LSI declaration for management body applications at less significant institutions.

The update follows the Law of 5 May 2026, which transposed CRD VI into the Law of 5 April 1993 on the financial sector (LFS): the procedure cites LFS Articles 38-2bis and 38-2ter, which that law inserted. The procedure decides which form a file uses, which channel it travels through, which authority decides and how much notice the supervisor gets. It also attaches two consequences to file quality: a file that does not meet its requirements is treated as incomplete and may be rejected (point 16), and files still being processed on 15 October 2026 must be completed to meet the new procedure if the competent authority asks (Section G).

The operative dates:

• 25 February 2026: EBA and ESMA open consultation on revised joint suitability Guidelines and a draft RTS on suitability documentation.
• 5 May 2026: Law transposing Directive (EU) 2024/1619 (CRD VI), published in Memorial A No 227 on 6 May 2026. Its Article 24 inserts LFS Articles 38-2bis and 38-2ter.
• 15 October 2026: revised CSSF procedure applies; the KFH and MB LSI declarations are updated on the CSSF website.
• From 15 October 2026: any file in progress may have to be topped up to meet the new procedure, on request.

Related reading: CRD VI Luxembourg Transposition Law 2026

What the updated CSSF fit and proper declaration set contains

Five documents moved together. The CSSF page for the KFH credit institution’s declaration shows it was first published on 5 January 2021 and updated on 15 October 2026; the MB LSI pair dates from 6 January 2021 and carries the same update date. The forms are Word files in English. The procedure is a French-language PDF whose cover states that it applies from 15 October 2026.

A version-labelling point needs care. The CSSF’s English page for the procedure still labels it “being updated”, while the only file attached is the French PDF that already states its own application date. The PDF is the operative text. Footnotes 5 and 6 of the procedure add that the declarations may change over time and that institutions should always download the latest version from the CSSF website, so a template saved to a shared drive before 15 October 2026 belongs in the archive.

The legal basis: Article 91a CRD and LFS Articles 7, 38-2bis and 38-2ter

CRD VI inserted Article 91a into the CRD. It gives the institution the primary responsibility for ensuring that key function holders are of sufficiently good repute, act with honesty and integrity and have sufficient knowledge, skills and experience, and it requires the institution to assess them before they take up the position and periodically. Article 91a(5) then requires competent authorities to assess the heads of internal control functions and the chief financial officer appointed in, at least, a defined set of large entities.

Luxembourg carried this into the LFS through the Law of 5 May 2026, covered in our guide to Luxembourg’s CRD VI transposition law. Three provisions matter for appointment files:

• Article 1 of the 2026 law adds several definitions to the LFS, including these two. The chief financial officer is the person with overall responsibility for managing financial resources, financial planning and financial reporting. Key function holders are persons with significant influence over the direction of a CRR institution who are not members of the management body, including the heads of internal control functions and the CFO where they sit outside the management body.
• Article 6 amends Article 7 LFS. The new paragraph 2bis requires a credit institution to send the CSSF its suitability request as soon as there is a clear intention to appoint a management body member, and at the latest 30 working days before the planned start date. Paragraph 2ter lists what goes with it: a suitability questionnaire provided by the CSSF, a CV, the internal suitability assessment, criminal records as soon as available, any other document the CSSF lists, and the appointment date and planned start date.
• Article 24 inserts Article 38-2bis (internal suitability assessment of the management body) and Article 38-2ter (suitability of key function holders). Under Article 38-2ter(4), for the entities referred to in Article 91a(5) CRD, the CSSF verifies that the heads of internal control functions and the CFO meet the criteria at all times. Article 38-2ter(5) gives it the power, in an ex ante assessment, to stop those persons taking up the role or to remove them, and in an ex post assessment to remove them or require the institution to do so.

None of Articles 1, 6 or 24 appears in the list of provisions that Article 94 of the 2026 law defers to 11 January 2027.

A reading that the statute closes off: a clean criminal record settles reputation. Article 38-2ter(1) states that the absence of a criminal conviction or of ongoing prosecution is not in itself sufficient to meet the requirement of good repute, honesty and integrity, and the same sentence now appears in Article 7(1) for management body members. The forms reflect it. The KFH appointee declaration asks nine reputation questions, covering settled proceedings, credit bureau records, refused or withdrawn licences, past investigations and involvement in situations that raised money laundering or terrorist financing concerns.

Which institutions count as large, and why four size labels matter

The procedure defines a “large institution” by pointing at the entities listed in Article 91a(5) CRD (point 6). That list covers EU parent and Member State parent institutions that qualify as large institutions (Member State parents affiliated to a central body are excluded), central bodies that are large or supervise large affiliates, stand-alone large institutions, large subsidiaries under Article 4(1)(147) CRR, and parent financial holding companies and mixed financial holding companies with large institutions in their group, except those falling under Article 21a(4) CRD. Article 4(1)(146) CRR treats an institution as large if it is a G-SII, an O-SII, one of the three largest institutions in its Member State by total assets, or holds total assets of EUR 30 billion or more on an individual or consolidated basis.

That label sits alongside three others in the same procedure, and each one switches on a different obligation:

The labels overlap without coinciding. An LSI can be large, and a large institution need not be an SI. The procedure addresses that case directly: institutions considered large but that are LSIs follow the route in point C.2.II, which is the KFH declaration (point 26).

The KFH forms, however, carry a header limiting them to entities other than the large entities listed in Article 91a(5). Point 24 adds that KFH appointments at large institutions are subject to approval. The CSSF text does not reconcile the form header with the routing sentence. The reading set out here is that a large LSI uses the KFH declaration as the vehicle for a CSSF approval, but that is an interpretation, and a large LSI with a pending CRO or CFO appointment has good reason to confirm the expected form with its CSSF contact before filing.

Key function holders: approval at large institutions, notification elsewhere

The procedure’s scope clause separates two populations. Point 1(c) covers approval requests and departure notifications for the CRO, CCO and CIA and for the CFO at large institutions. Point 1(d) covers notifications of appointments and departures of the CRO, CCO and CIA at all other institutions. Point 25 then states that at institutions other than large ones, those appointments do not require CSSF approval where the person is not part of the management body in its management function.

The CFO drops out of the second population. Point 1(d) and point 25 name only the CRO, CCO and CIA, and the function boxes on the KFH credit institution’s declaration are Chief Risk Officer, Chief Compliance Officer, Chief Internal Auditor and “Other”. The procedure is silent on whether a non-large institution files anything for a CFO who sits outside the management body; it does not ask for a KFH notification in that case.

Notification without approval still carries the full assessment burden. Point 23 requires the institution to assess knowledge, skills, experience and reputation before the person takes up the role, and Article 38-2ter(1) LFS puts the same duty in statute. The institution’s signature block on the KFH declaration confirms that the appointment was approved by the board of directors or, where appropriate, the nomination committee, that it complies with the institution’s own appointment and succession policy for key function holders and its conflicts of interest policy under Circular CSSF 12/552, and that an assessment under EBA/GL/2021/06 preceded it. A notification that reaches the CSSF before that internal assessment is documented contradicts the declaration it is filed with.

Point 25’s qualifier also matters. A CRO or CCO who is a member of the management body in its management function falls outside that carve-out, so the procedure reads as sending that appointment down the management body route in section C.1, with the approval that goes with it. For SIs the authority changes entirely: KFH files go to the ECB through the Joint Supervisory Team (point 35), and large SIs complete the SI declaration in the SSM Portal (point 26).

Inside the KFH declaration: what each signatory commits to

The institution’s part opens with identification: legal name, CSSF identification code, LEI, a contact person and the appointee’s name. It asks whether the appointee replaces someone, and if so who and why. The experience block rates the appointee on a four-point scale (high, medium-high, medium-low, low) in five areas: banking and financial markets, legal requirements and regulatory framework, knowledge of the function, climate-related and environmental risks, and prevention of money laundering and terrorist financing. Where experience is limited, the institution lists compensating factors and any training planned before appointment or within the first year, with provider and dates.

The annex checklist is identical on the KFH and MB LSI institution forms:

• a detailed professional CV covering the full academic and professional history;
• a copy of the appointee’s ID card or passport;
• the Luxembourg criminal record extract (bulletin no. 3);
• criminal records from every country of residence in the last five years and from any country that issued an ID or passport, if different from Luxembourg;
• the board minutes on the appointment.

The appointee’s part covers personal data, including the Luxembourg national identification number or, failing that, the identification number from the country of residence, followed by a table of previous supervisory assessments with the authority, function, dates and conclusion, and an explanation of any non-approval or objection. The KFH appointee form has no conflicts of interest or time commitment section. On the KFH side, time commitment appears only in the institution’s part, and conflicts appear only as the institution’s confirmation that the appointment respects its conflicts policy; the MB LSI forms cover both topics in both parts.

The time commitment block is where a combined role gets tested. If the function is not a permanent, full-time role, the institution describes the combined responsibilities and attaches its internal analysis justifying the combined or part-time arrangement, together with the board’s approval of that analysis. Article 53-14(3) LFS, as rewritten by Article 51 of the 2026 law, sets the outer boundary. Risk management or compliance can sit with another senior staff member when the institution’s nature, scale and complexity do not justify a dedicated person, provided there is no conflict of interest and the person meets the suitability criteria and has enough time for both. Internal audit cannot be combined with any other business line or control function, and a board-approved analysis does not make a part-time CIA who also runs compliance compatible with that rule.

Circular CSSF 12/552 adds a procedural condition in point 124. A combined risk management and compliance function, or a post with combined responsibility for both, needs the prior approval of the competent authority. An institution that wants to create such a function, give both responsibilities to one person or combine either responsibility with other tasks must submit a request to the competent authority. The request contains a description of the combined role, the analysis justifying it and the supervisory body’s decision approving that analysis, which mirror the three items the KFH form’s time commitment block asks for.

Inside the MB LSI declaration: collective suitability and conflicts

Both MB LSI forms state that they are based on an ECB template for SIs, modified under proportionality criteria for LSIs supervised by the CSSF, and that financial holding companies and mixed financial holding companies under CSSF consolidated supervision use the same form.

The institution’s part starts with governance structure. It asks whether the board is two-tier (supervisory board and management board) or one-tier (board of directors), the appointee’s seat (chair, supervisory function member, management function member), any additional function (CEO, CCO, CRO, CFO or other), and the nature of the mandate: executive, non-executive, staff representative, shareholder or group representative, independent director. The planned start date of the term goes in the same block.

The experience assessment uses a three-point scale (high, medium, low) with a justification column, across eleven areas, including strategic planning, risk management, compliance and internal audit, accounting and auditing, governance effectiveness, interpreting financial information, ICT risk and business-model-specific competences. Copying a KFH rating such as “medium-high” into an MB file produces a value the MB form does not offer.

The collective suitability block asks how the appointee complements the board, with reference to the latest self-assessment of collective suitability, whether the institution considers the body collectively suitable, and which weaknesses and remedies it has identified. It requires a composition table (members at a stated date, recent changes, upcoming members subject to supervisory approval) and a statement on whether the appointment complies with the internal diversity policy.

The appointee’s conflicts section has nine questions with stated de minimis lines:

• shareholdings below 1% or other investments of equivalent value need not be disclosed under the financial interest question;
• performing loans negotiated at arm’s length under EUR 200,000 and performing private mortgages negotiated at arm’s length would generally not be considered substantial financial obligations;
• professional or commercial relationships and positions with high political influence look back over the past two years.

The appointee also lists every other mandate with hours per week and days per year committed outside the function, answers whether an insurance policy covers their professional activity, and discloses whether the management body has deliberated on any aspect of their reputation.

Timing and channels: 30 working days for board seats, no fixed clock for KFH notices

The 30-day figure counts working days, roughly six calendar weeks. It is a floor for submission, and the decision clock is separate: point 33 says approval decisions are communicated within three months of receipt of a file the competent authority considers complete, and where the authority adds an interview, the three months only start once the interview is done. The CSSF may require a prospective member not to take up the role until the required information has been supplied (point 32, mirroring Article 7(2ter) LFS). A refusal or withdrawal comes with the facts and legal grounds relied on, and the person has the right to be heard before the final decision (point 34).

Mechanics are fixed too. Postal applications are not accepted, the cover letter must confirm that the annexes are true copies of the originals, and the SSM Portal is used exclusively for new fit and proper applications for SI management body members, executive and non-executive (point 31). By filing, the institution and the appointee accept that the CSSF and the ECB process the file under their own procedures (point 37).

Departures, internal moves and reassessment triggers

The procedure’s definition of departure is broad. Point 4 includes resignation, dismissal, termination by mutual agreement and internal transfer, and footnote 1 defines internal transfer as a change of function within the institution. A CRO who moves to head of treasury is a departure from the CRO role for this procedure.

The notice standard depends on who initiated the exit:

• Resignation or mutual termination: notify the competent authority as soon as possible, with all reasons given by the person and, where relevant, a copy of the resignation letter or termination agreement (point 27).
• Dismissal or transfer: inform the authority immediately with a complete and detailed justification, omitting no argument that influenced the decision or was put to the person (point 28).
• Dismissal or transfer of certain key function holders: a prior written decision or agreement of the supervisory body must be attached to the notification (point 28).

The last rule tracks the statute. Article 53-14(3) LFS now states that heads of internal control functions cannot be removed without the prior agreement of the management body in its supervisory function. Every departure notice must also say whether, and by when, the institution plans to replace the person (point 29).

Ongoing duties run alongside. A significant change to a board member’s functions during the mandate or at renewal requires a modification file with everything that changed and the institution’s reassessment; a switch between executive and non-executive mandate is named as one such change (point 18). Point 14 lists the events that should trigger a formal reassessment, including doubts about competence or reputation, a review of governance arrangements, significant reputational impact, and reasonable grounds to suspect money laundering or terrorist financing in connection with the institution. Point 19 requires the institution to tell the competent authority promptly about any information that could call a person’s suitability into question, any significant gap in the board’s collective composition, and the planned remedy and timeline.

Section F: diversity targets, annual notices and mandate limits

Section F applies to the narrower population of CRD institutions of significant importance and institutions of significant importance in Luxembourg. Citing paragraph 103 of EBA/GL/2021/06, the procedure requires the first group to set a quantitative target for the under-represented gender on the management body, with a timeframe and the means of reaching it; the target is set for the body as a whole and may be split between management and supervisory functions when the body is large enough (point 38). The annual review of board composition must document whether the targets were met and, if not, why, what will be done and by when, and the documents must be produced on the first request of the competent authority (point 39). Citing paragraph 160 of the same Guidelines, these institutions inform the competent authorities at least once a year of any reassessments of collective suitability (point 40).

For institutions of significant importance in Luxembourg, board members other than representatives of the Luxembourg State must respect the limits on the number and type of mandates in Article 38-2(2) LFS. Point 41 frames that formal cap as complementary to the general availability requirement in Article 38-2(1)(b), so staying inside the numeric limit does not on its own settle availability.

The procedure also marks its own limits. Point 11 states that neither it nor Circular CSSF 12/552 is an exhaustive list of suitability requirements, and that institutions apply the whole of EBA/GL/2021/06 with proportionality where relevant. Point 13 removes proportionality from two areas altogether: professional reputation, honesty and integrity, and the independence of mind of management body members. For the wider European picture, our coverage of the ESMA and EBA suitability assessment guidelines tracks the 2026 revision.

Frequently Asked Questions

Our bank is an LSI but its total assets exceed EUR 30 billion. Which KFH route applies?

The procedure says institutions considered large but that are LSIs follow point C.2.II, the KFH declaration, while point 24 makes KFH appointments at large institutions subject to approval by the CSSF or the ECB. The KFH form header excludes large entities. Until the CSSF aligns the two texts, the safer course is to confirm with the CSSF which form it expects and to plan for an approval decision. The three-month decision timeline in point 33 sits in the management body section; the procedure states no separate timeline for KFH approvals.

Most of our board is being replaced at once after a change of control. Who assesses the incoming members?

Article 38-2bis(1) LFS allows the internal assessment to take place after the new members take office where the majority of the board is replaced at the same time and the outgoing members would otherwise assess the incoming ones. Article 7(2ter) drops the internal assessment from the required attachments in that case, and Article 7(2quater) requires the institution to inform the CSSF that those conditions exist when it submits the suitability request. Point 16 of the procedure adds that where appointments are made within a qualifying holding procedure, the file content and steps may differ from the ad hoc route.

Does a director’s mandate renewal need a new MB LSI declaration?

Not automatically. Under Article 7(2quinquies) LFS the CSSF is not required to reassess at renewal unless relevant information has changed in a way that could affect suitability. The institution’s own duty is wider: point 14 requires a reassessment at renewal if the role’s requirements changed or the member moves to a different position, and point 18 requires a modification file where functions change significantly, including a move between executive and non-executive mandates.

Do the persons running a Luxembourg branch of a non-EU bank fall under this procedure?

Yes. Point 1(b) brings approval requests and departure notifications for the persons who effectively direct Luxembourg branches of third-country credit institutions into scope, and point 2 includes those branches in the definition of institution. The separate CRD VI authorisation regime for these branches is covered in our article on third-country branch authorisation under CRD6.

Can a newly appointed CCO at a non-large LSI start before the CSSF reacts to the notification?

The procedure frames these appointments as notifications that do not require CSSF approval (point 25), and it sets no waiting period. A combined role is the exception: where the CCO will also hold the risk management responsibility, or will combine compliance with other tasks, point 124 of Circular CSSF 12/552 requires a request to the competent authority, and a combined risk management and compliance post needs its prior approval. The internal assessment must be finished before the person takes up the role (point 23), and the notification is due without delay (point 35). The CSSF keeps its general power under point 36 to require remediation where it sees weaknesses in governance or internal control arrangements, by reference to Article 53-1 LFS.

Will the forms change again when the EBA and ESMA finalise the revised suitability Guidelines?

Possibly. The EBA’s 25 February 2026 press release says the revised Guidelines will repeal the 2021 Guidelines once they enter into force, and that a companion draft RTS under Article 91(10) CRD would harmonise the minimum content of the suitability questionnaire, CV and internal suitability assessment for large institutions. The procedure and forms published on 15 October 2026 still cite EBA/GL/2021/06, and footnotes 5 and 6 of the procedure already warn that the declarations may change over time.

Is the CSSF appointment file the same thing as naming function holders in Table B 4.6?

They are separate filings. The fit and proper file supports an approval or notification for a named person; Table B 4.6 is a CSSF reporting table identifying who is responsible for specific functions. Our guide to CSSF Table B 4.6 reporting covers that return.

Related Articles

• CRD VI Luxembourg Transposition Law 2026: how the Law of 5 May 2026 rewrote the Law of 5 April 1993 for CRD VI, from supervisory powers to third-country branches.
• ESMA/EBA Suitability Assessment Guidelines: What the 2026 Consultation Means for Luxembourg Boards: the proposed revision of EBA/GL/2021/06 and the companion RTS on suitability documentation.
• CSSF Table B 4.6 Reporting: The 22 Named Functions Due by 20 January: the CSSF table naming persons responsible for specific functions at Luxembourg banks.
• CRD6 Third-Country Branch Authorisation: The 11 January 2027 Deadline: authorisation requirements and EBA guidance for branches of non-EU banks.
• CSSF Material Operations Notification: Approval Triggers Under CRD VI: another CRD VI-driven CSSF approval route for Luxembourg credit institutions.

Key Takeaways

• Retire locally stored KFH and MB LSI templates dated before 15 October 2026 and pull the current versions from the CSSF website for every new file.
• Classify the institution under all four labels (large, SI, CRD institution of significant importance, significant importance in Luxembourg) before the first appointment file; each one moves a different obligation.
• For board seats, back-plan the submission date from the planned start using 30 working days, then allow up to three months from file completeness for the decision.
• Large LSIs appointing a CRO, CCO, CIA or CFO should resolve the form question with the CSSF before filing, given the gap between point 26 and the KFH form header.
• Route any CRO-to-other-role move through the departure procedure: an internal transfer is a departure, and for certain key function holders it needs a prior written decision or agreement of the supervisory body (point 28).
• Before sending a KFH notification, confirm the board or nomination committee approval and the EBA/GL/2021/06 assessment exist in writing; the institution’s declaration certifies both.
• Test any part-time or combined control role against Article 53-14(3) LFS before writing the internal analysis the KFH form asks for, and submit the request required by point 124 of Circular CSSF 12/552 before combining risk management and compliance or combining either responsibility with other tasks, since a combined risk management and compliance post needs the competent authority’s prior approval; internal audit cannot be combined.

Sources and References

• CSSF, Fit and Proper Declaration (KFH), credit institution’s declaration, updated 15 October 2026: cssf.lu
• CSSF, Fit and Proper Declaration (KFH), appointee’s declaration, updated 15 October 2026: cssf.lu
• CSSF, Fit and Proper Declaration (MB LSI), credit institution’s declaration, updated 15 October 2026: cssf.lu
• CSSF, Fit and Proper Declaration (MB LSI), appointee’s declaration, updated 15 October 2026: cssf.lu
• CSSF, Prudential procedure for the appointment of members of the management body and key function holders in credit institutions, applicable from 15 October 2026 (French): CSSF document page and PDF
• Law of 5 May 2026 transposing Directive (EU) 2024/1619 and Directive (EU) 2024/2994 and amending the Law of 5 April 1993 on the financial sector, Memorial A No 227 of 6 May 2026 (Articles 1, 6, 24, 51 and 94): Legilux
• Directive (EU) 2024/1619 (CRD VI), including new Article 91a of Directive 2013/36/EU: EUR-Lex
• Regulation (EU) No 575/2013 (CRR), consolidated text, Article 4(1), points (146) and (147): EUR-Lex
• Circular CSSF 12/552 on central administration, internal governance and risk management, as amended: cssf.lu
• Joint ESMA and EBA Guidelines on the assessment of the suitability of members of the management body and key function holders (EBA/GL/2021/06), final report of 2 July 2021: EBA
• EBA press release, The EBA and ESMA launch a consultation on the revised suitability assessment framework for banks and investment firms, 25 February 2026: EBA

Appointment files in flight on 15 October 2026

Section G is the provision with an immediate effect. The new procedure cancels and replaces the previous version from 15 October 2026, and any file still being processed on that date must be completed, at the competent authority’s request, so that it meets the new requirements. For an LSI with a board candidate or a CRO notification already lodged, that means checking the submitted forms against the current CSSF versions, in particular the institution’s signature block, the annex checklist and, for board seats, the collective suitability block, and having the missing pieces ready before the CSSF asks for them.

The next appointment after that starts with the current form downloaded from the CSSF website. For a management body appointment, the suitability request goes in as soon as there is a clear intention to appoint and at the latest 30 working days before the planned start (Article 7(2bis) LFS). For a key function holder notification, the procedure sets no day count and asks for the notification without delay (point 35).

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.