CSSF MiFID II Notification Templates: The 13 July 2026 Filing Set

On 13 July 2026 the CSSF published five standardised XLSX notification forms on its Markets in Financial Instruments (MiFID II/MiFIR) page, covering algorithmic trading, direct electronic access, systematic internaliser status, designated publishing entity status and commodity derivatives. For algorithmic-trading and DEA notifications, the workbook replaces the Q&A-table format referenced in the CSSF’s communication of 26 June 2024. The SI, DPE and commodity-derivative workbooks standardise separate notification workflows.

These notifications sit alongside, but are distinct from, MiFIR transaction reporting. Article 17(2) requires notification when a firm engages in algorithmic trading, rather than a new notification for every individual algorithm. Article 17(5) applies when a firm provides direct electronic access. Systematic-internaliser and DPE notifications follow their own status and change triggers. The CSSF’s former Q&A-table procedure applied specifically to algorithmic-trading and DEA notifications.

The set also captures two items reshaped by the 2024 MiFID II and MiFIR review package. Directive (EU) 2024/790 amended the MiFID II definition of systematic internaliser. Regulation (EU) 2024/791 amended the MiFIR SI-notification framework and introduced the designated-publishing-entity regime in Article 21a.

Related reading: our MiFIR transaction reporting guide covers the reporting obligation these operational notifications sit alongside.

The CSSF MiFID II notification templates at a glance

The CSSF page now lists five downloadable forms, each in XLSX format and each tagged to the MiFID II/MiFIR topic and to credit institutions and investment firms. The algorithmic trading notification template and the DEA notification template are the smallest files. The systematic internaliser template, the designated publishing entity template, and the commodity derivative template carry more fields. The publication date on each document page is 13 July 2026.

Before this, the CSSF handled the algorithmic trading and direct electronic access notifications through a communication issued on 26 June 2024. That communication told firms to notify by email to mifid2@cssf.lu, using the table set out in the CSSF MiFID II/MiFIR Q and A at section 5.1. The legal references the communication cited were Directive 2014/65/EU, Articles 4(1)(39), 4(1)(41) and 17, the Luxembourg Law of 30 May 2018 on markets in financial instruments, and Commission Delegated Regulation (EU) 2017/565. The move to standardised XLSX forms formalises that content into a filed artifact.

One point of confusion is worth clearing early. A CSSF template is a filing convenience, and it creates no new obligation. The obligation to notify comes from MiFID II and MiFIR and from their Luxembourg transposition; the template only fixes how a firm expresses it. A firm that was already outside scope on 12 July 2026 stays outside scope on 13 July 2026.

The dates that shape these filings

The calendar behind the templates spans the MiFIR review and the CSSF’s own steps. The operative dates are:

• 28 March 2024: Regulation (EU) 2024/791, the MiFIR review, entered into force.
• 26 June 2024: the CSSF communication on algorithmic trading and DEA notification requirements, directing firms to email mifid2@cssf.lu using the Q and A table.
• 29 September 2024: the date by which ESMA had to establish and publish its register of designated publishing entities under Article 21a(4) MiFIR.
• 10 April 2025: ESMA published its Final Report on the systematic internaliser notification, the volume cap and transparency calculations, and circuit breakers, extending the SI notification period to 20 calendar days.
• 13 July 2026: the CSSF published the five XLSX notification templates.

None of these is a periodic remittance date. They are event-driven triggers: a firm files when the underlying fact occurs or changes, not on a fixed quarterly rhythm.

Algorithmic trading: the Article 17(2) notification

Article 17 of MiFID II governs firms that engage in algorithmic trading, and paragraph 2 carries the notification. An investment firm that engages in algorithmic trading in a Member State notifies this to the competent authorities of its home Member State and of the trading venue at which it engages in algorithmic trading as a member or participant. For a Luxembourg-authorised firm, the home authority is the CSSF; where the venue sits in another Member State, that venue’s authority is notified as well.

The scope of the trigger is wider than many desks assume. Algorithmic trading covers any trading in financial instruments where a computer algorithm automatically determines individual order parameters such as whether to initiate the order, the timing, the price, the quantity, or how to manage the order after submission, with limited or no human intervention. High-frequency trading is only a subset of this. A firm running an execution algorithm on client flow can be in scope with no high-frequency element at all.

The notification opens the relationship with the regulator, and the obligation continues after it. Under Article 17(2), the home competent authority may require the firm to provide, on a regular or ad hoc basis, a description of the nature of its algorithmic trading strategies, the trading parameters or limits the system is subject to, the key compliance and risk controls in place, and details of the testing of its systems. The organisational detail behind those controls sits in Commission Delegated Regulation (EU) 2017/589, known as RTS 6, which sets out the organisational requirements for firms engaged in algorithmic trading, including a dedicated chapter on direct electronic access. RTS 6 also requires an annual self-assessment and validation, so a firm that has notified should expect the CSSF to be able to ask for that report.

Where a firm’s algorithmic trading pursues a market-making strategy, Article 17(3) adds obligations that the notification does not discharge on its own: carrying out that market making continuously during a specified proportion of the venue’s trading hours, entering into a binding written agreement with the trading venue, and running systems and controls to meet those commitments. Filing the algorithmic trading notification does not signal a market-making strategy; that is a separate arrangement with the venue.

Direct electronic access: notifying under Article 17(5)

Direct electronic access is the arrangement where a member, participant or client of a trading venue permits another person to use its trading code to transmit orders electronically and directly to the venue. Article 17(5) requires an investment firm that provides direct electronic access to a trading venue to notify the competent authorities of its home Member State and of the trading venue accordingly. The CSSF’s DEA notification template captures that filing for Luxembourg firms and for firms providing DEA to a Luxembourg venue.

Article 17(5) puts most of its weight on the responsibility that comes attached to the access, over and above the notification. A DEA provider stays responsible for ensuring that clients using the service comply with MiFID II and the rules of the trading venue. It monitors the client’s transactions to identify rule infringements, disorderly trading conditions, or conduct that may involve market abuse reportable to the competent authority. It maintains a binding written agreement with the client that sets out the essential rights and obligations, and under that agreement the firm retains its own responsibility. The directive is explicit that direct electronic access provided without the required pre-set trading and credit thresholds, monitoring, and risk controls is prohibited, so a firm cannot treat the notification as the whole of its compliance step.

Article 17(5) does not prescribe a minimum number of DEA clients. Where an in-scope investment firm provides direct electronic access to a trading venue, it must notify the relevant competent authorities and have the required client assessment, pre-set thresholds, monitoring, risk controls and written agreement in place before providing the service.

The systematic internaliser template and what the MiFIR review changed

The systematic internaliser form is where a firm most needs to re-check the legal basis before reusing an old process. For Luxembourg filings, the CSSF’s 2026 form identifies Article 1(27) of the Law of 30 May 2018 on markets in financial instruments as the local definition. That provision reflects the amendment to MiFID II Article 4(1)(20) made by Directive (EU) 2024/790: an investment firm is a systematic internaliser where, on an organised, frequent and systematic basis, it deals on own account in equity instruments by executing client orders outside a regulated market, an MTF or an OTF, without operating a multilateral system, or where it opts in to systematic internaliser status.

The quantitative determination used under the earlier regime was replaced by a qualitative assessment for equity instruments, while firms may opt in for non-equity instruments. Regulation (EU) 2024/791 separately amended MiFIR Article 15 to require notification to the competent authority and to mandate an implementing technical standard on the notification’s content and format.

ESMA’s Final Report of 10 April 2025 contains a draft implementing technical standard proposing that firms notify the competent authority as soon as possible and no later than 20 calendar days after the relevant change. Publication of the Final Report did not make that proposed deadline binding. The CSSF’s 13 July 2026 systematic-internaliser workbook provides the local notification form but does not itself state a 20-calendar-day deadline.

The second change is easy to miss because it moves an obligation out of the systematic internaliser regime altogether, and it is the subject of the next section.

Designated publishing entity: the new post-trade reporting role

Before the MiFIR review, whether a firm was a systematic internaliser decided who made an over-the-counter trade public. Regulation (EU) 2024/791 broke that link by creating the designated publishing entity, or DPE, in Article 21a of MiFIR. Under Article 21a(1), competent authorities grant investment firms designated publishing entity status for specific classes of financial instrument on the firm’s own request, and the competent authority communicates the request to ESMA. ESMA maintains a public register of designated publishing entities, which it had to establish by 29 September 2024.

The responsibility a DPE takes on is the post-trade publication itself. Under Article 21a(2), where only one party to a transaction is a designated publishing entity, that entity is responsible for making the transaction public through an approved publication arrangement. Article 21a(3) sets the fallback for transactions where neither party or both parties are designated publishing entities: the seller is responsible for publication. Our coverage of MiFIR post-trade transparency and the bond consolidated tape traces where those prints ultimately flow.

The practical confusion the CSSF DPE template resolves is the assumption that a firm has to become a systematic internaliser to carry the reporting burden. It does not. A firm can request designated publishing entity status for the instrument classes it trades and take on OTC post-trade publication without assuming systematic internaliser status or its quoting obligations. The two forms sit next to each other on the CSSF page precisely because a firm might file one, the other, both, or neither. For the wider derivatives reporting picture, see the work on the ESMA OTC derivatives consolidated tape provider.

The commodity derivative notification and position limits

The fifth form, the notification of a commodity derivative, is tagged by the CSSF to position limits, which places it in the MiFID II commodity derivative position-limits framework under Article 57, alongside but separate from the Article 17 notifications. It is the outlier in the set: same publication date, same entity scope, but a different obligation.

Because its trigger and content differ from the trading-arrangement notifications, a firm should treat it as a separate workflow with its own owner. We cover the specifics of that filing in the CSSF commodity derivative notification guide, and this article keeps its focus on the algorithmic trading, DEA, systematic internaliser and DPE forms.

How to file with the CSSF

The algorithmic-trading, DEA, systematic-internaliser and DPE workbooks each instruct the filer to save the completed form as an XLSX file named with the institution’s LEI, attach a declaration signed by a legal representative, and send both documents by email to mifid2@cssf.lu. The CSSF’s communication of 26 June 2024 gives the same email channel for algorithmic-trading and DEA notifications.

When a notification like this reaches a reporting desk, the friction is seldom the legal test. It tends to be operational: which mailbox, which form version, which fields, and the standardised XLSX set is meant to remove exactly that friction. Two habits keep the filing clean. First, match the template to the trigger and not to whichever desk happens to own the mailbox, because the same firm may need the algorithmic trading form, the DEA form, the systematic internaliser form and the DPE form for different reasons. Second, keep the supporting record ready. Article 17(2) obliges an algorithmic trading firm to keep records sufficient for the competent authority to monitor compliance, and the authority can ask for the strategy description, parameters, controls, and testing detail at any point after the notification.

For firms that also file cross-border, the direction of the notification follows the venue. A Luxembourg firm trading on a foreign venue notifies the CSSF as home authority and the venue’s authority as well; an EU firm trading on a Luxembourg venue notifies its own home authority and the CSSF as the venue authority. The CSSF forms serve both directions, which is why their entity scope names credit institutions and investment firms without limiting them to Luxembourg-only arrangements.

Four ways these notifications go wrong

The first error is scope creep in the wrong direction: treating algorithmic trading as a high-frequency-only concern. The Article 17 definition reaches any automated determination of order parameters with limited human intervention, so an execution algorithm on client orders can trigger the notification with no high-frequency element.

The second is stale systematic internaliser logic. A firm that still runs threshold arithmetic to decide systematic internaliser status is applying a determination the MiFIR review removed; the current test is qualitative or opt-in under Article 4(1)(20).

The third is conflating the systematic internaliser and designated publishing entity roles. Post-trade publication of OTC trades now follows designated publishing entity status under Article 21a, so a firm can carry the publication duty without being a systematic internaliser, and being a systematic internaliser no longer decides who prints the trade.

The fourth is filing the form and stopping there. For direct electronic access, the pre-trade controls, monitoring and written client agreement are conditions of providing the service at all, and access without them is prohibited under Article 17(5). The notification records the arrangement; it does not substitute for the controls.

Frequently Asked Questions

Do we notify the CSSF once, or every time we deploy a new trading algorithm?

Article 17(2) frames the notification around the fact of engaging in algorithmic trading. A firm notifies the CSSF that it engages in algorithmic trading and, where relevant, the trading-venue authority as well. The per-algorithm detail sits in the description the competent authority can request afterwards, together with the records and the RTS 6 self-assessment. The article does not ask for a fresh notification for every model.

We provide direct electronic access to a single client on a foreign venue. Do we still file with the CSSF?

Yes, where you are the Luxembourg-authorised provider. Article 17(5) requires notification to the home authority, the CSSF, and to the authority of the trading venue. The number of clients does not change the trigger; providing the access does. The monitoring duty and the binding written agreement apply to that single-client arrangement in the same way they would to many.

Is the systematic internaliser notification the same test we used before 2024?

No. The MiFIR review removed the quantitative determination that turned on measured over-the-counter thresholds. Under Article 4(1)(20) of MiFID II, systematic internaliser status now rests on the qualitative organised, frequent and systematic basis test for equity instruments, or on a voluntary opt-in. A firm reusing the old threshold calculation is assessing status against a framework that no longer applies.

We are a designated publishing entity. Does that make us a systematic internaliser?

No. Regulation (EU) 2024/791 separated the two. Designated publishing entity status under Article 21a of MiFIR is a voluntary status granted on request for specific instrument classes, and it carries the responsibility to make over-the-counter trades public through an approved publication arrangement. It does not bring systematic internaliser status or the systematic internaliser quoting obligations with it.

Which channel do we use to submit the new XLSX templates?

The algorithmic-trading, DEA, systematic-internaliser and DPE workbooks instruct the filer to email the completed XLSX form and a declaration signed by a legal representative to mifid2@cssf.lu. The XLSX filename must use the institution’s LEI.

Does an EU firm trading on a Luxembourg venue notify the CSSF or its home regulator?

Both, in their respective roles. For algorithmic trading and direct electronic access, the notification goes to the firm’s home authority and to the authority of the trading venue. An EU firm trading on a Luxembourg venue therefore notifies its home authority and the CSSF as the venue authority, which is why the CSSF forms name credit institutions and investment firms generally.

What records does an algorithmic trading firm keep after notifying?

Article 17(2) requires records sufficient to let the competent authority monitor compliance with MiFID II, and the CSSF may ask for a description of the algorithmic trading strategies, the trading parameters or limits, the key compliance and risk controls, and details of system testing. RTS 6, Commission Delegated Regulation (EU) 2017/589, adds the annual self-assessment and validation report, which a firm should keep ready to produce.

Related Articles

• MiFIR Transaction Reporting – the transaction reporting obligation that runs alongside these operational MiFID II notifications.
• CSSF Commodity Derivative Notification – the fifth form in the 13 July 2026 set, tied to the position-limits regime.
• UK Bond Consolidated Tape and MiFIR Post-Trade Transparency – where the OTC prints a designated publishing entity makes public ultimately flow.
• ESMA OTC Derivatives Consolidated Tape Provider – the wider MiFIR data architecture the DPE regime feeds.
• ESMA Transaction Reporting Simplification – the parallel work to align reporting across EMIR, MiFIR and SFTR.

Key Takeaways

• The CSSF published five standardised XLSX MiFID II notification templates on 13 July 2026: algorithmic trading, direct electronic access, systematic internaliser, designated publishing entity, and commodity derivative.
• The templates change the form of the filing, not the legal trigger; the obligations still come from MiFID II, MiFIR and the Luxembourg Law of 30 May 2018.
• Algorithmic trading notifications rest on Article 17(2) and reach any automated determination of order parameters, well beyond high-frequency trading; direct electronic access notifications rest on Article 17(5).
• Systematic internaliser status is now qualitative or opt-in under Article 4(1)(20) after the MiFIR review removed the quantitative determination; ESMA’s draft ITS sets a 20 calendar day notification period, pending Official Journal adoption.
• Designated publishing entity status under Article 21a of MiFIR carries OTC post-trade publication responsibility and is separate from systematic internaliser status; Article 21a(4) required ESMA to establish the DPE register by 29 September 2024.
• The commodity derivative form is tagged to position limits, a different obligation from the Article 17 notifications, and belongs to a separate workflow.
• For the algorithmic-trading, DEA, systematic-internaliser and DPE forms, save the XLSX file under the institution’s LEI, attach the declaration signed by a legal representative, and email both documents to mifid2@cssf.lu.

Sources and References

• CSSF, Algorithmic trading notification template (13 July 2026): cssf.lu
• CSSF, DEA notification template (13 July 2026): cssf.lu
• CSSF, Systematic Internaliser notification template (13 July 2026): cssf.lu
• CSSF, DPE notification template (13 July 2026): cssf.lu
• CSSF, Notification of a commodity derivative (13 July 2026): cssf.lu
• CSSF, Markets in Financial Instruments (MiFID II/MiFIR) page: cssf.lu
• CSSF, Communication regarding the notification requirements for firms engaging in algorithmic trading or providing direct electronic access to a trading venue (26 June 2024): cssf.lu
• Directive 2014/65/EU (MiFID II), Article 17 (algorithmic trading): ESMA interactive single rulebook; consolidated text: EUR-Lex
• Directive 2014/65/EU (MiFID II), Article 4(1)(20) definition of systematic internaliser: ESMA interactive single rulebook
• Commission Delegated Regulation (EU) 2017/589 (RTS 6, organisational requirements of firms engaged in algorithmic trading): EUR-Lex
• Commission Delegated Regulation (EU) 2017/565 (MiFID II organisational and conduct requirements): EUR-Lex
• Regulation (EU) No 600/2014 (MiFIR), Article 21a (designated publishing entities): ESMA interactive single rulebook
• Regulation (EU) 2024/791 (MiFIR review), in force 28 March 2024: EUR-Lex
• Directive (EU) 2024/790 (MiFID II review, amending Article 4(1)(20) SI definition): EUR-Lex
• ESMA, Final Report on the SI notification, the volume cap and transparency calculations and circuit breakers (10 April 2025, ESMA74-2134169708-7780): esma.europa.eu

Getting the CSSF filing right the first time

The templates reward a firm that has already mapped its trading arrangements to the right legal trigger and treats the form as the last step, not the analysis. Match the algorithmic trading, direct electronic access, systematic internaliser and designated publishing entity forms to the obligations in Articles 17 and 4(1)(20) of MiFID II and Article 21a of MiFIR, confirm the submission channel on the CSSF page, and keep the records and self-assessment ready for the CSSF to ask. The 13 July 2026 forms make the filing tidier; the substance still lives in the arrangement behind it.

Last updated: July 2026

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.