General climate and trends
General innovation climate
What is the general state of fintech innovation in your jurisdiction, including any notable trends, innovations, innovators and future prospects?
Luxembourg is the ideal fintech gateway to Europe. Ranked among the leading financial centres, Luxembourg enjoys exemplary economic, social and fiscal stability, making it one of the few countries in the world with an AAA rating from every major ratings agency. Luxembourg has naturally positioned itself as a world leader in the sphere of digital financial services and as a fintech hub.
The rise of the Luxembourg fintech sector started early with the development of the international e-commerce and e-payments sector (notably due to the presence of PayPal, Amazon and iTunes in Luxembourg); since then, it has diversified into an ecosystem engaged in regulatory technology (known as ‘regtech’), security and authentication, distributed ledger technologies and smart contracts, mobile and e-payments, automated investment services, Big Data and analytics.
A range of support initiatives make Luxembourg the perfect place to engage in a fintech start-up. The development of innovative fintech solutions is notably encouraged by the Luxembourg House of Financial Technology – Luxembourg’s dedicated fintech platform – where finance and technology interact to foster innovation and develop solutions to shape the future of financial services. Start-ups can also combine private funding with public funding schemes for research, development and innovation. In addition, tech companies can obtain funding from the €150 million Luxembourg Future Fund and the Digital Tech Fund.
Luxembourg’s regulatory framework provides security to both companies and investors and the Commission de Surveillance du Secteur Financier (CSSF), the Luxembourg financial regulator, has a well-established reputation for accessibility, competence, responsiveness and an open attitude towards innovation.
Have there been any particular developments – regulatory or commercial – in any of the following fintech sectors?
Distributed ledger technology and digital currencies (eg, blockchain, smart contracts and Bitcoin)?
Luxembourg is a leader in the promotion of innovative blockchain applications.
Although the CSSF has not yet assumed an official position regarding virtual currency initial coin offerings (ICOs) or investment funds, in March 2018 it issued two papers warning the public about “substantial risks linked to” virtual currencies and ICOs used to launch new virtual currencies through tokens.
In both papers, the CSSF underlined that its warnings did not apply to the blockchain technology used by cryptocurrencies, which it said “could bring certain advantages in their use in the financial sector and in different innovative projects”.
Issuers should therefore give careful consideration as to whether their ICOs and their activities constitute regulated activities. If this is the case, issuers must comply with the relevant EU or national legislation; any failure to comply with the applicable rules would constitute a violation of such rules and regulations.
Alternative lending platforms?
Luxembourg’s alternative lending space has witnessed significant growth in recent years, led predominantly by the fact that debt origination activities can be pursued in Luxembourg without having to apply for a banking licence provided that no deposits and other repayable funds are received from the public.
Digital payments, remittances and foreign exchange?
Luxembourg serves as the European hub for major e-commerce and e-payment companies and currently stands as Europe’s number one cross-border financial centre.
Luxembourg was the first EU country to license a bitcoin exchange, having approved a payments institution licence for Bitstamp in April 2016. Thanks to the EU passporting system, Bitstamp is now considered licensed in 28 EU member states.
Alternative financing (including crowdfunding)?
To date, there are no specific crowdfunding regulations in place in Luxembourg and there are no further general regulatory developments that might have an effect on crowdfunding in Luxembourg. In most cases, crowdfunding would not be regulated by the CSSF. However, depending on the services offered by the crowdfunding platform, the financial sector law could be applicable, which would mean that the crowdfunding platform would be required to obtain a specific licence from the CSSF in order to perform its activities.
Investment, asset and wealth management?
The Fundchain initiative was launched in 2016 with the aim of developing solutions using distributed ledger technology and smart contracts to act as innovation pioneers for the investment fund industry.
Robo-advice and artificial intelligence?
The University of Luxembourg has entered a collaborative research partnership with financial firm Clearstream, part of Deutsche Börse Group, and consulting firm escent to explore how artificial intelligence and natural language processing can be used to simplify and standardise requirement analysis for IT projects in the financial industry.
Any other technologies?
To achieve the next level of digitisation, in 2014 the Luxembourg government launched the Digital Luxembourg initiative. The aim of the Digital Luxembourg initiative is to strengthen and consolidate Luxembourg's position in the information and communications technology field over the long term, and to transform the country into a centre of excellence for new technology.
The CSSF is currently investigating how and under what conditions public clouds could be used by regulated entities of the financial sector.
How would you describe the regulatory policy for fintech products and services in your jurisdiction?
The Commission de Surveillance du Secteur Financier (CSSF) is an open regulator and is generally flexible when it comes to financial innovation matters; it usually takes a technologically neutral view when assessing a new fintech project. Nadia Manzari, head of innovation, payments, markets infrastructures and governance at the CSSF, has stated that: “Luxembourg’s innovative regulatory approach has contributed to develop an important payment services industry which generates nowadays an ecosystem of highly innovative products.”
The CSSF was one of the first European regulators to adopt a clear position in favour of virtual currencies and, through its dedicated division for financial invocation and technology, has launched a number of initiatives to facilitate fintech innovations (notably through the introduction of simplified due diligence for low-value online payment transactions).
Have any fintech-specific laws or regulations been enacted in your jurisdiction? Are any envisaged?
No, but further legislation may be introduced as fintech industries mature and evolve – for example, in relation to virtual currencies and initial coin offerings.
Which government authorities regulate the provision of fintech products and services?
In order to be established in Luxembourg to carry out financial sector activity, a fintech entity must have authorisation from the minister of finance and be subject to supervision by the CSSF. The same rules apply to financial technologies and new digital services. Far from preventing innovation, this supports the development of a level playing field for fintech products and services and offers security for customers and investors.
Financial regulatory framework
Which laws and regulations governing the provision of financial services apply to fintech businesses?
The main legislation and codes of practice that govern the traditional financial services industry include the following:
- the Law of April 5 1993 on the financial sector (as amended), which regulates and controls entities undertaking financial services business in Luxembourg;
- the Law of November 10 2009 on payment services (as amended) which regulates payment institutions and electronic money institutions;
- the Law of November 12 2004 on the fight against money laundering and terrorist financing (as amended) and the Law of October 27 2010 enhancing the anti-money laundering and counter terrorist financing legal framework, organising the controls of physical transport of cash entering, transiting through or leaving the Grand Duchy of Luxembourg (as amended);
- the Law of August 2 2002 relating to the protection of individuals as regards the processing of personal data (as amended), to be repealed and replaced by the law implementing the EU General Data Protection Regulation (GDPR) in Luxembourg; and
- the Law of December 6 1991 on the insurance industry (as amended) and the Grand Ducal Regulation of December 14 1994 (as amended), which regulate and control insurers and their activities in Luxembourg.
The extent to which these apply to fintech businesses in any given case will depend on the nature of the business and the way in which a fintech product or service is structured and delivered. Engaging in these businesses without complying with the licence or registration requirements may lead to criminal penalties.
Under what conditions are fintech businesses subject to licensing requirements? Are there any exemptions?
Depending on the services offered, it is possible that the law on the financial sector could apply, which would require the fintech company to obtain a specific licence from the CSSF in order to perform its activities.
If regulated, fintech solutions will be accepted only if they fully comply with the legal requirements, particularly in the fields of data privacy and data protection, know-your customer regulations and IT security requirements.
Are any fintech products or services prohibited in your jurisdiction?
Any fintech product or service falling within the ambit of existing legislation will be prohibited if it does not comply with the applicable regulatory framework
Data protection and cybersecurity
What rules and regulations govern the processing and transfer (domestic and cross-border) of data relating to fintech products and services?
Luxembourg's data protection legislation will be updated in May 2018 to bring it in line with GDPR. This local legislation will apply to all Luxembourg businesses, including fintech businesses, and is expected to include provisions relating to the processing and transfer of data consistent with GDPR.
What cybersecurity regulations or standards apply to fintech businesses?
Luxembourg data protection law (as it will be amended by GDPR) provides that data controllers and data processors must implement all appropriate technical and organisational measures to ensure the protection of the data they process against accidental or unlawful destruction or accidental loss, falsification, unauthorised dissemination or access, in particular where the processing involves the transmission of data over a network, and against all other unlawful forms of processing.
The Luxembourg Criminal Code also sets down penalties for cybercrime, including illegal access, hacking and deletion of computer data.
As well as this developed legal framework, Luxembourg has launched initiatives to enhance awareness of the risks linked to information and communications technology, and to contribute to a more secure use of those technologies.
What anti-fraud, anti-money laundering or other financial crime regulations govern the provision of fintech products and services?
Please see above in relation to the anti-money laundering legislation.
The Luxembourg Bankers’ Association and the University of Luxembourg recently launched a joint research project on the distributed ledger prototype and data analytics for Know Your Customer (KYC). This project aims to develop and test new conceptual and technological approaches to KYC procedures in the financial services sector, enabling financial institutions to use more efficient methods of customer identification.
What precautions should fintech businesses take to ensure compliance with these provisions?
What consumer protection laws and regulations apply to the provision of fintech products and services?
Privacy and consumer protection in the fintech domain is guaranteed by the Consumer Code of April 8 2011 regarding distance contracts on financial services (as amended) and the Law of August 2 2002 on the protection of persons about the processing of personal data (as amended).
The CSSF is competent to receive complaints from customers of fintech entities subject to its supervision and to act as an intermediary to seek the amicable settlement of such complaints.
The CSSF acts in its capacity as a dispute resolution body, notably pursuant to the EU legislation on the out-of-court resolution of consumer disputes, as transposed into Luxembourg national law and introduced into the Consumer Code in 2016.
The CSSF is registered on the list of the alternative dispute resolution (ADR) bodies and on the list of ADR entities established and published by the European Commission.
Does the provision of fintech products or services in your jurisdiction raise any particular competition regulatory concerns?
Luxembourg is the only country in the European Union without a prior merger control system. Nevertheless, a merger or acquisition and the parties involved may be subject to a postiori control by the Luxembourg Competition Council pursuant to the Law of October 23 2011 on competition (as amended).
Are there any particular regulatory issues concerning the cross-border provision of fintech products and services (eg, operating jurisdiction rules and currency controls)?
GDPR and the equivalent local data protection legislation to be introduced in Luxembourg will regulate the cross-border transfer of data.
Financing, investment and government support
Does the government provide any incentives or support programmes to promote fintech innovation in your jurisdiction (eg, tax incentives, grants and regulatory sandboxes)?
Luxembourg has the lowest level of value added tax in the European Union, and its effective corporate tax ranks among the most favourable in Europe. Accelerated depreciation and tax credits, applied to qualifying investments, add to an attractive tax climate, thus helping start-ups and facilitating return on investment.
Further, Luxembourg offers an attractive environment for IP management, including an absence of withholding tax on royalty payments and an extensive network of double tax treaties.
To encourage R&D activity, Luxembourg offers a tax incentive that provides for an 80% exemption of certain types of IP-related income (or of deemed IP-income if a taxpayer creates intellectual property for its own use), as well as capital gains realised on the disposal of such intellectual property.
A wide range of financial aid is available to support R&D activities in both the public and the private sector.
The Luxembourg House of Financial Technology – a partnership between the public and private sectors – was established in 2017. It aims to foster innovation within and drive the technological evolution of Luxembourg’s financial services sector. It offers start-up incubation as well as co-working spaces, and brings together innovators, investors, financial institutions and research institutions.
Has the government concluded any international cooperation agreements to promote and facilitate the cross-border expansion of fintech businesses?
Luxembourg and Belgium have signed a memorandum of understanding which aims to work on collaborative initiatives and further promote the fintech industry across Europe for the benefit of the whole industry.
Financing and investment
What private financing and investment schemes are available and commonly used for fintech start-ups in your jurisdiction?
Private financing or investment may be available from dedicated investment funds, banks and financial institutions, global venture capital and business angel investors.
Start-ups can also combine private funding with public funding schemes for research, development and innovation. In addition, fintech companies can obtain funding from the €150 million Luxembourg Future Fund and the Digital Tech Fund. Incubator and accelerator facilities also offer physical space designed to foster business development and provide invaluable networking opportunities.
What forms of IP protection are available for fintech innovations?
Fintech innovations and inventions are protected by IP legislation, mainly through the patent, trademark, design and pattern rules. Software developments and computer programs are protected only by copyright unless deemed to be a part of a patented invention.
Copyright protection is obtained automatically without the need for registration or other formalities, and grants the author property rights lasting up to 70 years after his or her death.
What rules govern the ownership of IP rights to fintech innovations?
The Law of April 18 2001 on copyright, related rights and databases provides the legal framework applicable to literary and artistic property.
Luxembourg has also been proactive in developing its IP standards and participates in all of the major IP treaties and conventions, including the Bern Convention, the Patent Cooperation Treaty, the Paris Convention and the Patent Law Treaty, as well as the Madrid Agreement and Protocol. The country is also a signatory of the European Patent Convention, which was set up by the European Patent Office.
The Luxembourg authorities have created a safe IP environment by implementing EU directives as well as international agreements and treaties, such as the Agreement on Trade-Related Aspects of Intellectual Property Rights to secure IP rights.
As far as industrial property is concerned, the Luxembourg legal framework allows for multiple types of patent:
- a national patent application may be submitted to the Office of Intellectual Property of the Ministry of Economy;
- a European patent application may be introduced at the European Patent Office; or
- an application for an international patent may be submitted at the World Intellectual Property Organisation in the context of the Patent Cooperation Treaty.
Protection for trademarks or designs is not only national, but also covers Belgium and the Netherlands, because Luxembourg is part of the Benelux Intellectual Property Organisation. Applications can be made at the Benelux Office for Intellectual Property.
What immigration schemes are available for fintech businesses to recruit skilled staff from abroad? Are there any special regimes specific to the tech or financial sector?
Under the European Blue Card scheme, specific rules apply to highly qualified non-EU or non-EEA/Swiss workers, who are defined as workers in possession of a higher education degree or at least five years of highly skilled work experience.
What immigration schemes are available for foreign investors and entrepreneurs wishing to invest in or establish a fintech business in your jurisdiction?
A new type of residence permit was created in 2017 for investors which aims to diversify the national economy and encourage entrepreneurship in Luxembourg.
A third-country national interested in investing in Luxembourg may opt for one of the following investment plans in order to be granted a residence permit as an investor:
- Invest at least €500,000 in an existing Luxembourg company (with commercial, industrial or craft activities) and commit to maintaining existing jobs for five years;
- invest at least €500,000 in a new Luxembourg company (with commercial, industrial or craft activities) and commit to creating at least five jobs in the next three years; or
- invest at least €3 million in an existing or new investment or management structure which has its registered office in Luxembourg and has proven appropriate substance.