What third-country banks need to do before January 2027

The grandfathering period under the sixth Capital Requirements Directive (Directive (EU) 2024/1619) of the European Parliament and of the Council of 31 May 2024 amending Directive 2013/36/EU as regards supervisory powers, sanctions, third-country branches, and environmental, social and governance risks, the "CRD VI Directive"), expired on 11 July 2026. The CRD VI Directive, which entered into force on 9 July 2024, introduced, at European Economic Area level, a harmonised framework governing the cross-border provision of core banking services into the EU by third-country undertakings consisting in a general prohibition on such provision unless conducted through an authorised branch established in a Member State or through an EU-authorised subsidiary (the "TCB Regime"). As a result, new contractual arrangements entered into on or after 11 July 2026 no longer benefit from the grandfathering regime and will be required to comply with the TCB Regime once the Luxembourg provisions transposing Article 21c the CRD VI Directive become applicable on 11 January 2027. 

The law of 5 May 2026 transposes the CRD VI Directive into Luxembourg law, and in particular the framework set out under Article 21c, by amending the law of 5 April 1993 on the financial sector ("LFS") and inserting a new Section 3 (Articles 32-2 to 32-19 LFS) into Part I, Chapter 3 of the LFS. The provisions of the LFS relating to the TCB Regime will apply as from 11 January 2027.

This article focuses on the core characteristics of the TCB Regime and on its transposition into Luxembourg law.

Recall of the Luxembourg Law Status: A permissive regime

Before the adoption of the CRD VI Directive, Member States were largely free to determine their own rules for market access by third-country institutions.

Prior to the transposition of the CRD VI Directive, the cross-border provision of banking services by third-country firms and the establishment of their branches in Luxembourg were governed primarily by the LFS and CSSF Circular 11/515. Regulated activities falling within the scope of the LFS required prior authorisation from the Commission de Surveillance du Secteur Financier (the “CSSF”).

Under the previous regime, third-country credit institutions wishing to provide banking services in Luxembourg on a permanent basis were authorised by the CSSF and established a branch in Luxembourg pursuant to Article 32 of the LFS. 

Separately, Article 32(5) of the LFS allowed third-country firms not established in Luxembourg to provide banking services on an occasional and temporary cross-border basis, subject to prior written CSSF authorisation but without the need to establish a branch. CSSF Circular 11/515 set out the conditions governing this "light-touch" authorisation.

A third path also existed in practice, though it was not expressly articulated in the LFS. Under the framework applicable to investment services, governed by Article 32-1 of the LFS, CSSF Circular 19/716 and CSSF Circular 20/743, a service was deemed to be provided "in Luxembourg" only where the place of its "characteristic performance" (i.e., the essential service for which payment is due) was Luxembourg. Where that condition was not met, no branch requirement or prior authorisation applied. An analogous territorial logic already underpinned CSSF Circular 11/515 for banking services, drawing on the European Commission's interpretative communication of 20 June 1997 on the freedom to provide services in the banking sector (97/C 209/04). Under that approach, the mere fact that activities were directed at Luxembourg clients, or that clients were domiciled there, was not in itself sufficient to treat the activity as being carried on within Luxembourg territory; what mattered was the place where the service was actually performed.

The preparatory works to the law of 5 May 2026 have confirmed this reading. They state that, "in accordance with existing practice", where a banking activity is carried out wholly and exclusively at a distance from a third country with no relevant connecting factor to Luxembourg, it may be regarded as provided outside Luxembourg. This constitutes an acknowledgment of Luxembourg's established administrative practice and confirms that the territoriality of banking services was already assessed on a basis broadly aligned with the characteristic performance test applicable under MiFID II. The new Article 32-3 of the LFS does not seem to depart from this approach. Luxembourg's permissive pre-CRD VI Directive regime, which allowed a number of non-EU institutions to access the market without establishing a permanent presence, thus reflected a deliberate and well-grounded territorial framework, rather than a mere regulatory gap.

What happens next? 

Under the new TCB Regime, non-EU banks and other in-scope undertakings that do not benefit from an exemption and do not operate through an EU subsidiary must establish and obtain authorisation for a branch in each Member State where they wish to provide core banking services. There is no passporting - a separate authorisation is required in every relevant jurisdiction.

Article 32(5) LFS has been repealed, along with the specific provisions of Article 32 that formerly applied to third-country credit institutions. 

Pursuant to the new Article 32-3 LFS, third-country undertakings wishing to provide core banking services in Luxembourg will be required to establish an authorised branch and obtain prior authorisation from the CSSF. The CSSF must, before granting authorisation, consult the Luxembourg AML/CFT supervisory authority and obtain written confirmation from it, a requirement not provided for under the CRD VI Directive. The CSSF retains the power to require, on a case-by-case basis, that a third-country branch be converted into a subsidiary. The CSSF may also decide that existing third-country branch authorisations granted no later than 10 January 2027 under the former Article 32 of the LFS remain valid, provided that the branches comply with the requirements of the new framework.

The law of 5 May 2026 reflects both the material and personal scope of the TCB Regime as set out in the CRD VI Directive, together with the main exceptions and limitations to the regime.

TCB Regime scope: new Article 32-2 LFS

The application of the TCB Regime is subject to both a material and a personal scope of application. It is necessary to assess, on the one hand, the relevant services that are provided and, on the other hand, the third-country undertaking carrying out those. 

The core banking services subject to the branch establishment requirement are defined by reference to points 1, 2 and 6 of Annex I to the CRD VI Directive (transposed by reference to points 1, 2 and 6 of Annex I to the LFS). These services comprise:

  1. the taking of deposits and other repayable funds;
  2. lending activities, including, inter alia, consumer credit, credit agreements relating to immovable property, factoring (with or without recourse), and the financing of commercial transactions (including forfeiting); and
  3. the provision of guarantees and commitments.

Where a third-country undertaking carries out activities listed under 1) within Luxembourg, the TCB Regime applies irrespective of whether that undertaking would qualify as a credit institution if established in the Union.

Where a third-country undertaking engages in activities listed under 2) and 3) the TCB Regime applies only if that undertaking would qualify as a credit institution or would satisfy the conditions set out in Article 4(1)(1)(b) Regulation 2013/575/EU, as amended by the Regulation (EU) 2024/1623 of 31 May 2024, if it were established in the Union. This is an exclusion of non-bank third-country actors from establishing a third country branch.

Consistently with the 21 c) 4 the CRD VI Directive), the new Article 32-2 (2) LFS of the Article includes the MiFID carve out, providing that the establishment of a branch by a third-country credit institution is not subject to the requirements of the TCB Regime when it provides investment services or activities and accompanying ancillary services as listed in Annex II, sections A and C LFS.

Thus far, even if the presentation of the rule is made differently under the directive, the content is identical.

Territorially, the CRD VI Directive does not provide any interpretative guidance on when a service is considered to be "provided in" a Member State for the purpose of triggering the branch requirement. As noted above, the preparatory works to the Law of 5 May 2026 suggest that Luxembourg has favoured a territorial approach broadly aligned with that applicable under MiFID II, and inspired by the Commission's 1997 communication, by expressly referencing the "characteristic performance" test. The new Article 32-3 of the LFS does not seem to depart from this approach. Accordingly, where a banking activity is performed entirely remotely from a third country, with no relevant connecting factor to Luxembourg, it may be regarded as provided outside Luxembourg and therefore fall outside the scope of the branch requirement.

Exemptions 

Exemptions are set out in Article 32-3 (2) LFS and they are consistent with the CRD VI Directive :

  • reverse solicitation, namely where the client or counterparty as defined under the LFS approaches, on its own exclusive initiative, an undertaking established in a third country for the provision of core banking services. The exemption also covers the continuation of the requested service and closely related services. However, it does not apply where the undertaking markets additional unrelated services or acts through linked entities acting on its behalf. The Luxembourg preparatory works clarify that the burden of proof lies squarely on the third-country firm, which must be able to document at all times that the client took the initiative. The CSSF may require group entities established in Luxembourg to provide information to verify genuine reverse solicitation. Whether a new product category is being marketed must be assessed case by case. The reverse solicitation exemption is conceptually uncertain and practically difficult to apply: its key terms are undefined, its interpretation varies across Member States. A critical unresolved question for the loan markets is whether the initiative can be exercised by a third party acting on the borrower's behalf
  • interbank operations, where core banking services are provided to a credit institution.
  • intragroup transactions.

Grandfathering

Although the grandfathering cut-off has now passed, Article 73 LFS, consistently with Article 21c(5) of the CRD VI Directive, continues to protect contracts entered into before 11 July 2026. Contracts entered into on or after that date will be expected to comply with the TCB Regime from its application date on 11 January 2027. 

The purpose of the grandfathering regime, as explained in the parliamentary preparatory works and reflected in the CRD VI Directive, is to preserve the vested rights of clients under existing contracts and to facilitate the transition to the new TCB Regime. The preparatory works further clarify that the implementation of the terms of a framework agreement concluded before 11 July 2026 remains covered by the derogation and does not trigger the branch requirement, even where the relevant steps are performed after that date.

However, no clarification has been provided on whether amendments or restatements of a pre-11 July 2026 contract would fall within or outside the grandfathering protection, or on what constitutes a new contract (for example, whether it covers accession of new lenders or extensions of maturity).

The central uncertainty - what triggers a change material enough to end grandfathering protection is now an immediate practical question for lenders and borrowers reviewing their existing portfolios. The CRD VI Directive and the Luxembourg transposition leave this undefined. The Loan Market Association's (LMA) position is that only changes that affect the borrower's original rights or introduce genuinely new terms should qualify; technical and corrective amendments should not, and pre-built contractual mechanisms exercisable unilaterally by the borrower should be safe even if exercised on or after 11 July 2026. Material changes, such as an extension of term or an increase in a credit limit, are more likely to end grandfathering protection.

Conclusion

Luxembourg has transposed the TCB Regime largely in line with the CRD VI Directive, subject to a few Luxembourg-specific adjustments, including, for instance, the additional AML/CFT involvement in the CSSF authorisation process and an early commencement of reporting obligations from 11 January 2026. The preparatory works also indicate an intention to preserve a characteristic performance approach to territoriality, providing continuity with pre-existing practice. Now that the grandfathering cut-off of 11 July 2026 has passed, the outstanding practical questions, in particular the treatment of amendments and restatements to pre-cut-off contracts, are live and require careful attention as market participants prepare for the 11 January 2027 application date. For any arrangement that does not benefit from grandfathering, the first question is whether the activity is in scope at all, and if yes, the next question is whether an exemption applies. Significant uncertainties nonetheless remain as to how these rules will be applied in practice. These are uncertainties that only market experience and, in due course, guidance from competent authorities, will be able to resolve.

Please contact our expert sfor further info: Nicolas Widung [email protected] and Elsa Jorro [email protected].