HIGH PRIORITY  

Luxembourg register deficiencies can now escalate

Why it matters? LBR has introduced an enhanced compliance process for incomplete or outdated RCS and RBE data, with enforcement beginning from 21 September 2026. For funds and managed entities, a filing inconsistency can become a visible governance weakness and may escalate if the 30-day remediation window is missed.

Key action Run a targeted RCS/RBE reconciliation across relevant Luxembourg entities, allocate an owner for every discrepancy and retain evidence of correction and sign-off.

‍

DORA incident reporting becomes a quality test

Why it matters? CSSF supplementary instructions sharpen expectations for complete, consistent and efficient DORA major ICT-incident reports. They do not create a new obligation, but they show how Luxembourg supervisors expect existing reporting duties to operate in practice.

Key action Benchmark the incident playbook and reporting templates against the CSSF and ESA instructions, then test ownership, escalation, data capture and submission quality.

‍MEDIUM PRIORITY  

Digital innovation becomes a supervisory priority

Why it matters? From2027, ESMA’s new Union Strategic Supervisory Priority will focus initially on AI and tokenisation alongside the existing cyber and operational resilience priority. Firms using AI tools, automated workflows or tokenised structures should expect more consistent supervisory questions about inventory, accountability, controls and investor safeguards.

Key action Create or refresh the inventory of AI and tokenisation use cases, map accountable owners and third parties, and ensure boards receive decision-useful reporting.

Cyber product reporting is now live

Why it matters? From11 September 2026, CRA manufacturers must report actively exploited vulnerabilities and severe incidents through the Single Reporting Platform. Most ManCos and AIFMs will be users rather than manufacturers, but scope, contractual notification and supplier readiness still need to be tested.

Key action Confirm whether any group entity is a manufacturer, importer or distributor, and add CRA readiness to critical ICT-provider assurance and incident playbooks.

‍LOW PRIORITY  

UK AIF data signals where scrutiny may go next

Why it matters? The FCA’s first market-wide analysis reports £1.8 trillion in UK-managed AIF assets in 2025, rapid private credit growth and concentrated leverage and liquidity risk. It is research, not a new rule, but it provides a baseline for UK AIFM reform and supervisory dialogue.

Key action Use the findings to challenge product, liquidity and leverage assumptions, and monitor the FCA’s modernisation of the UK AIFM regime.

‍

Tokenised settlement moves closer to production

Why it matters? TheECB launched Pontes for settlement of tokenised wholesale transactions in central bank money and plans limited own-funds investment in tokenised securities. There is no immediate compliance project, but operating-model questions are becoming more practical.

Key action For planned DLT products, assess custody, settlement finality, valuation, asset servicing, controls and governance before treating tokenisation as a distribution feature.

‍

‍

‍