Lexology In-Depth: Banking Litigation - Luxembourg (2026 edition)

Introduction

Luxembourg is recognised as one of the world’s leading international financial centres, owing not only to its position as the second-largest investment fund centre globally, after New York, with assets under management exceeding €7,300 billion,¹ but also to the remarkable strength of its banking sector and its particularly resilient financial system.

This has been recently confirmed by the International Monetary Fund, which commended the close supervision by the Luxembourg authorities and the strong fundamentals underpinning both the banking and non-bank financial sectors.²

Luxembourg’s competitive position is due in particular to the pragmatic approach adopted by the legislator and the innovative mindset of market practitioners, which have enabled legislation and practice to be adapted rapidly to market needs, thereby enhancing Luxembourg’s attractiveness for international financial operators. Luxembourg also benefits from an international and multilingual workforce, making it particularly well placed to welcome operators from around the world and to serve a broad range of international clients.

A prominent example of this pragmatic and innovative approach is the law of 5 August 2005 on financial collateral arrangements (the Financial Collateral Law), which permits the efficient enforcement of financial collateral arrangements, such as pledges, by the creditor or the security agent, even in the event of winding-up or similar proceedings. This has made the Financial Collateral Law particularly creditor-friendly and highly valued within the industry.

Another illustration is the special regime for personal guarantees granted in a professional context, introduced into Luxembourg law in 2020 as an alternative to suretyship and the first demand guarantee. The latter often entails a risk of recharacterisation as a suretyship, which is less favourable to the beneficiary of the guarantee.³ As a response to market needs, Luxembourg has therefore introduced the professional guarantee regime, characterised by its contractual flexibility and reliability.

As noted in the previous editions, a well-developed banking sector also means that banking litigation is constantly evolving. As Luxembourg is a small jurisdiction, its body of case law is less extensive than that of neighbouring countries. However, given the importance of the Luxembourg banking sector and the international profile of many transactions carried out in Luxembourg, banking litigation in Luxembourg often has a cross-border dimension and can therefore be particularly complex, making the matters brought before the courts all the more noteworthy.

Year in review

Recent cases

Madoff fraud #1

Luxembourg as a worldwide banking and financial centre has not been spared by the Madoff fraud.⁴ In one of the numerous cases tied to Madoff’s Ponzi scheme, one of the feeder funds in liquidation initiated proceedings in Luxembourg in 2009 against its custodian, seeking the return of securities and cash.

The relationship between the fund and the custodian was governed by a custodian agreement subject to Luxembourg law. The custodian entered into a sub-custodian agreement with Bernard Madoff Investment Securities (BMIS), and opened a special custody account with BMIS in connection with the fund’s assets.

On 22 March 2013,⁵ the Luxembourg District Court delivered an interlocutory judgment in which it (1) rejected the claim for restitution of the securities allegedly acquired by BMIS and recorded in the special custody account, and (2) stayed the proceedings with respect to the claim for restitution of the cash deposited in the fund’s account with the custodian.

The fund appealed said judgment.

By decision of 5 December 2024,⁶ the Luxembourg Court of Appeal,⁷ held that:

• the bank was custodian of the fund and BMIS was the sub-custodian of the bank;
• the contractual relationship between the custodian and the fund was governed by the custodian agreement and the provisions of the Luxembourg Civil Code on the contract of deposit. The specific provisions applicable to investment funds were therefore excluded; and
• the custodian had serious doubts as to BMIS’s reliability.

The Court of Appeal concluded that:

• the limitation of liability clause included in the custodian agreement in the custodian’s favour must be set aside because of its negligence in the selection and supervision of its sub-custodian BMIS;
• the custodian is under an obligation to return, by equivalent value, the securities allegedly acquired by BMIS. The Court of Appeal, however, stayed its ruling on the amount of the value of the securities; and
• the custodian is under an obligation to return the cash deposited by the fund.

The custodian lodged an appeal with the Luxembourg Supreme Court against this decision.

On 24 October 2025,⁸ the Supreme Court dismissed the custodian’s appeal concerning the fund’s claim for restitution of the securities. The ruling ordering the return of the securities is therefore final.

The Supreme Court partially quashed the appeal decision on the restitution of cash as this claim had not yet been decided upon by the District Court (which had stayed its decision on said claim) and the Court of Appeal had thus not to decide on this claim.

Key takeaways from the decision:

• The custodian notably challenged the characterisation as deposit of the contract between itself and the fund, arguing that it was a mandate. The Supreme Court, however, held that it had not been alleged that the existence of a mandate excluded the existence of a contract of deposit.
• The Supreme Court held that the Court of Appeal was entitled to find that, by passing on to the fund the information relating to the special custody account opened with BMIS, the custodian had admitted that it held those securities in custody, from which an obligation of restitution followed.
• Further, the Supreme Court held that the Court of Appeal could conclude that the book-entry registration of a dematerialised security within the meaning of the law of 1 August 2001 on the circulation of securities constituted a deposit, and that this gave rise to an obligation of restitution.

The Court of Appeal will now rule on the quantification of the award for restitution of the securities by equivalent value. The District Court will rule on the claim for restitution of the cash deposited with the custodian.

Madoff fraud #2

Another landmark decision relating to the Madoff fraud and arising from a Madoff-related liquidation of a fund was handed down this summer by the Court of Appeal on 15 July 2026.⁹

On 4 November 2008, investors had redeemed their shares in the fund, with a net redemption price of more than €30.07 million calculated as of 17 November 2008. The administrative agent of the fund confirmed the redemption order on 10 December 2008. Madoff’s fraud was revealed two days later, on 12 December 2008.

The fund subsequently suspended the Net Asset Value (NAV) calculation and redemptions, payment was not made on the anticipated date, and a later interim order compelling payment was ultimately reversed on appeal, with the funds returned to the fund’s liquidation estate.

The investors’ asset manager and their depositary sued the fund’s depositary bank for liability in tort, seeking payment of the €30.07 million redemption price, as well as damages for harm to their reputation. They alleged that the fund’s depositary bank had failed to execute the payment orders it had received from 10 December 2008 onwards. The fund’s administrative agent was subsequently joined to the proceedings, the claimants alleging that it had failed to ensure the proper execution of the redemption order.

By judgment of 22 February 2019, the Luxembourg District Court declared the investors’ asset manager’s claim admissible but unfounded. The investors’ depositary’s claim was declared admissible and well-founded against the fund’s depositary bank, which was accordingly ordered to pay the depositary the redemption price plus interest. The claim brought against the fund’s administrative agent was dismissed, the court considering that it was not responsible for making the payment.

An appeal was lodged against the decision.

On the merits, the Court of Appeal rejected liability against the fund’s depositary bank. It held that the depositary’s role was not purely mechanical: under the 2002 Luxembourg fund law, the depositary had duties to verify compliance with law and fund documents and to act in the shareholders’ interests.

The court found no fault in non-payment before 15 December 2008, because that was the confirmed settlement date accepted in practice; nor after that date, given factors such as the exceptional post-Madoff uncertainty, the fund’s board deliberations, the attachment that had been made over its assets, and the Commission de Surveillance du Secteur Financier (CSSF)'s refusal to give a comfort approval.

The court likewise rejected liability against the fund’s administrative agent. It distinguished administrative processing of redemption orders from the financial act of paying redemption proceeds. The administrative agent had confirmed the redemption and may have transmitted payment instructions, but the claimants failed to show that it owed them any direct payment obligation, acted as their mandatary, or had power to compel the depositary to release funds.

The key takeaway is that, in a distressed fund context, confirmation of a redemption and transfer of shares might not by themselves establish tort liability of the depositary or administrator for non-payment. The claimant must identify a concrete breached obligation and show fault in context. This is a significant decision in this large-scale dispute and particularly positive and important for the Luxembourg banking sector. Developments to follow.

Duty of care

In the previous edition, we had touched upon the topic of scams, which occur more and more often, and following which victims try to recover the lost funds by suing their bank for breach of their duty of care.

A new illustration was provided in a recent case before the Luxembourg District Court. The claimant had clicked a non-bank link and completed multiple authentication steps outside the normal banking website, despite the bank’s terms stating it never asks clients via link, message or call to provide access/security credentials. The claimant argued that he had never intended the transactions made to the fraudster and requested reimbursement by the bank.

The court recalled that the user of a payment service may not hold the service provider civilly liable on any legal basis other than on the provision of the law of 10 November 2009 on payment services. Further, the court concluded that, even if the claimant did not intend the transfers, he effectively authorised them through his authentication device and thus acted with gross negligence. As a result, his reimbursement claim was rejected.

This case law confirms that a client cannot hold a bank liable for its own mistakes, if the bank itself did not breach any of its duties.

First money-laundering conviction of a Luxembourg bank

On 22 May 2025, the criminal chamber of the Luxembourg District Court convicted Edmond de Rothschild (Europe) SA for money laundering and handling criminal proceeds in connection with the 1MDB scandal, ordering confiscation of €25 million already seized.¹⁰ The same bank had also received a fine by the CSSF.

The case concerns funds misappropriated by the then Malaysian prime minister, public servants and others from Malaysia’s sovereign fund 1MALAYSIA DEVELOPMENT BERHAD between 2009 and 2013 and routed through complex international structures into dozens of accounts at the Edmond de Rothschild bank linked to a UAE national and offshore entities.

The court approved an agreement entered into with the public prosecutor by the indicted bank, holding the criminal liability established and the agreed penalty lawful and appropriate, which closed the criminal case against the bank.

This is the first money-laundering conviction of a Luxembourg bank, after thorough investigation on international level by the Luxembourg authorities. This demonstrates Luxembourg's commitment to enforcing anti-money laundering rules and its determination to ensure their effective implementation.

Recent legislative developments

Introduction of class actions into Luxembourg consumer law

On 25 November 2025, the law introducing class actions into Luxembourg consumer law entered into force. This law, implementing Directive (EU) 2020/1828 on representative actions, also applies in the financial, banking and insurance sectors.¹¹

Class actions are intended to improve access to justice by enabling numerous consumers to pursue claims within one set of proceedings through a qualified representative body, such as an approved organisation or a regulatory authority, against one or more professionals established in Luxembourg or operating there.

This procedural mechanism does not alter the substantive rights of consumers or the obligations of professionals, but it may facilitate their enforcement by introducing an organised pathway for handling marge-scale consumer disputes.

It is to be noted that, unlike US class actions, the Luxembourg law incorporates certain safeguards, including the absence of punitive damages, the prohibition of contingency fee arrangements, and strict admissibility criteria designed to prevent abusive claims.

For companies operating in Luxembourg, the new regime provides earlier insight into potential liability, more efficient coordination of disputes, and a framework that may support constructive settlement before reputational concerns intensify.

New carried interest regime

In January 2026, the new carried interest regime law was approved by the Luxembourg Parliament, providing a more transparent and structured framework.¹²

Key changes are the following:

• clear distinction between contractual carried interest and carried interest linked to Alternative Investment Funds (AIF) participations: contractual carry benefits from a preferential tax rate of up to 11.45%, while AIF-linked carry remains taxable as speculative income if realised within six months and exempt after that unless the holding exceeds 10%;
• broader eligibility, extending beyond employees of AIFMs or management companies to professionals performing investment management functions for an AIF; and
• greater structuring flexibility by allowing deal-by-deal carry structures without requiring full investor return first.

Overall, the reform is intended to attract and retain fund talent, strengthen Luxembourg’s position as a leading European fund domicile, and deepen the surrounding professional services ecosystem.

Gender balance on listed companies’ boards

In December 2025, Luxembourg transposed the EU gender-balance directive for Luxembourg-incorporated companies listed on an EU regulated market, excluding SMEs.¹³

Since 30 June 2026, the underrepresented sex must hold at least 33% of all board seats (executive and non-executive).

The stated aim is to attract female talent to companies, creating an indirect or “spill-over” effect, encouraging an increased presence of women at all levels of management and among the workforce, which could, in turn, have a positive impact on the gender employment and pay gaps between women and men.¹⁴

There is no direct penalty for missing this target, but companies that fall short must explain why and what remedial measures they are taking. They must also apply a compliant director selection process: objective, pre-set, gender-neutral criteria, with priority to the underrepresented sex where candidates are equally qualified, subject to limited exceptions. Further, companies must report annually to the Luxembourg financial regulator, the CSSF, on board composition and measures taken, and publish board composition and any shortfall explanation on their website (or in the corporate governance statement, where applicable). The CSSF can investigate, order compliance and impose sanctions for breaches of selection, reporting and publication obligations, including warnings, reprimands, public statements, injunctions and fines from €250 to €250,000.

This is a positive step for Luxembourg towards more gender balance.

Expansion of the cybersecurity regulatory framework

Luxembourg modernised the national cybersecurity framework by its new law of 5 May 2026 on measures for a high level of cybersecurity.¹⁵ Its scope includes notably the banking and financial market infrastructures sectors and is thus of relevance to banks and financial institutions. In-scope entities must indeed implement proportionate cybersecurity risk-management measures covering, amongst others, incident handling, business continuity, supply-chain security, secure development, vulnerability management, cyber hygiene, encryption and access controls.

Supervisors have broad inspection and enforcement powers. Fines can reach €10 million or 2% of worldwide annual turnover for essential entities, and €7 million or 1.4% for important entities.

It is therefore important for banks and financial institutions to verify their compliance with this new law.

Transposition of CRD VI Directive

In May 2026, Luxembourg proceeded to a faithful transposition of the sixth Capital Requirements Directive (EU) 2024/1619 (CRD VI), updating the supervision and governance rules for banks.¹⁶ The key provisions relate to non-EU third-country firms (TCFs) providing core banking services in Luxembourg which are now required to establish a locally authorised third-country branch (TCB), unless an exemption applies.

Covered core banking activities include: (1) taking deposits and other repayable funds; (2) granting credit in any form, including consumer loans, mortgage lending, factoring and trade finance; and (3) issuing guarantees and other commitments.

Main exemptions include reverse solicitation, interbank business, intragroup transactions, and certain ancillary services linked to MiFID II investment activities. The full branch regime applies from 11 January 2027, with 11 July 2026 having been the deadline for the grandfathering cut-off for loans and guarantees signed before that date.

Non-EU financial institutions should assess the impact of CRD VI on their Luxembourg activities and take appropriate action.

Interim measures

Under Luxembourg law, a creditor can request a variety of interim measures. We will be focusing on attachments, as they are the most commonly used seizure measure in Luxembourg and of particular interest to banks. Attachments operate as a "freezing order" in the hands of third parties, which are most often banks. These third parties are then involved in interim measures proceedings as the third-party debtor, although they have no interest in the dispute between the creditor and its debtor.

To proceed to a conservatory attachment (ie, when the creditor does not dispose of an enforceable title), the creditor requests, within ex parte proceedings, the authorisation of the Luxembourg judge to proceed to the attachment. In the event that the judge grants the authorisation, the creditor notifies the attachment order to the third party by bailiff. In principle, Luxembourg courts only order interim measures on assets located in their jurisdiction.¹⁷

The attachment immediately renders the seized assets unavailable: the entire assets owed by the bank to the debtor are seized, even if they exceed the creditor’s claim.¹⁸

The creditor must inform the debtor of the attachment and bring against them an action for the validation of the attachment within eight days of its execution.

Within eight days of the service of the writ for validation to the debtor, the creditor must serve a confirmation of this writ to the bank. If the creditor fails to do so, the attachment cannot be validated and the seized assets become available again, until the bank receives the aforementioned confirmation.¹⁹

Banks always comply with attachments, as the law provides that if the third-party debtor does not comply with the attachment order, it will become the direct debtor and will be liable for the actual debtor’s obligations towards the creditor.

The debtor may challenge the attachment by seeking the withdrawal or limitation of the order.

Once the attachment has been validated by a first instance court, the creditor will request an affirmative declaration from the bank relating to whether the bank is or is not a debtor of the creditor’s debtor and if so, for which amount. The principle of banking secrecy does not apply to the affirmative declaration, it being noted that the bank is, however, not allowed to communicate said information before the affirmative declaration, as this would constitute a violation of banking secrecy.

Regarding case law, the Luxembourg District Court confirmed relatively recently a well-established jurisprudence regarding the third-party debtor: the judges reasserted the impossibility of executing an attachment on an indirect debtor of the creditor’s debtor.²⁰ This notably means that an attachment cannot be executed on assets of which the creditor’s debtor is only the economic beneficiary.²¹ In order not to violate banking secrecy, banks should, however, await a judgment on the validation and the summons for affirmative declaration before revealing whether they are a debtor or not of the creditor’s debtor.

Furthermore, the judges of the Luxembourg District Court, in another relatively recent decision, restated certain aspects of the affirmative declaration that the third-party debtor needs to make to the court and the creditor regarding its capacity as debtor of the creditor’s debtor and the origins and amount of the debt.²²

First, this declaration may be made even after expiry of the time limit set by the judge and as long as no definitive decision has been rendered against the third-party debtor, which would hold them liable for the actual debtor’s obligations towards the creditor.

Second, in the event that the third-party debtor states not being and never having been a debtor of the creditor’s debtor, it is up to the creditor to provide evidence that could cast doubts on the accuracy of the third-party debtor’s declaration. It is only then that the third-party debtor needs to prove the rightness of their declaration. If the third-party does not provide any proof, they will be condemned to pay the creditor as if they were the actual debtor. This would also be the case for false declarations.

Privilege and professional secrecy

A lawyer’s professional secrecy applies in Luxembourg to all information about the client and the client's affairs of which the lawyer is informed by their client or of which the lawyer becomes aware, regardless of the source of the information (eg, advice, correspondence, notes and name of clients) and the area of practice (eg, litigation, corporate and tax).²³ The professional secrecy applies to qualified lawyers registered at the Luxembourg Bar, as opposed to in-house counsel.

A limit to professional secrecy stems from the AML/CFT Law under which a lawyer who knows, suspects or has reasonable grounds to suspect that money laundering or terrorist financing is taking place, has taken place or has been attempted, is obliged to inform the President of the Bar. Under the AML/CFT Law and in the limited cases provided for by this law, a lawyer is also obliged to provide information to the financial intelligence unit, at its request.²⁴ The AML/CFT Law, however, only applies to legal services in scope of said law, which is not the case for litigation cases.

Given the role of Luxembourg as a financial centre in international transactions, attempts have been made by national and foreign authorities to get access to such information by targeting not only financial services providers but also other actors, such as lawyers. A number of the targeted lawyers have, however, successfully questioned these attempts and convinced national courts to request a preliminary ruling from the Court of Justice of the European Union (CJEU). The 2024 ruling of the CJEU in case No. C-432/23,²⁵ regarding a request for the exchange of information addressed to a Luxembourg law firm by the Spanish tax authorities,²⁶ further comforted privilege and professional secrecy in Luxembourg. The CJEU held that the protection of professional secrecy also covers legal advice and necessarily guarantees the secrecy of that advice, both as regards its content and its existence. In addition, the court stated that the special protection of professional secrecy extends without distinction to all areas of law. This is a landmark decision for lawyers and the protection of their professional secrecy.

Banks may also oppose professional secrecy to disclosure orders. As regards disclosure proceedings in general, the Luxembourg approach is fundamentally different to common law procedures, insofar as disclosure proceedings are subject to very strict conditions. Their scope is limited to the production of documents that need to be precisely determined.²⁷ The disclosure proceedings can thus not be used as means for a "private raid" or "fishing expedition".

Luxembourg law distinguishes between:

• the disclosure order of documents requested in the context of proceedings on the merits pending before a court; and
• the disclosure order arising from an autonomous procedure before the summary judge, the sole aim of which is to have the documents released, in view of initiating a dispute on the merits.

Disclosure orders can be obtained against the person or entity that the claimant considers to be in possession of information or documents that are relevant to the outcome of the pending or future dispute, whether it is a party or a third party (notably banks and trustees).

However, as stated above, the obligation of professional secrecy, including the legal professional secrecy, can constitute a lawful impediment or a legitimate obstacle to the disclosure of evidence. Specifically, Luxembourg case law requires that the requested measure does not allow the claimant to infringe any legal requirement or violate any fundamental freedom or ethical rule such as professional secrecy. When assessing a request aimed at the production of documents, the judge must perform a balancing test and take into account the consequences that the requested measure will have on both the claimant’s and respondent’s interests. It must not be a way of interfering in matters that the claimant is normally not supposed to know about.²⁸

Furthermore, the professional secrecy of banks and financial institutions does not apply when they are requested to comply with Luxembourg authorities requests, such as those related to money laundering and terrorist financing investigations as well as criminal investigations in general. Banks and financial institutions also have a duty to inform the Financial Intelligence Unit (FIU) when they know, suspect or have reasonable grounds to suspect that money laundering, an associated predicate offence or terrorist financing is being committed, or has been committed or attempted.

In a case where the former client of a bank requested the production of a declaration of suspicion allegedly reported to the FIU, the judge held that the "no tipping off" rule anchored in the AML/CFT Law is a serious challenge preventing the admissibility of the request.²⁹

Jurisdiction and conflicts of law

As banking litigation mainly relates to contractual liability, jurisdiction and conflicts of law are often governed by clauses on the choices of forum and law. However, this does not mean that Luxembourg courts and practitioners are not confronted with complex questions relating to these legal issues, notably in the context of cross-border transactions, international financing and enforcement measures.

By way of an example, as regards the law applicable to tort liability of the corporate bodies of a company or a bank towards third parties, it appears that Luxembourg judges apply the lex loci delicti (as opposed to the lex societatis). The Court of Appeal has ruled that the liability of the directors of a foreign company, who were accused of having provided false information on the basis of which the claimants had subscribed shares in the company, was subject to Luxembourg tort law, as the shares had been offered for subscription in Luxembourg.³⁰

Sources of litigation

Luxembourg is the largest investment fund centre in Europe and the second largest worldwide after New York, and as such, a frequent source of litigation by and against banks or other financial service providers related to investment funds. The liability of professionals, such as custodian banks, fund managers or portfolio managers, and the liability of their directors are some of the banking litigation matters brought before the courts of Luxembourg.

Furthermore, clients unsatisfied by the outcome of their investment regularly try to hold their bank liable by invoking a breach of its duty to inform and advise. The question of the existence and scope of an ancillary obligation to provide information and advice to a client without having concluded an investment advice contract or a management mandate is in particular often raised.

By way of illustration, in a decision of 7 March 2024, the Luxembourg Court of Appeal confirmed that an ancillary obligation to provide information and advice on stock market orders exists for banks, even in the event of an "execution only" instruction by the client (ie, even in the absence of an investment advice contract or a portfolio management mandate).³¹ The information to be provided to the client relates to the financial terms of the transaction and to the risks of stock market trading in general. It does, however, in principle, not cover the particular risks associated with a given transaction, the advisability of acquiring or not acquiring a given security, events and circumstances likely to have an influence on stock market prices, the quality of securities or the economy in general.

The scope of the obligation to provide information on risks varies nonetheless with the client’s knowledge and investment habits, as the Court of Appeal had already confirmed in 2022.³² Therefore, a more detailed risk warning needs to be provided to a non-specialised, non­professional client than to a sophisticated client. In its decision of 7 March 2024, the Court of Appeal, however, specified that being a non-professional client does not automatically mean that the client is not a sophisticated investor.³³ Investors can become sophisticated over time but the bank has the burden of proof to demonstrate the experience acquired by the client and the fact that the information provided on risks was adequate.

Banks must thus be diligent in establishing the investor profiles of their clients, even in the absence of a management mandate or advice contract, and must provide all necessary information accordingly, in order to avoid liability for breach of duty to inform.

Finally, due to the assets (whether securities or cash) that banks hold on behalf of their clients, they are often involved in proceedings for interim measures as third-party debtor to which an attachment order has been served.

Exclusion of liability

Under Luxembourg law, provisions excluding or limiting liability are in principle valid, in accordance with the principle of contractual freedom.

However, they become invalid in cases of fraud, serious misconduct or when they affect an essential obligation of the contract, rendering the latter void of substance.³⁴ For serious misconduct to be characterised, a reprehensible behaviour needs to be proven, going beyond the simple fact of having failed to comply with the contractual obligations.³⁵ Abusive clauses are also prohibited.³⁶

Regarding not the exclusion or limitation of liability but the adjustment of the period during which a bank’s liability can be sought, the Luxembourg District Court reaffirmed the possibility for banks to reduce the limitation period.³⁷

In this case, the limitation period was reduced contractually to two years (it being noted that under Luxembourg general law, the limitation period in commercial matters is 10 years).

Regulatory impact

Under Luxembourgish law, the liability of banks is a matter of common civil liability law.³⁸ It is predominantly a contractual liability and only exceptionally a liability in tort.

Regarding the regulatory impact on these civil liabilities, Luxembourg case law has known a development in the past decade. Since two decisions of the Court of Appeal of 25 February 2015 and of the Supreme Court of 26 March 2015, claimants may support their claim for damage by proving the bank’s failure to comply with a professional standard.³⁹

However, a breach by a bank of a professional standard does not automatically lead to compensation. The claimants need to prove the following:

• the breach of the professional standard constitutes a contractual fault or a fault in tort; and
• there is a causal link between this fault and the alleged damage.⁴⁰

This is not an easy task and the above-mentioned turnaround in case law has ultimately not led to a major increase in the number of decisions that find a bank liable.

As regards regulatory developments, other than the Luxembourg legislator, the CSSF is very active and regularly publishes and updates its guidelines and regulations on matters regarding the banking and financial sectors. Compliance with laws and regulations is assessed during on-site visits carried out by the CSSF, which also has sanctioning powers. A recent example is the revocation of Banque Havilland’s licence by the European Central Bank following a request for withdrawal by the CSSF.⁴¹ The CSSF had fined that same bank in 2018 for €4 million for compliance failings with the AML/CFT Law.⁴²

Furthermore, clients of professionals subject to the supervision of the CSSF may file complaints with the latter under CSSF Regulation No. 16-07 relating to out-of-court complaint resolution. The CSSF has reported a marked rise in complaints in 2025 compared with the preceding year, with many cases linked to customers affected by fraudulent activity. The complaints received by the CSSF commonly concern the following matters:

• transactions executed on behalf of the bank clients by a proxy, the client not having been aware of the extent of powers given to the proxy;
• clients who were victims of fraud;
• payment obligations under a guarantee contract; or
• the late or non-execution of market orders.⁴³

One of those cases related to the execution of securities transactions in an execution-only arrangement (ie, where customers manage their assets themselves, and the bank only carries out their instructions). This was the case for the complainants, who independently chose to invest in bonds that later defaulted.⁴⁴

The CSSF found no evidence of the clients’ exact risk profile, but concluded the bank breached its execution-only conduct duties by failing to provide adequate risk information and failing to warn that it would not assess suitability and that the clients would not benefit from related investor protections. While the bank was not required to assess suitability, its disclosure failures led the CSSF to request a commercial gesture to support an amicable settlement.

This demonstrates once again that banks, even in execution-only arrangements, need to be vigilant towards their duties of care and duties to inform to avoid liability.

Another case concerned the unauthorised use of a bank card.⁴⁵ A customer disputed cash withdrawals made with a replacement bank card and PIN allegedly mailed separately while he was abroad and never received them. The bank argued it was not liable for possible mail theft and relied on its card terms. The CSSF highlighted that, under article 84 of the Law on payment services, the bank bears the risk of sending payment instruments and security credentials. This means, in practice, that banks must ensure that the PIN codes sent to their customers are only available to these customers.

As a last illustration, the CSSF reviewed a complaint about a bank transfer sent to the wrong account after a fraudster altered the IBAN on an invoice.⁴⁶ It found that the bank was not responsible for executing the payment, because under the applicable payment services rules, a transfer made using the IBAN supplied by the customer is generally treated as correctly executed, even if other payee details do not match.

However, the CSSF criticised the bank for reacting too slowly once the fraud was discovered, as it waited around two months before asking the recipient bank to try to recover the funds. Because payment providers must make reasonable recovery efforts without delay, the CSSF considered the bank insufficiently diligent on that point and invited it to offer the customer a commercial gesture, which it agreed to do. This shows that banks, once frauds are discovered, ought to react fast.

Outlook and conclusions

Even in a more challenging geopolitical and economic climate, Luxembourg is expected to continue strengthening its position as an international financial centre in the coming years, while preserving its high degree of legal certainty and political stability. Luxembourg’s banking industry remains resilient and continues to attract new banking institutions. The legislative and regulatory framework should continue to support that development, particularly in the Fintech and sustainable finance sectors.

One of the challenges Luxembourg will face in the coming years will be to continue attracting increasingly innovative and specialised talent in the financial and legal sectors, so as to support the sustained development of the financial industry.

It may also be expected that Luxembourg will remain creditor-friendly, which is an attribute that is essential to the Luxembourg market.

This article was written by Partner Elisabeth Omes and Senior Associate Lena Hoss and was reproduced with permission from Law Business Research Ltd. This content was first published in Lexology In-Depth: Banking Litigation - Edition 10 (Banking Litigation: Luxembourg - Lexology). For further information, please visit In-Depth - Lexology.