September did not bring major changes to the Luxembourg fund framework, but several developments deserve attention from AIFMs, Conducting Officers, Compliance Officers and other fund professionals.

The main topics were the notification of redemption suspensions, new rules on sustainability claims, Luxembourg’s first risk assessment on financial sanctions, and new cyber security alerts.

1. Redemption suspensions: new eDesk process

Since 21 September 2026, a suspension of redemptions only must be notified through the CSSF’s “LMT activation” module in eDesk.

This applies to Luxembourg funds subject to:

  • the Law of 17 December 2010;

  • the SIF Law of 13 February 2007;

  • the SICAR Law of 15 June 2004.

A suspension of redemptions only is not itself considered a liquidity management tool under the Law of 3 March 2026. However, the CSSF now requires the notification to be made through the same eDesk module used for LMTs.

Supporting documents must still be sent through the usual CSSF channels.

What should AIFMs check?

The main point is to make sure internal procedures are clear.

They should distinguish between:

  • suspension of redemptions only;

  • suspension of subscriptions and redemptions;

  • activation or deactivation of an LMT;

  • creation of a side pocket.

It should also be clear who is responsible for making the notification: the fund, the AIFM, the central administrator or another service provider.

AIFMs should also check that the relevant people have the correct eDesk access and that there is a back-up person if the main contact is unavailable.

The CSSF communication does not expressly cover RAIFs for this specific redemption-only notification process.

2. Sustainability claims: more attention to greenwashing

New Luxembourg rules on consumer sustainability claims became applicable on 27 September 2026.

The CSSF reminded firms that sustainability claims made to consumers should be:

  • clear;

  • accurate;

  • supported by evidence.

A firm should also not present something required by law as if it were a special environmental or sustainability feature.

What does this mean in practice?

The review should not be limited to SFDR disclosures.

Firms should also look at:

  • websites;

  • fund factsheets;

  • presentations;

  • marketing documents;

  • social media;

  • distributor materials.

Words such as “green”, “sustainable”, “responsible”, “ESG” or “positive impact” should be used carefully and should be supported by clear evidence.

A simple question can help:

If the CSSF asked us tomorrow why we use this sustainability claim, could we show the evidence behind it?

AIFMs should also be clear about who checks claims prepared by distributors, initiators or investment managers.

The new rules are especially important for retail-facing communications. Professional-only products may be less directly affected, but public websites and open marketing materials should still be reviewed.

3. Luxembourg publishes its first sanctions risk assessment

In September, Luxembourg published its first vertical risk assessment on international financial sanctions linked to terrorist financing and proliferation financing.

The assessment looks at the risks faced by Luxembourg because of its international financial sector, cross-border business and exposure to complex financial structures.

This does not create a new legal requirement by itself.

However, it gives firms a useful picture of the risks that Luxembourg authorities are looking at.

What should AIFMs consider?

Sanctions risk is not only about screening investors.

Depending on the business model, AIFMs may also need to consider:

  • beneficial owners;

  • initiators;

  • investment advisers;

  • portfolio companies;

  • counterparties;

  • banks;

  • brokers;

  • payment chains;

  • complex ownership structures;

  • countries and sectors with higher sanctions risk.

For many firms, this is a good moment to compare the new Luxembourg risk assessment with the existing AML and sanctions framework.

A practical review could ask:

  • Are all relevant parties covered?

  • Do we look at ownership and control?

  • Do we only rely on name screening?

  • Are indirect sanctions risks considered?

  • Is proliferation financing included in the risk assessment?

4. Cyber security: Cisco and Citrix alerts

The CSSF published alerts concerning vulnerabilities affecting:

  • Cisco Secure Email Gateway;

  • Citrix NetScaler ADC;

  • Citrix NetScaler Gateway.

Some of these vulnerabilities were actively exploited.

The CSSF also reminded firms that a successful cyber attack may lead to a major ICT incident that needs to be assessed and, where relevant, notified under DORA.

What should AIFMs do?

The first step is straightforward: ask IT or the relevant service provider for a written assessment.

The response should ideally confirm:

  • whether the products are used;

  • which versions are in place;

  • whether patches were applied;

  • whether signs of compromise were checked;

  • whether any suspicious access was found;

  • whether DORA incident classification was considered.

A simple email saying “we are not affected” is not very useful if it does not explain what was checked.

For outsourced IT environments, this is also a good reminder that the AIFM should be able to obtain clear and specific answers from its service providers.

5. New practical guidance on cyber incidents

On 28 September 2026, Luxembourg authorities published new practical guidance on how to manage cyber incidents.

The guidance covers areas such as:

  • detection;

  • containment;

  • investigation;

  • remediation;

  • evidence preservation;

  • communication;

  • post-incident review.

The guidance was prepared mainly in the context of NIS2, but it can also be useful for firms subject to DORA.

It does not replace internal procedures or regulatory notification rules.

Why is it useful?

For AIFMs, the value is mainly practical.

Firms can compare the guidance with their own incident-response procedures and check whether responsibilities are clear.

In particular:

  • Who decides that an incident is serious?

  • Who contacts senior management?

  • Who contacts the regulator?

  • Who keeps the evidence?

  • Who manages communication with service providers?

  • Who documents the lessons learned after the incident?

These questions sound basic, but they become important very quickly when an incident actually happens.

Looking ahead: Valuation

On 9 October 2026, the CSSF and ALFI will hold a webinar on valuation frameworks for less liquid and illiquid assets.

The session is relevant for AIFM board members, Conducting Officers, valuation officers, Compliance Officers, Risk Managers, fund administrators and depositaries.

Managers active in private markets or less liquid assets may want to pay particular attention to:

  • valuation governance;

  • independence;

  • external valuations;

  • model inputs;

  • overrides;

  • stale prices;

  • escalation;

  • reporting to the board and Conducting Officers.

October checklist

For Luxembourg AIFMs, the main actions to consider are:

  1. Check that redemption-suspension procedures reflect the new eDesk process.

  2. Review public sustainability claims and make sure they are supported by evidence.

  3. Compare the sanctions framework with Luxembourg’s new risk assessment.

  4. Ask IT providers for written confirmation on Cisco and Citrix exposure.

  5. Review cyber incident-response procedures.

  6. Follow the CSSF-ALFI valuation webinar and assess whether any changes are needed.

This briefing is provided for general information only and does not constitute legal or regulatory advice.

Diego Ofano
Investment Funds · Compliance & AML