guide

Last updated June 25, 2026

CSSF Investment Firms and MiFID Conduct in Luxembourg: Client Protection Guide

Direct answer

Use CSSF Investment Firms and MiFID Conduct in Luxembourg: Client Protection Guide when a CSSF-facing question needs a structured file rather than a loose policy summary. It explains understanding the Luxembourg regulatory obligation, supervisory evidence, internal ownership, and escalation points in CSSF Investment Firms and MiFID Conduct in Luxembourg: Client Protection Guide, then shows how to map the controlling rule, prepare board or compliance evidence, and know when a CSSF-facing specialist should review the file. The later sections connect official sources used, start with the investment service, not the product name, and client categorisation as the first protection gate so the next step is easier to judge. Read it before assigning owners or responding to a supervisory request, so the evidence file matches the regulatory question.

The CSSF investment firms page identifies the Luxembourg PFS categories that qualify as investment firms, including reception and transmission of orders, execution, dealing on own account, portfolio management, investment advice, underwriting, placing, MTF operation and OTF operation. The CSSF MiFID II/MiFIR/PRIIPs page summarises the investor-protection direction of the framework, including product governance, independent advice, structured deposits, management-body responsibility, inducements, client information and reporting, cross-selling, remuneration and best execution.

This guide is for investors, boards, compliance teams, advisers and readers who need a practical way to understand MiFID conduct in Luxembourg. It is not legal advice. Source check date: 20 May 2026.

Official sources used

• CSSF: Investment firms

• CSSF: MiFID II/MiFIR/PRIIPs

• CSSF: Legal requirements and authorisation procedure for investment firms

• CSSF: Customer complaints

• CSSF: Search entities

• CSSF MiFID investor protection guide

• CSSF internal governance guide

Start with the investment service, not the product name

The first discipline is mapping the actual investment service. A firm may discuss a portfolio, model, note, fund, crypto-linked exposure, structured product or advisory plan, but MiFID analysis starts with what the firm does for the client: gives advice, manages a portfolio, transmits an order, executes an order, places instruments or deals on own account.

The service map should identify client touchpoints, decision points, documentation, remuneration, execution path, product manufacturer, distributor role and records created. If the firm cannot map the client journey, it cannot reliably prove conduct compliance.

Product names can mislead. A simple-sounding product may be complex. A familiar brand may be high risk. A fund, structured deposit, derivative, bond or discretionary mandate may create different suitability, disclosure and execution questions.

For investors, the practical question is whether the firm advised, merely executed, managed discretion or introduced another provider. Rights and evidence differ by service.

For boards, the practical question is whether the activity sold by front-line teams matches the permissions, policies and controls approved by governance.

Client categorisation as the first protection gate

Client categorisation is not a paperwork detail. Retail clients, professional clients and eligible counterparties receive different levels of protection. A firm must know which category applies and must communicate category and consequences in a controlled way.

The categorisation file should record the basis for the category, any elective professional-client request, evidence assessed, warnings given and approvals. Reclassification should not be a sales convenience.

Weak categorisation creates downstream errors. Suitability, disclosures, reporting, appropriateness and complaint expectations may all be affected if the starting category is wrong.

For clients, professional categorisation may sound prestigious but can reduce protections. A client should not accept a change without understanding consequences.

For compliance teams, sample testing should ask whether client status in the CRM, contract, suitability file and reporting system is consistent.

Suitability as a reasoning file

Suitability is a reasoning exercise. For investment advice and portfolio management, the firm should understand the client's knowledge and experience, financial situation, investment objectives, risk tolerance, loss capacity, sustainability preferences where applicable and relevant constraints.

A suitable recommendation should connect facts to conclusion. It should not merely state that a product matches the profile. It should explain why the product, portfolio or strategy fits the client's objectives, horizon, risk and capacity.

The suitability file should preserve rejected options where useful. If a lower-risk or lower-cost alternative was rejected, the reason can help show that the recommendation was considered rather than automatic.

Suitability should be refreshed when facts change. A client retirement, liquidity need, market loss, leverage use, family event, tax change or risk-profile change may make old reasoning stale.

For investors, the best protection is to keep records of what you told the firm, what the firm recommended and why. If the explanation is generic, ask for specifics.

Appropriateness and execution-only risk

Where a firm does not advise but enables a client to trade, appropriateness can still matter for complex products. The firm may need to assess whether the client has knowledge and experience to understand risks, and to warn where the product appears inappropriate or where information is insufficient.

Execution-only labels should not be used to avoid conduct responsibility. If staff steer a client toward a product, frame a decision or provide selective explanations, the factual service may move closer to advice.

The appropriateness process should be product-specific. Knowledge of ordinary shares does not prove understanding of leveraged derivatives, structured products, complex bonds or illiquid instruments.

Warnings should be clear and recorded. A buried warning in a long digital journey may not be enough if the client cannot reasonably notice it.

Compliance monitoring should test whether execution-only flows are genuinely execution-only and whether warning logic works across channels.

Product governance and target market

Product governance asks whether products are designed, approved, distributed and monitored for the right target market. Manufacturers and distributors have different roles, but both should understand who the product is for and who it is not for.

The target market should be specific. A statement that a product is for investors seeking growth is weak. The file should address client type, knowledge, risk tolerance, loss capacity, investment horizon, needs, objectives and distribution strategy.

Negative target market matters. Some products should not be sold to clients with short horizons, low loss capacity, limited knowledge, liquidity needs or incompatible sustainability preferences.

Distributors should not rely blindly on manufacturer materials. They should assess whether their own client base and distribution channel match the target market.

Post-sale monitoring should identify whether sales occur outside the target market, whether complaints appear, whether product performance creates unexpected harm and whether distribution should change.

Costs, charges and inducements

MiFID conduct discipline requires attention to costs, charges and inducements. Investors should understand what they pay, who receives remuneration and how payments might influence recommendations or distribution.

Cost disclosure should be understandable. Percentage fees, transaction fees, product costs, custody fees, retrocessions, performance fees, FX spreads and exit costs can interact. A client needs practical total-cost understanding.

Inducements and third-party payments create conflict risk. The firm should record why any inducement is permitted, how it enhances service where required and how conflicts are managed.

Independent advice creates stricter expectations. A firm should not market independence if remuneration or product selection does not support that position.

For investors, the practical question is: who gets paid if I accept this recommendation, and would a lower-cost or non-paying alternative have been considered?

Best execution as evidence, not slogan

Best execution is often misunderstood. It does not mean the best price in hindsight for every trade. It means the firm must take sufficient steps under its policy to obtain the best possible result, considering relevant factors such as price, costs, speed, likelihood of execution and settlement, size, nature and client characteristics.

The execution policy should be specific enough to guide routing. It should identify venues, brokers, factors, monitoring, review frequency and how client instructions affect the process.

Monitoring should test outcomes. If a firm routes most orders to one broker or venue, it should be able to explain why that remains appropriate.

Client instructions can limit best execution, but they should be recorded. A client-requested venue or method should not become an undocumented escape from the policy.

For boards, best execution reporting should highlight exceptions and trends, not only confirm that a policy exists.

Conflicts of interest

Investment firms live with conflicts: proprietary products, group funds, retrocessions, sales targets, research relationships, underwriting roles, personal account dealing, allocation decisions and tied services. The issue is whether conflicts are identified, prevented or managed and disclosed where needed.

A conflict register should connect each conflict to controls. Naming a conflict without control is not enough. Controls may include separation, approvals, disclosure, remuneration changes, monitoring, restrictions or declining business.

Disclosure is a last line, not a cure-all. If a conflict can be prevented or managed more directly, a generic disclosure may be weak.

Boards should see material conflicts and repeated exceptions. Conflict risk often becomes visible only after complaints, losses or reviews.

For clients, conflict questions should be direct: are you recommending your own product, a group product, a product paying inducements or a product linked to another relationship?

Remuneration and sales culture

Remuneration affects conduct. If staff are rewarded mainly for volume, margin or product push, investor protection can weaken. MiFID conduct discipline therefore intersects with HR, sales management and governance.

The remuneration file should explain how incentives avoid encouraging unsuitable recommendations, excessive trading, biased product selection or inadequate disclosure.

Non-financial metrics matter. Complaint quality, documentation quality, compliance findings, training, client outcomes and conduct behaviour should influence evaluation where relevant.

Sales campaigns should be reviewed before launch. A campaign that targets the wrong clients or simplifies risk can create systemic conduct issues.

A healthy culture lets staff slow down a sale when suitability, understanding or documentation is weak. Pressure to close at all costs is a conduct warning sign.

Client reporting and recordkeeping

Client reporting turns conduct into evidence. Reports, suitability statements, confirmations, periodic statements, cost disclosures and portfolio reports should be accurate, timely and understandable.

Recordkeeping should capture the client interaction, information gathered, recommendation given, warning provided, order received, execution path and post-sale communication.

Digital channels create additional evidence questions. The firm should know what the client saw, clicked, accepted, declined and downloaded. Screens and flows should be version-controlled.

Records should be retrievable for complaints, audits and supervisory questions. A record that exists somewhere in a vendor system but cannot be retrieved is weak evidence.

For clients, keeping personal copies of suitability reports, cost disclosures and trade confirmations is prudent. It makes later questions easier.

Complaints as conduct signals

Complaints are not only individual disputes. They are conduct data. Repeated complaints about costs, risk explanations, suitability, order handling or product performance may reveal a systemic issue.

Complaint handling should identify root cause. Was the issue a misunderstanding, a disclosure gap, poor advice, system error, execution problem, staff training issue or product-governance weakness?

The CSSF customer complaints process is available for customers of supervised professionals, but firms should resolve issues fairly before escalation where possible.

Boards should see complaint themes and remediation. A declining complaint count is not enough if high-risk themes persist.

For investors, a well-written complaint should include dates, documents, recommendation, product, loss or issue, response requested and evidence. Emotional pressure without evidence is less effective.

Management body responsibility

The CSSF MiFID page highlights management-body responsibility among the areas strengthened by MiFID II. Conduct risk is therefore not only a compliance department topic. Boards and senior managers need to understand the investment services actually provided.

A board should ask which products drive revenue, which client segments are vulnerable, which inducements exist, which complaints repeat, which execution venues dominate and which suitability exceptions occur.

Conduct MI should include trends, breaches, monitoring findings, training gaps, complaint themes, target-market exceptions and conflicts.

Management should challenge optimistic conduct reports. If no issues are ever found, either controls are excellent or monitoring is too weak.

The board's role is not to approve every trade or recommendation. It is to oversee the framework that keeps client-facing activity controlled.

Digital journeys and self-directed investors

Digital investment journeys can make conduct risk less visible. A client may pass through onboarding, categorisation, product selection, appropriateness, risk warnings and order placement without speaking to staff. The evidence still needs to be robust.

Digital flows should be tested for comprehension. Important warnings should not be less visible behind default clicks, vague icons or excessive legal text.

The firm should preserve journey versions. If a complaint arises, the reviewer needs to know what the client saw on that date.

Behavioural design matters. Interfaces should not push clients toward riskier products through colour, ordering, defaults or friction asymmetry without conduct review.

Self-directed investors should still receive clear information. No-advice does not mean no responsibility for transparency and controlled execution.

Investor action plan

Before accepting advice, ask what service is being provided: investment advice, portfolio management, reception and transmission, execution-only or something else. The answer affects documentation and expectations.

Ask for total costs, key risks, why the product fits your profile, whether the product is proprietary or group-linked, whether the firm receives inducements and how you can complain.

Check the exact legal entity in CSSF Search Entities before transferring money or signing documents. Brand names and group names can obscure the contracting party.

Keep documents. Suitability statements, disclosures, warnings, trade confirmations and account statements are your evidence if a dispute arises.

If you do not understand the product, do not let urgency, prestige or fear of missing out replace explanation. A regulated process should survive careful questions.

Firm self-test

A firm can self-test conduct readiness with five samples: one advised client, one discretionary client, one execution-only complex product, one complaint and one best-execution exception. Trace each sample from client facts to outcome.

For the advised client, can the firm show profile, recommendation, rationale, costs, conflicts and suitability statement? For the discretionary client, can it show mandate, portfolio fit, risk monitoring and reporting?

For the execution-only complex product, can it show appropriateness logic and warnings? For the complaint, can it show fair handling and root-cause review? For execution, can it show policy application and monitoring?

If any file breaks, the firm should fix the process, not only the sample. A bad sample often indicates training, system or governance weakness.

The self-test should be repeated after product changes, system changes, campaigns, staff turnover and complaint spikes.

FAQ

Is every investment loss a MiFID breach? No. Investments can lose money without misconduct. The conduct question is whether the firm gathered information, disclosed risks, managed conflicts and followed the correct service obligations.

Does execution-only mean no protection? No. Information, appropriateness for complex products, order handling and best execution may still matter depending on the facts.

Can a professional client complain? Yes, but protections and expectations differ. Categorisation matters.

Is best execution the same as cheapest execution? not necessarily. Price and costs matter, but execution quality can include speed, likelihood, settlement, size and nature.

Should I rely on a firm because it is CSSF-supervised? Supervision matters, but Verify exact entity, service, product, documents and risks.

Final reader guidance

For firms, the practical standard is evidence. If you cannot prove categorisation, suitability, appropriateness, costs, conflicts, execution and complaint handling, the conduct framework is vulnerable.

For boards, the standard is challenge. Ask how revenue, products, incentives and complaints affect investor protection.

For investors, the standard is informed consent. Understand the service, product, costs, conflicts and evidence before acting.

For the site, the editorial standard is to make MiFID practical without pretending that public guidance replaces legal advice or firm-specific supervisory analysis.

Audit trail for hybrid adviser platforms

Hybrid platforms combine automated journeys with human contact. They can be efficient, but they create audit-trail questions: which part of the recommendation came from an algorithm, which part came from staff and which evidence was used at each point?

A hybrid file should preserve questionnaire logic, scoring, model assumptions, staff override, client communications and final recommendation. If a staff member overrides a model output, the reason should be recorded.

The firm should test whether automated questions gather enough information for the service offered. A short risk quiz may be inadequate for complex advice or discretionary management.

Model governance should include versioning. If a client was onboarded under an older algorithm, the firm should know which logic applied on that date.

Clients should be told whether they receive personal advice, automated guidance, portfolio management or execution-only tools. The distinction should not be less visible behind digital convenience.

Language, cross-border clients and comprehension

Luxembourg investment firms may deal with multilingual and cross-border clients. Language affects comprehension, disclosures, complaints and suitability. A client signing documents in a language they barely understand is a conduct risk.

The firm should know which languages are used for advice, contracts, risk warnings and ongoing reports. Staff language competence should match the service.

Translations should be controlled. Informal translation by a salesperson can distort risk or cost information. Key documents should be consistent across languages.

Cross-border clients may also have different tax, legal and product expectations. The firm should avoid implying that a Luxembourg product solves local tax or legal issues unless it has verified advice.

For clients, the practical rule is to request documents and explanations in a language you understand before signing or transferring funds.

Client asset and custody interface

Investment firms that interact with custody or client assets should make the custody chain understandable. The client should know where assets are held, who is custodian, what statements prove ownership and what happens if a provider fails.

Even where the investment firm does not hold client assets itself, its advice, execution or portfolio management may depend on custodians, brokers or platforms. The relationship should be disclosed clearly.

Asset statements should reconcile with transactions and portfolio reports. Differences should be explained quickly because custody confusion creates trust and complaint risk.

If assets are held through omnibus structures, nominee arrangements or foreign custodians, the client-facing explanation should be precise enough to understand practical implications.

For boards, custody interface risk should appear in outsourcing, operational and complaint reporting where relevant.

How to use CSSF sources without overclaiming

Public readers should use CSSF pages as anchors, not as shortcuts to conclusions about one firm. The CSSF investment firm and MiFID pages explain categories and framework direction, but a specific client dispute still depends on facts.

An investor should combine official sources with their own file: contracts, suitability reports, cost disclosures, statements, emails and complaint responses.

A firm should use CSSF materials to structure controls, but should also check applicable laws, circulars, ESMA material and qualified advice where needed.

Writers and analysts should avoid claiming that a poor investment result proves a breach. The better question is whether the process evidence supports the service provided.

This restraint is what makes regulatory content useful. It helps readers ask better questions without turning guidance into unsupported accusation.

Final MiFID checklist

Use this checklist as a practical review, not a substitute for legal analysis. The point is to find missing evidence before a complaint or inspection does.

For investors, the checklist indicates which documents to request and preserve.

For firms, it indicates where monitoring should sample files.

For boards, it converts MiFID from abstract regulation into concrete conduct evidence.

If one row cannot be evidenced, the issue should be assigned before the next sales campaign, product launch or inspection request. The checklist is most valuable when it changes work, not when it is filed away.

A final useful habit is to sample recent business, not only legacy files. Recent files show whether training, systems and controls are working today.

The checklist should also be used after complaints. If a complaint concerns a product, adviser or digital journey, the firm should run the same evidence questions on similar clients. That turns one dispute into a control-improvement opportunity.

For senior management, the checklist creates a common language across sales, compliance, risk, legal and audit. Everyone can see whether the issue is client data, product governance, cost disclosure, conflict management, execution or recordkeeping.

For clients, the same checklist is a reminder not to rely on trust alone. Regulated advice should leave a paper trail that a reasonable person can read later.

Where the trail is missing, ask for clarification before adding money, increasing risk or accepting a new recommendation.

If the answer is that no document exists because the conversation was informal, treat that as useful information. Important investment decisions should not depend on informal memory alone.

A firm that consistently produces clear files will usually handle later questions faster, because the explanation already exists.

The same file discipline should apply to rejected recommendations and declined transactions. When the firm decides not to recommend a product or warns a client away from a transaction, that evidence also proves the conduct framework is working.

Good conduct is therefore visible in both sales and non-sales. A framework that only records completed transactions misses the moments where investor protection prevented a poor outcome.

Deep-dive: portfolio management mandate control

Discretionary portfolio management creates a specific conduct burden because the client delegates investment decisions. The mandate should define objectives, risk limits, eligible instruments, restrictions, benchmark logic where relevant, reporting, fees and termination rights.

The firm should monitor mandate drift. A portfolio that gradually moves outside agreed risk, concentration, liquidity or instrument limits can become unsuitable even if each individual trade looked defensible.

Portfolio reviews should connect performance to risk taken. Reporting only returns can hide whether the manager changed style, increased concentration or used instruments the client did not expect.

Client changes should feed the mandate. If the client needs liquidity, changes risk tolerance or updates investment goals, the portfolio should be reviewed against the new facts.

For clients, the practical question is whether the mandate gives enough control without becoming so broad that almost any outcome can be justified.

Deep-dive: investment advice documentation

Advice documentation should preserve the conversation that mattered. A client should be able to see what facts were gathered, what recommendation was made, what alternatives were considered, what costs and risks were explained and what conflicts existed.

The recommendation should be tied to current facts. Advice based on old questionnaires, stale financial data or incomplete objectives creates evidence risk.

Where advice is given remotely, the firm should preserve digital journey evidence, recordings where applicable, messages, uploaded documents and final suitability report.

Advice should not be reverse-engineered after the sale. If the rationale is written only when a complaint arrives, the file will look weak.

A good advice file helps both sides. It protects the client by making the recommendation understandable and protects the firm by showing disciplined reasoning.

Deep-dive: complex products and leverage

Complex products deserve specific governance. Leverage, derivatives, structured payoffs, capital-at-risk notes, illiquid instruments and embedded optionality can be misunderstood even by experienced clients.

The firm should explain downside scenarios in practical language. A client should know what happens if the underlying falls, volatility changes, liquidity disappears, issuer risk materialises or early exit is needed.

Appropriateness and suitability checks should not treat self-declared experience as enough. Experience should be plausible and connected to product type.

Marketing should avoid highlighting yield or coupon features without equal attention to risk, conditions and loss scenarios.

Product committees should ask whether the product can be explained clearly to the intended client segment. If not, distribution should be narrowed or reconsidered.

Deep-dive: allocation fairness

Allocation fairness matters when scarce investment opportunities, IPO allocations, bond placements, model changes or block trades are distributed across clients. The firm should have a policy that prevents favouring high-revenue clients without justification.

Allocation records should show criteria, eligible accounts, final allocation, exceptions and approvals. If a client receives less than expected, the firm should be able to explain why.

Conflicts can arise when the firm, group entities, staff or related clients participate in the same opportunity. Personal account dealing and proprietary interest should be controlled.

Allocation review should be periodic. A pattern of favourable treatment can be invisible in a single file but obvious across deals.

For investors, asking how allocations are determined is reasonable when access to limited products or placements is part of the relationship.

Deep-dive: inducement governance

Inducement governance should start with an inventory. The firm should know every fee, commission, retrocession, benefit, research arrangement, distribution payment or non-monetary benefit connected to investment services.

Each item should have a legal assessment, conflict assessment, disclosure treatment, client-benefit rationale where required and monitoring owner.

Inducements should be reviewed when product shelves change. A new distributor arrangement or group product can alter incentives quickly.

Client-facing staff should understand what they may say. If disclosures are technically correct but staff describe the service as unbiased in a way the remuneration model does not support, conduct risk remains.

Boards should receive material inducement themes because they affect both revenue and client trust.

Deep-dive: evidence after client loss

When a client loses money, the firm should not assume that market risk explains everything. The file should be able to show service type, client profile, risk disclosure, product governance, costs, conflicts, suitability or appropriateness and execution.

Loss reviews should be factual. A loss is not automatically misconduct, but it is often the moment when weak documentation becomes visible.

If many clients lose money in the same product, the firm should review target market, distribution, disclosures, risk scenario explanation and complaints.

Client communication should avoid defensiveness. A clear explanation of product risk and file evidence is stronger than generic statements about markets.

For investors, a loss review should focus on process: what was promised, what was disclosed, what was recommended, what changed and what evidence exists.

Deep-dive: supervisory inspection readiness

Inspection readiness means the firm can retrieve conduct evidence quickly. The inspection team may ask for client files, product governance records, execution monitoring, conflict registers, inducement analysis, complaints and board MI.

A conduct file should be indexed by client, product, adviser, service, date and issue. If evidence lives across CRM, email, portfolio systems and document storage, retrieval should be tested.

Mock inspections can reveal gaps. Ask compliance to pull ten files and answer five supervisory questions for each within a defined time.

The firm should not create evidence after the request. It should retrieve evidence that existed at the time of the decision.

Inspection readiness improves everyday quality because teams know their decisions must be explainable.

Final MiFID operating standard

A strong MiFID operating model has a simple final test: can the firm explain who the client was, what service was provided, why the product or transaction fit that service, what risks and costs were disclosed, what conflicts existed and what evidence proves the process?

If the answer depends on memory, the model is weak. If it depends on generic templates, the model is incomplete. If it depends on current evidence in a retrievable file, the model is stronger.

The purpose is not to eliminate investment risk. The purpose is to make sure clients take risk knowingly, through the right service, with clear costs, controlled conflicts and fair execution.

That standard supports good firms too. It distinguishes legitimate market loss from poor process and makes complaint handling more evidence-based.

For public readers, this is the practical lens: do not ask only whether an investment made money. Ask whether the process that led to it was controlled, documented and understandable.

Governance evidence the board should see

The board should receive conduct evidence in a form that supports decisions. A dashboard that says all MiFID controls are green is not enough. The board needs exceptions, trends, client segments, product concentrations, complaint themes, remuneration pressure, conflicts and control-function findings.

Conduct MI should connect revenue to risk. If a product produces high margin, high volume or high complaint sensitivity, the board should know why the product remains appropriate for the target market and how distribution is monitored.

The board should see suitability and appropriateness testing results. It does not need individual client names in ordinary reporting, but it should understand error rates, root causes, remediation and whether weaknesses cluster by adviser, branch, platform or product.

Best-execution reporting should show venue concentration, broker performance, exceptions, policy review and client-instruction patterns. A best-execution policy with no outcome monitoring is weak evidence.

Management should record challenge. If directors ask why a product is still sold to a certain segment, why inducements are accepted, why execution venue concentration is high or why complaints repeat, the answers should be minuted and followed.

File quality for suitability reviews

A suitability file should be readable by someone who was not in the meeting. It should show client facts, objective, risk profile, loss capacity, horizon, constraints, product features, costs, conflicts and the reasoning that connects those points.

The file should avoid copy-paste rationale. If every client receives the same explanation, the evidence will not prove individual suitability. Templates can structure reasoning, but they should not replace reasoning.

Client understanding should be considered. A technically suitable product may still be problematic if the client did not understand leverage, liquidity, downside, currency risk or early-exit consequences.

Updates should be traceable. If the client profile changes, the file should show when the firm learned of the change and whether existing recommendations or portfolios were reviewed.

Quality review should include negative samples. Files that passed automated checks may still be weak if the narrative is generic or if important client facts are missing.

Advice versus information boundary

Firms often struggle with the boundary between factual information and investment advice. A neutral explanation of product features is different from a personal recommendation, but client conversations can move quickly from information to steering.

Scripts and training should help staff recognise when they are making a recommendation. Phrases such as this is right for you, you should switch, this fits your goal or this is safer for your situation may create advice evidence.

Digital tools can also blur the boundary. Filters, rankings, nudges and model portfolios may be perceived as recommendations depending on design and context.

If the firm intends to provide no advice, the journey should be reviewed by compliance and legal teams. Disclaimers alone may not be enough if the practical flow steers users personally.

For clients, the practical step is to ask whether the firm is advising or only providing information. The answer should be clear before acting.

Vulnerable clients and practical comprehension

Investor protection should account for clients who may be vulnerable because of age, language, financial stress, bereavement, low investment experience, digital exclusion or cognitive pressure. Vulnerability does not mean a client cannot invest; it means the firm should communicate carefully.

The firm should train staff to recognise warning signs: confusion, repeated misunderstanding, third-party pressure, urgency, inability to explain the product back, or focus on headline yield without downside.

Documentation should show how the firm handled comprehension. Extra explanation, cooling-off, simpler alternatives, refusal to proceed or escalation may be appropriate depending on facts.

Digital channels should not assume that clicking a box proves understanding. Comprehension checks should be meaningful for complex or high-risk products.

For boards, vulnerable-client indicators should be part of conduct oversight when relevant. Complaints and cancellations can reveal that disclosures are not understood.

Sustainability preferences and green claims

Where sustainability preferences are part of the investment process, the firm should gather, record and apply them consistently. ESG language should not become a vague sales label.

A recommendation that references sustainability should connect client preference, product classification, product documentation and limitations. If a product only partially matches a preference, the file should explain that gap.

Green claims create conduct risk. Marketing materials, adviser language and product documents should avoid implying environmental or social impact beyond what evidence supports.

If a product changes sustainability characteristics, the firm should consider client impact, target market and communication obligations.

For investors, sustainability questions should be concrete: what does the product claim, what data supports it, what exclusions apply, what trade-offs exist and what happens if the product changes?

Ongoing monitoring after sale

Conduct responsibility does not necessarily end at sale. Portfolio management clearly requires ongoing monitoring, but even advisory and distribution models may need post-sale product governance, complaint analysis and client communication when material events occur.

The firm should know which products are held by which client segments and whether changes in risk, liquidity, costs or target market require action.

Product events should be triaged. A rating change, suspension, liquidity issue, corporate action, cost change or regulatory notice may affect different client groups differently.

Ongoing monitoring should be proportionate to service model. An execution-only firm may not advise, but it should still monitor product governance and communications where required by its role.

For clients, the practical question is whether the firm will update you after sale and what monitoring is included in the service you pay for.

Training and adviser supervision

Adviser training should be product-specific and conduct-specific. Knowing product features is not enough. Staff should understand suitability, costs, conflicts, target market, vulnerable clients, recordkeeping and complaint escalation.

Supervision should include file reviews, call reviews where relevant, exception reports, complaint feedback and coaching. A training certificate without observed behaviour is weak evidence.

New advisers should have heightened supervision. Early files often reveal whether training translates into practical reasoning.

Sales managers should be trained too. If managers pressure advisers to sell products despite conduct concerns, front-line training will not protect clients.

The firm should track whether training reduces errors. If the same finding repeats after training, the root cause may be incentives, systems or product complexity rather than knowledge.

Cross-border and third-country service risk

Investment services can cross borders through branches, agents, reverse solicitation claims, third-country firms, digital access or group relationships. The firm should know where clients are located and which entity provides which service.

A Luxembourg firm serving clients abroad may face host-country requirements. A foreign firm approaching Luxembourg clients may need to understand Luxembourg perimeter rules and CSSF expectations.

Cross-border files should preserve client location, solicitation path, contracting entity, service provider, language, disclosures and complaint route.

Third-country arrangements require special care because authorisation, passporting and client-protection assumptions may differ.

For investors, exact entity and jurisdiction matter. A brand may be global, but your contract and protections are usually tied to a specific legal entity.

How to review marketing material

Marketing review should ask whether materials are fair, clear and not misleading. Return examples, risk statements, cost references, product comparisons and sustainability language should be supported and balanced.

A marketing piece should match the approved target market and service model. A product intended for experienced investors should not be promoted through simplified mass-market language.

Performance information should be contextual. Past performance, simulated performance, back-tests and scenario returns can mislead if limitations are not clear.

Marketing controls should cover websites, emails, social posts, webinars, scripts, app screens and third-party introducer material.

A good review process records who approved the material, version, intended audience, key risks and expiry or review date.

Conduct remediation after a finding

When a conduct finding appears, remediation should start with population analysis. How many clients, products, advisers, channels or periods may be affected? Fixing one file rarely solves a systemic issue.

The firm should decide whether client communication, compensation, product review, adviser retraining, system change, policy update or governance escalation is needed.

Root-cause analysis should be honest. If the issue arose because the product was too complex for the channel, training alone is not enough.

Remediation should be validated. Sample new files, review client outcomes, test system changes and monitor complaints after the fix.

Boards should see material remediation and validation, especially where investor harm or repeated findings are involved.