Guide

Last updated October 08, 2026

How to Verify a Private Bank Is Regulated by the CSSF in Luxembourg

For this guide, a “private-banking offer” is an offer marketed to individual clients as private banking or as a combination of banking, investment or wealth-management services. That marketing description does not make every provider, relationship manager or adviser a bank. The first question is which legal entity would contract with you or hold your money or securities, and what that entity is authorised to do.

This guide is for anyone considering or already dealing with a Luxembourg private-banking offer. Before relying on the offer, verify three separate things: the legal institution and its regulatory status, the authenticity of the contact and payment instructions, and the protection that applies to cash or investments. A genuine register entry supports the first check only; it does not by itself authenticate a contact or establish how assets are protected.

The Commission de Surveillance du Secteur Financier (CSSF) is Luxembourg’s public financial-sector supervisor. Prudential supervision of banks is shared under the European banking-supervision system: depending on the institution, the direct authority may be the CSSF, the European Central Bank (ECB) or a bank’s home-country authority. The CSSF’s credit-institution overview sets out that division.

Material checks of the CSSF credit-institution and investor-compensation guidance and the FGDL deposit-guarantee guidance updated: October 8, 2026. Other cited sources retain their October 7, 2026 review.

1. Identify the legal entity behind the offer

Before searching a register, collect the full company name, registered address, registration or regulatory identifier, claimed regulator and proposed service from the account agreement or other contractual documents. Do not rely only on a website banner, group logo or salesperson’s email signature.

Ask one direct question:

Which legal entity will enter into the agreement with me, and which entity will hold my cash or securities?

“Private banking,” “wealth management” and a group brand are not substitutes for the name of the contracting institution. A company-registration record is also not a banking authorisation. The CSSF’s authorisation page explains that banking licensing is a separate process involving the CSSF and ECB, while the CSSF authorises third-country bank branches in Luxembourg.

The CSSF’s financial-fraud guidance recommends obtaining the provider’s company name, registration number, address, telephone number, supervisory authority and clear information about the product before investing. If a proposal mentions a banking group, an advisory company and a Luxembourg branch, identify the role of each instead of assuming that one matching group name validates all of them.

2. Check the official CSSF entity record

Open CSSF Search Entities from the regulator’s website. The CSSF describes this database as covering entities that it supervises or with which they are registered. Use the live database rather than a screenshot supplied by the person selling the service.

Search for the exact legal name from the proposed agreement. Compare the result with your documents, including the entity category, address, identifier and any displayed authorisation or notice. If the exact name produces no result, check the spelling and try a distinctive part of the name, but do not treat a vaguely similar record as a match.

For an institution presented as a bank, the relevant category is bank or credit institution. The CSSF defines credit institutions as legal persons whose activities include taking deposits or other repayable funds from the public and granting credit for their own account. Finding a different type of financial entity does not establish that it is authorised as a bank. See the CSSF credit-institution page.

A matching institution record establishes regulatory information about that entity. It does not authenticate the website, caller, relationship manager, product or beneficiary account in the offer you received.

3. Work out which authority directly supervises the bank

“Regulated by the CSSF” is often used loosely. The direct prudential supervisor depends on the institution’s structure and significance. The CSSF publishes the following allocation:

Source: CSSF, Credit institutions.

Direct ECB prudential supervision does not remove the CSSF’s separate responsibilities for anti-money laundering and counter-terrorist financing (AML/CFT) compliance or consumer-protection regulation. The same CSSF credit-institution page identifies those as CSSF supervisory areas.

The ECB grants and withdraws banking licences for credit institutions established in countries participating in the Single Supervisory Mechanism, in cooperation with the CSSF; the CSSF handles authorisation of third-country branches. A Luxembourg bank referring to both authorities is therefore not inherently inconsistent. The CSSF authorisation guidance explains the respective roles.

For a bank authorised elsewhere in the EU or European Economic Area, cross-border activity may rely on the European passport. The bank must complete the formalities through its home authority, which notifies the CSSF. “European licence” alone is not a sufficient explanation; identify the home-authorised bank and the branch or cross-border service involved. See the CSSF’s European passport guidance.

You can also consult the ECB’s list of supervised banks, which identifies significant banks under direct ECB supervision and less significant banks under indirect ECB supervision. Read the list’s cutoff date: the page says it reflects significance decisions that entered into force before that date.

4. Authenticate the contact and payment instructions independently

A correct entity record does not prove that the person contacting you works for that institution. Use a channel you establish independently—for example, an existing authenticated banking app or a telephone number obtained from the verified institution record or website. Ask the bank to confirm the relationship manager, proposed service, account-opening process and beneficiary-account details.

Do not complete this check by calling a number supplied only in the message you are trying to verify. Luxembourg Police warn that criminals impersonating bank staff can use caller-ID spoofing so that a Luxembourg or official-looking number appears on the recipient’s screen. They also state that reputable banks and administrations do not ask customers to disclose login details or approve transactions over the phone. See the Police guidance on fraud by fake bank employees.

A useful confirmation question is:

Please confirm that this offer, this representative and these beneficiary-account instructions are genuinely associated with your bank.

A plausible explanation from the original sender is not independent confirmation.

5. Search CSSF warnings—and distinguish impersonation from an unauthorised operator

Search the CSSF warnings library for the claimed name, website, email domain, telephone number and other distinctive details. Read the full notice rather than relying on a headline.

There is an important distinction between a warning about an unauthorised operator and one about criminals impersonating a legitimate institution. A real bank’s name appearing in an impersonation notice does not mean the bank itself conducted the fraudulent activity.

On October 5, 2026, the CSSF published a warning about unknown persons impersonating Eurobank Private Bank Luxembourg S.A. The notice listed a website, email addresses and telephone number used in the fraudulent activity and stated that the legitimate bank was not connected with it. The bank was identified separately as a bank with its official CSSF entity record. Read the CSSF Eurobank impersonation warning.

No warning found is not the same as authorisation confirmed. The entity database helps establish regulatory status; warnings help identify reported misuse or illicit activity; independent contact with the institution tests whether the actual offer and payment instructions are genuine.

6. Check cash-deposit and investment protection separately

After confirming the institution and communication channel, identify what you would place with it. Cash deposits and investment assets use different protection systems, with different limits and eligibility rules.

Eligible deposits: the FGDL

The Fonds de garantie des dépôts Luxembourg (FGDL) covers eligible deposits with member banks and POST Luxembourg. The standard limit is €100,000 per person, per bank, subject to eligibility rules. Certain qualifying temporary high balances can receive higher protection. See the official FGDL deposit-guarantee explanation.

The standard limit applies across eligible accounts held by the same person at the same bank; it is not renewed for every account. For example, if one eligible depositor holds €80,000 in one account and €70,000 in another at the same bank, the combined balance is €150,000 and the ordinary limit remains €100,000. This example assumes no qualifying temporary-high-balance protection.

Luxembourg banks provide customers with an annual depositor information sheet describing the recognised deposit-guarantee scheme, its limit, treatment of multiple accounts and repayment arrangements. The CSSF explains this standard notice on its deposit-guarantee page.

Check the applicable scheme instead of assuming that every Luxembourg address means FGDL membership. For a Luxembourg branch of a bank headquartered in another EU Member State, the home country’s law determines the scope of the guarantee; the FGDL explains that it would manage communication and repayment locally using funds from the home-country scheme. For third-country branches, check whether the branch appears on the FGDL member list.

Investment assets: the SIIL

The Système d’indemnisation des investisseurs Luxembourg (SIIL) is separate from deposit protection. It covers eligible clients of member banks and investment firms in defined failure situations. If a member institution fails, financial instruments such as securities held on behalf of clients do not form part of its liquidation assets and must be returned to the clients. Compensation becomes relevant when covered assets cannot be returned—for example, because some instruments are missing due to fraud or administrative negligence.

For that covered shortfall, the SIIL compensation limit is €20,000 per person and per institution, subject to eligibility rules and exclusions, including for specified professional and institutional investors. The €20,000 amount is not a general ceiling on the return of a client’s portfolio: it caps compensation for a covered inability to return assets. It also does not protect against an investment falling in value. See the official CSSF investor-compensation explanation.

FGDL and SIIL are not automatically triggered simply because an impostor induced a payment. If you sent money to an outside impersonator rather than placing an eligible deposit or covered assets with the institution, the payment is not automatically a claim under either scheme. That is not a general statement that all fraud-related losses are excluded: the CSSF explains that SIIL may compensate eligible clients when a failed member cannot return covered instruments, including where instruments have gone missing because of fraud or administrative negligence.

For an offer combining cash and investments, ask the institution to identify the deposit-taking entity, custodian and protection applicable to each component. Do not treat a general statement that a portfolio is “guaranteed” as a substitute for those details.

What if the bank does not appear in your search?

A failed search is a reason to pause, not an automatic finding of fraud. First determine whether you have a brand, legal entity, branch or former name. Ask the provider to identify the current contracting entity and the official record supporting its claimed status. Do not send money while a material identity or authorisation mismatch remains unresolved.

For an EU/EEA institution, confirm the home-authorised bank and the passporting arrangement. The CSSF states that the institution completes the necessary formalities through its home authority, which then notifies the CSSF.

If doubts remain, the CSSF’s financial-fraud guidance directs consumers to [email protected] and asks them to provide the information received from the provider. The CSSF can confirm whether the provider is supervised and whether contact details are correct, but it does not assess whether the offer is commercially worthwhile.

A verification request you can send

Use this template for a focused inquiry. Do not include passwords, authentication codes or unnecessary identity documents.

Subject: Verification of banking authorisation and contact details — [legal entity name]

I have received a private-banking offer from a provider claiming to be [legal entity name], based at [address].

The claimed regulatory identifier is [identifier]. The provider uses [website], [email address] and [telephone number]. The proposed service is [service].

Could you confirm its regulatory status and whether these contact details correspond to the institution? Please advise which authority I should contact if it operates through a foreign branch or cross-border arrangement.

I can provide the offer and correspondence through an appropriate channel.

Keep a dated record of the entity entry you reviewed, the documents naming the contractual partner, the independent contact confirmation and the relevant protection information. Record unresolved questions as unresolved rather than converting them into assumptions.

Already sent money or credentials to a suspicious contact?

Contact your own bank through a known channel, explain that the transfer or account access may involve fraud, and ask what actions remain available. Do not assume that recovery is possible.

If you suffered a loss from a fake-bank-employee call, Luxembourg Police instruct victims to contact a police station. Preserve the messages, payment details and other records for your bank and the Police. See the official Police fraud guidance.

Do not install remote-access software at the request of an unsolicited recovery service. The CSSF warns that recovery scammers target people who have already lost money, ask for remote access and then seek additional fees or initiate further transfers. See the CSSF warning on investment and recovery scams.

The bottom line

A useful verification has three separate outcomes: the institution’s regulatory status is established, the contact and payment instructions are independently authenticated, and the protection for each asset is understood.

Finding a bank’s name is only the beginning. Do not transfer money while material inconsistencies remain between the official record, the proposed contract and the communication channel.

This guide provides general information, not individual legal or investment advice. It does not certify any particular bank, representative or offer.