Substance in Luxembourg's Financial Sector: From Box-Ticking to Bottleneck

What "substance" actually means

Substance is not a defined legal term you'll find in one article of one law. It is a composite requirement, built up over two decades from CSSF circulars, tax case law, and EU anti-abuse doctrine, that answers one question: does the decision-making that justifies this entity's existence in Luxembourg actually happen in Luxembourg?

Three layers apply simultaneously to most regulated or holding structures, each policed by a different authority:

• Regulatory substance (CSSF): for licensed vehicles (SICARs, SIFs, investment firms, management companies), the CSSF requires that central administration, directorship, execution, and control, be genuinely located and exercised in Luxembourg, not merely registered there.
• Direct tax substance (Administration des Contributions Directes / ACD): for the entity to access double tax treaties, the EU Parent-Subsidiary Directive, or the participation exemption, it must show real management, local decision-making, and economic justification, not just a mailing address.
• Indirect tax and AML substance (Administration de l'Enregistrement, des Domaines et de la TVA / AED): the AED is Luxembourg's third fiscal administration, alongside the ACD and Customs, competent for VAT, registration duties, and the taxe d'abonnement levied on investment vehicles. Since a 2018 reinforcement, it also acts as an AML/CFT control authority for certain non-financial professionals, a supervisory role that increasingly overlaps with substance questions when a vehicle's declared activity doesn't match its VAT footprint.

Then and now

Then (roughly 2005–2018): a registered office through a domiciliation agent, a board that met in Luxembourg a few times a year (sometimes by phone with minutes drafted afterward), and one or two Luxembourg-resident directors sitting on dozens of boards was broadly accepted. Substance was largely a formality proven by paperwork.

Now: substance is proven by operational reality, and that reality is checked. CSSF Circular 25/901, issued 19 December 2025, consolidated and modernised the supervisory framework for SIFs, SICARs and Part II UCIs, tightening in particular the analytical framework for SICAR risk capital and reinforcing expectations on governance. Telework rules under Circular CSSF 21/769 even require entities to demonstrate that remote staff, including cross-border commuters, can return to Luxembourg premises on short notice, a sign of how granular the scrutiny has become.

Three logics, not two: CSSF licence, business permit, or nothing at all

This is where clients most often get confused, because the consequence of insufficient substance differs depending on which of three regimes actually applies, and it isn't just "regulated vs. SOPARFI." There's a middle category that gets missed constantly: an entity that takes investment decisions itself, without CSSF licensing and without delegating to an AIFM, doesn't automatically fall back into the light-touch SOPARFI category. It falls into general commercial law instead.

1. CSSF-licensed investment vehicles (SICAR, SIF): Substance is a licensing condition, supervised directly by the CSSF. A SICAR or a SIF must prove its central administration is in Luxembourg as part of authorisation, and this is monitored on an ongoing basis, through Fund Self-Assessment Questionnaires, off-site reviews, and on-site inspections that can happen with or without notice under Article 147 of the 2010 Law. Deficient substance here can trigger a CSSF finding, formal remediation requirements, or in serious cases withdrawal of authorisation. On top of that, the taxe d'abonnement these vehicles pay to the AED makes their declared activity level cross-checkable against a second administration.

It's worth separating two things clients often conflate: the vehicle's own central administration substance (registered office, board, corporate governance, which must sit with the vehicle itself), and the fund management function (portfolio management, risk management). If the SICAR or SIF appoints an authorised AIFM, that manager can validly discharge the fund management substance on the vehicle's behalf, the AIFM carries its own CSSF-supervised substance obligations (its own conducting officers, own premises, own governance), whether Luxembourg-based or passported in from elsewhere in the EU. The vehicle does not need to duplicate portfolio-management capability in-house; it needs a properly appointed, properly substantiated manager. Back-office central administration tasks can, separately, be delegated to an authorised "UCI administrator" under CSSF Circular 22/811, a category broader than AIFMs alone. What the vehicle cannot outsource is its own governance, the board still has to genuinely decide, in Luxembourg, on matters reserved to it.

But this AIFM cushion only exists if the vehicle actually qualifies as an AIF, and not every SICAR does. A SICAR is licensed directly under the Law of 15 June 2004, independently of AIFMD status. Many SICARs raise capital from a number of investors and squarely meet the AIF definition, in which case the delegation logic above applies in full. But single-investor or intra-group SICARs, for example, can fall outside the AIF definition altogether, the CSSF maintains a dedicated FAQ addressing exactly this category of SIFs and SICARs that do not qualify as AIFs. For those vehicles, there is no AIFM to appoint in the first place, because the AIFM Law only governs the management of AIFs. That means the actual investment decision-making has to be exercised genuinely by the vehicle's own board or management, there is no external manager's substance to point to. In practice, this pushes these non-AIF SICARs and SIFs toward needing more of their own real presence, a genuine office, real decision-makers on the ground, than a comparable AIF vehicle with a properly appointed AIFM, precisely because the delegation route simply isn't available to them.

And this is exactly where a CSSF licence can mislead. Take a non-AIF SICAR with part of its board genuinely based in Luxembourg (real directors, real meetings, real minutes) but with little to no operational activity beyond those board sittings: no dedicated staff, no premises used for anything but signing off decisions a few times a year, no evidence that anyone in Luxembourg is actually running the investment day to day. The CSSF's central administration test can, in practice, tolerate a fairly light footprint here, since board-level governance with genuine deliberation is itself a meaningful marker of central administration under Circular 25/901. But a CSSF licence is a domestic regulatory finding, not a foreign tax authority's finding, and the two do not automatically travel together. If this SICAR receives French-source income, the DGFiP is not bound by the CSSF's assessment and will apply its own abus de droit and beneficial-ownership analysis: periodic board meetings without ongoing operational reality (no staff performing functions, no evidence of active portfolio work between meetings) read exactly like the pattern the Comité de l'abus de droit fiscal and the Conseil d'État have penalised in cases like Holdem/Fidem. A structure can be entirely compliant with its Luxembourg licence and still lose a French withholding exemption on exactly this fact pattern, because "the board meets here" answers the CSSF's question, but not the DGFiP's, which is closer to "does anything happen here between meetings."

2. The overlooked middle case: active investment management without CSSF licence and without an AIFM: This is the scenario clients most often get wrong, because they assume "unregulated" means "light substance." If a manager takes investment decisions itself, as its actual commercial activity, for itself or on behalf of others, without CSSF authorisation and without appointing a licensed AIFM to do it instead, that activity doesn't escape scrutiny by staying below the CSSF's radar. It falls under general commercial law: the Law of 2 September 2011 regulating access to the professions of trader, craftsman, industrialist and certain liberal professions requires an autorisation d'établissement (business permit) before the activity can lawfully start, issued by the Ministry of the Economy.

This authorisation carries its own, very literal substance test, arguably stricter than the CSSF's, because it leaves no room for interpretation:

• The company must hold a genuine private office: case law and administrative practice under the 2011 Law make clear that a company carrying on commercial activity cannot rely on domiciliation alone; a real, exclusive physical premises is required.
• The authorisation holder (the natural person who is manager or administrateur délégué) must ensure the day-to-day management effectively and permanently, through physical presence at the establishment, not periodic visits, not a monthly appearance.
• The authorisation is granted to the individual, not the company, and lapses if that person leaves: a fresh application is required within six months.
• Operating without this authorisation is a criminal offence, and can render contracts entered into by the company void and jeopardise insurance coverage.

This is precisely the trap in the 8m² scenario: a foreign manager who is, in substance, making investment decisions from a Luxembourg entity (not through a licensed AIFM, not through a CSSF-authorised structure) needs this business permit, and the law's physical-presence requirement is not a soft "central administration" test open to argument. It requires permanent, physical, daily management presence. One junior employee present one day a month cannot hold or exercise this authorisation on the manager's behalf, and a shared 8m² unit is a difficult sell as "genuine private premises."

3. Passive SOPARFI and other unregulated holding companies: No CSSF licence and, if the company is genuinely passive (holding participations, not taking active investment or trading decisions as a business), generally no autorisation d'établissement either, since pure asset-holding for one's own account typically falls outside the scope of "commercial activity" under the 2011 Law. Luxembourg law does not impose one fixed statutory substance checklist here. The exposure is instead fiscal: a SOPARFI without real substance risks having its participation exemption, treaty access, or EU directive benefits denied by the Luxembourg ACD, but more commonly today by a foreign tax authority challenging the structure at the source-country end.

The practical dividing line clients should understand:

The key point: domiciliation is legitimate and CSSF-supervised as a regulated activity in itself (domiciliation agents must be authorised and are themselves subject to AML obligations toward the entities they host). The problem isn't using a domiciliation agent, most passive holding SOPARFIs correctly do. The problem is using domiciliation language to dress up what is actually meant to look, to a foreign tax auditor, like operational management.

Why the recent Luxembourg controls happened

Why: Luxembourg's financial centre depends on international credibility: for treaty access, for EU passporting, and for its FATF standing. Every high-profile "letterbox company" story (OpenLux-style reporting, EU Tax Observatory data on empty shells) puts that credibility, and by extension every genuinely substantial Luxembourg structure, at risk. The CSSF and the AED both have institutional incentive to be seen policing substance proactively rather than reactively.

What: Recent supervisory activity has combined (i) CSSF thematic and on-site inspections of regulated investment vehicles covering governance and delegation; (ii) the consolidation exercise under Circular 25/901 tightening SICAR and SIF governance expectations; and (iii) closer ACD and AED scrutiny of SOPARFI and fund substance in the context of GAAR, CFC rules, transfer pricing, and cross-checks against VAT and taxe d'abonnement filings, particularly where a structure's declared function looks disproportionate to its staffing.

When: This is not a single event but a build-up: intensified AML/CFT on-site inspections through 2022–2024, Circular 25/901 (December 2025), and CSSF's stated 2026 supervisory priorities explicitly naming governance and third-party/delegation risk as focus areas.

Conclusions: Luxembourg is not becoming hostile to foreign managers or holding structures: it remains one of the most sophisticated fund and holding jurisdictions in the EU. But the tolerance for symbolic substance has collapsed, and it is now checked from several directions at once: licensing, direct tax, and indirect tax/AML. The expectation is documented, demonstrable, proportionate operational reality, proportionate to the vehicle's activity, not to a generic minimum.

The EU and foreign tax authorities: a parallel, tougher track

This is arguably the more consequential shift for cross-border structures, and it runs largely independently of anything the CSSF does.

The EU's dedicated "Unshell Directive" (ATAD 3), which would have created a harmonised EU-wide substance gateway test, was formally abandoned by the EU Council on 18 June 2025 after three years without unanimous agreement. But, and this is the point clients underestimate, its objective did not disappear. The Council intends to fold anti-shell substance principles into a reform of DAC6 (the EU's mandatory disclosure regime), expected to move forward during 2026, reusing existing reporting hallmarks and infrastructure rather than creating a new standalone test.

In the meantime, substance is already being enforced through instruments that never went away: the General Anti-Abuse Rule, the OECD/EU Principal Purpose Test in tax treaties, CFC rules, and, most sharply, source-country withholding tax audits. A French, German, Italian, or Spanish tax authority denying a withholding exemption on dividends or interest paid up to a Luxembourg SOPARFI doesn't need ATAD 3: it only needs to show the Luxembourg entity lacks the substance to be the genuine "beneficial owner" of the income, drawing on the same body of CJEU case law (the Danish beneficial ownership cases) that predates ATAD 3 entirely. That challenge happens at the source, often years after the structure was set up, and it is where most real-world substance disputes are actually being fought today, not in Luxembourg, but in the courts of the paying jurisdiction.

What French, German and Italian tax authorities actually think, and do

These three source-country administrations don't wait for Luxembourg or for Brussels. Each has its own domestic doctrine, its own audit trigger, and its own case law, and each is actively using it.

France: abuse of law, with a lowered bar since 2019. The French tax authority (DGFiP) attacks weak-substance Luxembourg holdings through the general abuse-of-law doctrine, article L64 of the Livre des procédures fiscales, reinforced by article L64 A, which lowered the threshold from an exclusively tax-motivated purpose to a principally tax-motivated one. The Comité de l'abus de droit fiscal has repeatedly characterised undersubstantiated Luxembourg holdings as hollow shells interposed for the sole purpose of letting shareholders capture a disposal gain or dividend stream free of French tax. A CSSF licence offers no shield here: as noted above, a CSSF-authorised SICAR with a genuine Luxembourg-based board but little operational activity between meetings can satisfy its Luxembourg regulator while still failing this test, because the DGFiP looks past the licence to the same underlying question: staff, ongoing activity, and real decision-making, weighed very differently by each authority. The Conseil d'État's December 2023 Holdem/Fidem ruling (n° 470038) confirmed abuse of law on a dividend-routing structure through a Luxembourg holding even though a lawful alternative existed to reach the same economic result, a precedent practitioners now expect to extend to other holding-based structures. Given the four-to-six-year lag between an audit opening and an appellate decision, cases opened in 2020–2022 are only now reaching the courts, with more still in the pipeline.

Germany: denial at the source, plus a reverse exposure. Germany's dedicated anti-treaty/directive-shopping provision, §50d(3) EStG, denies the EU Parent-Subsidiary Directive exemption outright where the EU recipient lacks genuine economic substance: no staff, no premises, no real decision-making. Crucially, this is checked before the money moves: German-source dividends are subject to withholding at 26.375% unless the recipient first obtains a Freistellungsbescheinigung from the Bundeszentralamt für Steuern (BZSt), which scrutinises substance at the application stage rather than waiting for a later audit. Germany also runs the risk in the opposite direction: its permanent establishment ("Betriebsstätte") threshold is notably low: German case law has found a taxable presence created by arrangements as minimal as a locked storage locker used by an employee. A Luxembourg SOPARFI whose real decision-makers are, in substance, working out of Germany risks not only losing the directive benefit but creating an unwanted German taxable presence for the Luxembourg entity itself.

Italy: moving from presumption to full substance analysis. 2026 marks a shift in the Agenzia delle Entrate's approach to what it calls "holding abusiva" (abusive holding), driven by the 2023–2024 tax-reform decrees, notably Legislative Decree 13/2024. Assessments must now set out in detail the specific indicators of artificiality relied upon, following a mandatory prior adversarial exchange with the taxpayer: a real procedural safeguard, but also a signal that the Agenzia is building more rigorous, substance-based cases rather than presumptive ones. The indicators it most commonly cites: absence of staff, no genuine operating premises, costs inconsistent with an actual management function, and strategic decisions taken directly by the individual shareholders or by the underlying operating companies rather than by the holding itself. On the treaty side, a February 2025 ruling of the Corte di Giustizia Tributaria di secondo grado della Lombardia (n° 541/2025) upheld the Agenzia's position that intermediate Luxembourg holdings lacking economic substance were not genuine, applying a "look-through" approach to identify the real beneficial owner for treaty-rate purposes. Italy also runs its own reverse-substance risk through "esterovestizione": a Luxembourg holding whose board decisions are, in substance, made from Italy can be reclassified as Italian tax resident regardless of its Luxembourg incorporation.

The common thread: none of France, Germany, or Italy needs ATAD 3, the CSSF, or even Luxembourg's own ACD to act. Each has its own domestic anti-abuse machinery: abus de droit in France, §50d(3) EStG in Germany, holding abusiva/esterovestizione in Italy; each audits independently, often years after the structure was set up, using precisely the substance markers this article keeps returning to: real staff, real premises, and evidence of where decisions actually get made.

The provocative example: why the 8m² box doesn't work

A foreign investment manager sets up a Luxembourg office consisting of an 8m² room in a business-park unit in an industrial zone, shared with several other unrelated companies, staffed by one junior employee who comes in one day a month. Say this manager is taking investment decisions directly, not through a licensed AIFM, not under a CSSF authorisation.

This fails on every layer at once:

1. It fails the autorisation d'établissement test at the most literal level, before any tax or CSSF question even arises. If this entity is taking its own investment decisions as a commercial activity, it needs a business permit under the Law of 2 September 2011, and that law requires a genuine private office and permanent, physical, daily management presence by the authorisation holder. A shared 8m² unit is a hard sell as "private," and one junior employee present four percent of the working month cannot satisfy "permanent" under any reading of the text. Operating without this authorisation isn't a grey area: it's a criminal offence, and it can void the contracts the entity signs.
2. It fails the CSSF's central administration test outright, if the entity is instead structured as a regulated vehicle. Directorship, execution, and control cannot occur through one junior employee present four percent of the working month. There is no one there to actually manage, decide, monitor delegation, or respond to a supervisory request on short notice, which is precisely what circulars like 21/769 are designed to catch. And appointing an AIFM doesn't rescue this scenario if the box is meant to be the AIFM's own office: the delegation logic above only works if the AIFM itself has genuine substance. A shell AIFM "managing" a shell vehicle is two failures, not one fix.
3. It fails proportionality, not just presence. Regulators and tax auditors don't apply a flat headcount test: they compare the resources on the ground to the function the entity claims to perform. An entity claiming to house active portfolio management, risk oversight, or investment decision-making cannot credibly do so with one junior, non-decision-making employee present a handful of hours a month. The mismatch between claimed function and observed capacity is exactly the "gateway" logic that ATAD 3 tried to codify and that DAC6's coming reform will likely reuse.
4. It fails the "who actually decided" test. If the investment manager is, in practice, still making the calls from abroad (emailing instructions, dialling into calls, signing documents sent to them rather than drafted on-site), the Luxembourg entity is a conduit, not a decision-maker. Foreign tax authorities look for exactly this pattern: correspondence trails showing the real decision-maker was never in Luxembourg, board minutes that read as pre-scripted rather than deliberative, and a junior employee with no authority to bind the company.
5. It fails optically, and optics matter in a risk-based world. An 8m² shared unit in an industrial zone, rented by a financial structure with cross-border investment flows, is the exact profile that triggers a closer look: whether from a CSSF risk-based selection for an on-site inspection or a foreign auditor building a beneficial-ownership challenge. It doesn't need to be fraudulent to be indefensible; it just needs to be disproportionate to what's being claimed.

The fix is not necessarily "rent a bigger office." It's aligning the resources (space, staff, seniority, decision-making authority, and time on the ground) with what the entity actually does. A passive SOPARFI holding a single participation with infrequent board decisions genuinely can be substance-light and domiciled. A structure claiming active management, regulatory licensing, or meaningful economic function cannot.

Sources

• CSSF, Legal requirements and authorisation procedure for investment firms (updated 4 March 2026)
• CSSF Circular 25/901 (19 December 2025) and accompanying Concepts Compilation, consolidated framework for SIFs, SICARs and Part II UCIs
• CSSF Circular 22/811 (central administration of Luxembourg investment funds, "UCI administrator" delegation)
• CSSF, FAQ concerning SIFs and SICARs that do not qualify as Alternative Investment Funds (AIFs)
• Law of 15 June 2004 relating to investment companies in risk capital (SICAR Law), as amended
• CSSF Circular 21/769 (telework and central administration substance)
• CSSF, The CSSF's 2026 priorities for supervising the investment fund sector (March 2026)
• Law of 5 April 1993 on the financial sector, as amended (LFS), Articles 13–24-9
• Administration de l'Enregistrement, des Domaines et de la TVA (AED), role as Luxembourg's third fiscal administration and AML/CFT control authority
• EU Council, discontinuation of ATAD 3 negotiations (18 June 2025) and announced integration of substance principles into a DAC6 reform expected in 2026
• CJEU, Danish beneficial ownership cases (as the ongoing basis for source-country substance challenges independent of ATAD 3)
• France: Livre des procédures fiscales, articles L64 and L64 A; Conseil d'État, 12 December 2023, n° 470038 (Holdem/Fidem)
• Germany: §50d(3) EStG (anti-treaty/directive-shopping); German Federal Fiscal Court case law on the Betriebsstätte (permanent establishment) threshold
• Italy: Legislative Decree 13/2024 (tax reform, assessment and contraddittorio preventivo rules); Corte di Giustizia Tributaria di secondo grado della Lombardia, 20 February 2025, n° 541
• Law of 2 September 2011 regulating access to the professions of trader, craftsman, industrialist and certain liberal professions, as amended (autorisation d'établissement regime); Guichet.lu, business permit application guidance

This article reflects the regulatory and tax landscape as of August 2026 and is provided for general information. It does not constitute legal or tax advice for any specific structure.