Authorization as a financial service provider requires an application to the CSSF. An applicant must complete a formal process to obtain authorization, which involves the completion of required application forms and the submission of supporting information. The documents that have to be provided for submission to the regulator will depend on the nature of the regulated activities to be conducted.

The application file will vary depending on the license. However, it must generally include the following:

• Main application form – This form is the core document that must be completed. The five sections within this form include details about the applicant, information on the shareholder structure, the contemplated activities and the central administration, the infrastructure, and the internal governance of the firm
• Articles (or draft articles) of incorporation, together with an extract from the Trade and Companies Register in Luxembourg if the entity has already been incorporated
• Detailed memorandum describing the contemplated activities
• Supporting documents with regard to the identification of the group head shareholder, the beneficial owner, the direct shareholders having a qualifying holding, and the shareholders’ agreement (where applicable)
• Annual report and accounts for the previous three years (if the entity has already been incorporated)
• Organization chart of the company
• Names, curriculum vitae, criminal records in each country where the person has lived for the past five years and in the country/countries of their nationality/nationalities (issued within the last three months), and personal declaration of honor of natural persons and of each board member and each supervisory board member, as well as of the people who will be responsible for the day-to-day management of the entity
• Engagement letter of the external auditor
• Name and curriculum vitae of the compliance officer and of the internal auditor
• Provisional budget for each of the three upcoming years
• Details of the human, technical and material resources to be employed in Luxembourg
• AML and KYC procedures
• Description of the IT infrastructure
• Description of the compliance and risk management function
• Information on the membership in an authorized investor compensation scheme

In relation to timing, in most cases the regulator takes six months from receipt of a completed application to determine whether or not to approve the application. The approval must typically be decided on within 12 months after the receipt of the application. The absence of a decision within 12 months shall be deemed to constitute rejection of the application.

Luxembourg has adopted a technology-neutral strategy in relation to fintech; there is no "regulatory sandbox." The legal qualification of each project presented to the CSSF is assessed on the basis of the services effectively provided, regardless of the technology used, with a risk-based approach, to assess the way the chosen technology is implemented. However, the CSSF has created an Innovation Hub, consisting of a dedicated point of contact for market players to contact it in order to present an innovative project, request information on the regulatory framework applicable to a project, or to initiate a dialogue regarding new technologies or regulations that may impact the financial sector.