PSD2 – PSP ICT Assessment – 2026 Campaign related to the financial year 2025

(published on 9 February 2026, updated on 10 February 2026)

As of 9 February 9 2026, the “PSD2 – PSP ICT Assessment campaign” related to the financial year 2025 is available for professionals concerned. Through this annual reporting, PSPs are required to provide the CSSF with an updated and comprehensive risk assessment related to payment services (cf. Circular CSSF 25/880).

The expected questionnaires have to be submitted using one of the following methods:

The webform in the dedicated eDesk procedure “PSD2 – PSP ICT Assessment”,
Pre-filing of the webform is also available through API solution (S3 protocol).

Dedicated user guide will be available through the eDesk procedure.

For any questions, please contact edesk@cssf.lu.

Name	Description	Duration
cssf_cookies	Saves information regarding the user's consent to the use of cookies for each optional category.	1 year
ROUTEID	Technical cookie allowing load distribution.	Deleted when the browsing session ends
TBMCookie*	Security: This cookies protects the website against automated attacks.	Deleted when the browsing session ends
__utmvc	These first party cookies are set by a third party service to filter out malicious requests.	Deleted when the browsing session ends
__utmvm*	These first party cookies are set by a third party service to filter out malicious requests.	15 minutes

Name	Description	Duration
cssf_profile	This cookie adapts the website pages to the profile chosen by the visitor (professionals, markets, consumers).	1 year
pll_language	This cookie saves the user’s language choice.	1 year

Name	Description	Duration
_pk_id.#	Collects anonymous statistical data on the website consultations, such as the number of visits or the average time spent on the website. The data is processed in-house and is not shared with a third party.	1 year
_pk_ses.#	Collects anonymous statistical data for the tracking of the pages consulted during the browsing session. The data is processed in-house and is not shared with a third party.	30 minutes