Fund Governance: How Your Luxembourg Fund Is Run and Controlled

Who governs a Luxembourg fund

Five bodies share the task. The board of the fund — or the general partner and its managers for a partnership — is responsible for the vehicle: constitutive documents, appointments, investor information. The AIFM or management company manages portfolio and risk and carries the organisational rules of the AIFM law, the UCI law and Circular 18/698. The depositary safekeeps the assets, monitors cash and oversees the fund's key operations. The administrator calculates the NAV and keeps the register; the approved statutory auditor audits the annual accounts and must report serious breaches to the CSSF itself (UCI law Article 154(3)).

Behind them stand the supervisors: the CSSF for UCITS, UCI Part II funds, SIFs, SICARs and every authorised manager; the AED for the anti-money laundering supervision of RAIFs and other unregulated AIFs. The articles or partnership agreement, the prospectus or issuing document and the service agreements allocate the roles — and the board remains responsible for having chosen and supervised the others.

The board of the fund

A UCITS SICAV is always an SA; a UCI Part II fund, a SIF or a RAIF in corporate form may be an SA, SCA, SCS, SCSp, S.à r.l. or cooperative. An SA has a board of at least three directors, one while it has a single shareholder, appointed for up to six years and revocable at any time (Law of 10 August 1915, Article 441-2). An SCA is run by the managers named in its articles, an SCSp by its general partner or the managers named in the partnership agreement; an FCP has no board — the management company's board acts for it. Unanimous written resolutions are valid where the articles allow, directors may take part by video-conference unless the articles exclude it (Articles 444-3, 444-4), and a director with a conflicting interest must declare it and abstain (Article 441-7).

For regulated funds the CSSF approves the people: the directors of a SIF and of a SICAR are "subject to approval by the CSSF" (SIF law Article 42(3), SICAR law Article 12(3)); for UCITS and UCI Part II funds the law requires that their identity be communicated to the CSSF forthwith, and the CSSF treats every new director as an approval request (UCI law Articles 27(1), 129(5); CSSF FAQ on the market-entry form). The file is the same: CV, declaration of honour, criminal-record extracts, identity document. A RAIF's board is not approved by the CSSF — the RAIF states on its cover page that it is not supervised, and supervision runs through its authorised AIFM — but investors apply the same test.

The manager: board, conducting officers, substance

An authorised AIFM or management company is the engine of the governance. The law requires that its business be decided by at least two natural persons, employed or committed full-time and domiciled in the EU (AIFM law Article 7(1)(c), UCI law Article 102(1)(c), as amended by the Law of 3 March 2026). Circular 18/698 adds the Luxembourg layer: a board of at least three members that meets at least every quarter (points 59, 74); at least two conducting officers who are permanently located in Luxembourg, employed full-time and approved by the CSSF before they start (points 78–80, 104); at least three full-time staff in key functions (point 123); the decision-making and administrative centre in Luxembourg (points 115–120).

The circular also caps the mandates: a board member's professional engagements may not exceed 1,920 hours and 20 mandates a year without written justification (points 69–71), and a conducting officer's other conducting-officer mandates depend on the assets under management, with EUR 1.5 billion as the dividing line (points 81–82). The conducting officers meet monthly in Luxembourg and keep minutes (points 100–101). A registered sub-threshold AIFM has none of these organisational duties — only registration, reporting and AML — which is why institutional investors ask for more than the law.

Control functions

The AIFM law separates the risk-management function functionally and hierarchically from the operating units, including portfolio management (Article 14(1)), and requires a valuation function that is independent from portfolio management, or an external valuer (Article 17(4)). Delegated Regulation 231/2013 adds the permanent compliance function (Article 61), the internal audit function where proportionate (Article 62) and the list of what senior management must ensure — investment policy, valuation policy, risk limits, remuneration policy — with written reports to the governing body at least once a year (Article 60).

Circular 18/698 turns this into three permanent control functions — compliance, risk management, internal audit — each with its own head approved by the board and notified to the CSSF, direct access to the board, the auditor and the CSSF, and an annual report filed within five months of year-end (points 162–172, 212, 258, 301). Compliance and internal audit stay in Luxembourg and may only be outsourced by prior derogation (points 226, 261). Remuneration follows Article 12 and Annex II of the AIFM law and the ESMA guidelines; conflicts of interest are identified, managed, recorded and disclosed under Article 13 and Articles 30–37 of the Delegated Regulation.

Delegation and oversight

A manager may delegate portfolio management, risk management, administration or distribution, but not its responsibility. The AIFM law requires notification to the CSSF before the arrangement takes effect, objective reasons for the whole delegation structure, a qualified delegate, effective supervision and the right to withdraw the mandate at once; portfolio or risk management may only go to an authorised and supervised undertaking, never to the depositary (Article 18(1)–(2)). A manager that delegates so much that it no longer manages is a letter-box entity (Article 18(3); Delegated Regulation Article 82).

Circular 18/698 sets the practice: written initial due diligence signed before the contract starts, a contract with instruction, access and termination rights, ongoing monitoring that cannot itself be delegated, a due diligence cycle of generally three years, a periodic written critical analysis, an annual list of delegates and prior CSSF approval of any change of delegate (points 424–469). From 16 April 2027 managers also report their delegation data to the CSSF — delegates, staff, assets delegated, due diligence reviews — under the amended Article 22. The CSSF's sanctions of 2024–2026 have targeted exactly this: delegates not reviewed, best execution not checked.

The depositary

Every UCITS, UCI Part II fund, SIF, SICAR and RAIF has a single depositary established in Luxembourg. Beyond safekeeping, the AIFM law gives it three oversight tasks: monitoring the fund's cash flows, holding the financial instruments in custody and verifying ownership of the other assets, and checking that subscriptions and redemptions, the valuation of units, the manager's instructions, the settlement of transactions and the application of income comply with the law and the fund documents (Article 19(7)–(9); UCI law Articles 18 and 34 for UCITS).

The depositary is liable for the loss of a financial instrument held in custody — it returns an identical instrument or the corresponding amount without undue delay unless the loss results from an external event beyond its reasonable control — and for other losses caused by negligence or intentional failure (Article 19(12)); for a UCITS this liability cannot be excluded or limited by contract (UCI law Article 19). Under Circular 24/856 the depositary that detects a NAV error or breach informs the fund's directors and, if they do not act, the CSSF (point 25). For the board this means a depositary agreement that mirrors these duties and information flows that let the depositary actually oversee.

NAV errors and investment breaches

Since 1 January 2025 Circular CSSF 24/856 governs NAV calculation errors and non-compliance with investment rules for UCITS, UCI Part II funds, SIFs and SICARs, and for RAIFs only where they are ELTIFs, money-market funds, EuVECAs or EuSEFs (points 1–4). An error is significant when it reaches the tolerance threshold: 0.20% of NAV for money-market funds, 0.50% for UCITS bond and mixed funds, 1.00% for equity and other UCITS, the same table for UCI Part II funds and ELTIFs sold to retail investors; for funds reserved to well-informed investors the directors set the threshold with the manager, up to 5% of NAV (point 35). Significant errors are notified to the CSSF within four to eight weeks of detection, corrected, and the investors and the fund are compensated by the party that caused the loss — never out of the fund's assets (points 15, 118–135, 158).

The circular also covers what the old Circular 02/77 did not: wrong application of swing pricing or cut-off times, cost and fee errors — notifiable whatever the amount — allocation errors, and active investment breaches; passive breaches are corrected but not notified (points 54–56, 97–115). Closed-ended funds are outside the NAV-error chapter but must still value correctly (point 27). In 2025 the CSSF received 2,218 notifications under the circular, two thirds of them investment breaches (feedback report of 5 October 2026).

Anti-money laundering governance

A fund and its manager are each a professional under the Law of 12 November 2004. Each appoints a compliance officer at the appropriate hierarchical level — the RC — and, among the members of its management body or effective direction, the person responsible for compliance — the RR (Article 4(1)). For a fund without authorised management the RR is a board member or the board as a whole; the fund and the manager may appoint a third party as RC; the names are communicated to the CSSF beforehand (CSSF Regulation 12-02, Articles 1, 40). The RC reports to the board at least once a year, and the RR files that summary report with the CSSF within five months of year-end unless the fund's Luxembourg management company does so (Article 42(6)–(7)).

For UCITS, UCI Part II funds, SIFs, SICARs and authorised managers the supervisor is the CSSF, which also runs an annual AML/CFT questionnaire (Article 4(3)); for RAIFs and other unregulated AIFs it is the AED (AML law Article 2-1(8)). At the manager, the RR and the RC must be permanently located in Luxembourg and employed by it, and the internal audit reviews the AML framework every year (Circular 18/698, points 313–320). The two AML laws of July 2026 changed the national framework, not the duties of funds and managers.

Policies, meetings and records

The law speaks of functions and policies; investors and the CSSF look at how they are lived. A governance that holds up has a board calendar — quarterly meetings are the floor Circular 18/698 sets for managers, and what fund boards usually adopt — agendas that cover performance, risk, compliance, delegates and the reports of depositary and auditor, minutes that show real deliberation, and a conflicts register. Policies to keep current: conflicts of interest, remuneration, valuation, liquidity management tools (since 16 April 2026 every open-ended AIF selects at least two from the statutory list — AIFM law Article 15-1), complaints handling (CSSF Regulation 16-07: a responsible person at management level, acknowledgement within ten business days, answer within one month, annual report), personal transactions, whistleblowing, and sustainability risks (page /esg-sfdr).

The ALFI Code of Conduct for Luxembourg investment funds (2022 revision, eleven principles) is the industry's reference: a balanced board with a formal appointment procedure, consideration of independent members, sufficient time, periodic self-evaluation, minuted meetings, and the board's responsibility for every delegated activity. It is a voluntary code, not law — but one that investors and the CSSF expect to see applied or explained.

DORA and ICT risk

Since 17 January 2025 the Digital Operational Resilience Act (Regulation (EU) 2022/2554) applies to AIFMs and management companies, but not to registered sub-threshold AIFMs (Articles 2(1)(k)–(l), 2(3)(a)). The management body carries the final responsibility for ICT risk: it approves the ICT risk-management framework, the strategy and the budget, establishes a role or names a senior manager to oversee ICT third parties, and follows regular training (Article 5(2)–(4)). The manager keeps a register of its ICT third-party contracts, which the CSSF collects every year between 28 February and 31 March (Article 28(3); Circular 25/882), reports major ICT incidents through the CSSF portal (Article 19; Circular 25/893), tests its resilience and puts the prescribed clauses in every ICT contract (Articles 24–25, 30).

Since April 2025 the CSSF's outsourcing Circular 22/806 no longer applies to authorised managers; DORA and the CSSF's DORA circulars replace it. A fund is not itself a DORA entity unless it is internally managed, but its data and operations sit with entities that are — manager, administrator, depositary, transfer agent — so the board checks that each of them is covered and that the contracts contain the DORA clauses.

Who is responsible for the governance of a Luxembourg fund?

The board of the fund — or the general partner — is responsible for the vehicle; the AIFM or management company for portfolio and risk management and for its own organisation; the depositary for safekeeping, cash monitoring and oversight; the administrator for the NAV and the register; the auditor for the accounts. The board chooses and supervises the others and answers to the investors and, for regulated funds, to the CSSF. Delegation never moves responsibility.

How many directors does a Luxembourg fund need, and must they live in Luxembourg?

An SA needs at least three directors, one while it has a single shareholder; an SCA and an SCSp are run by their managers or general partner; an FCP has none of its own. No Luxembourg law requires fund directors to be resident in Luxembourg or a minimum number of independent directors. What the law requires is the fund's head office in Luxembourg, directors of good repute and experience whom the CSSF approves for regulated funds, and, for the manager, two full-time persons domiciled in the EU and conducting officers permanently in Luxembourg. In practice investors expect a majority that is present at meetings and at least one independent member.

What are conducting officers?

The persons who effectively conduct the business of an authorised AIFM or management company — the dirigeants. The law requires at least two natural persons, employed or committed full-time and domiciled in the EU. Circular 18/698 requires them to be permanently located in Luxembourg, approved by the CSSF before they start, with defined areas of responsibility — portfolio management, risk, compliance, administration, distribution, AML — so that no one controls a risk they take themselves; they meet monthly and minute their decisions. Their other conducting-officer mandates are capped by the assets they manage.

Does the CSSF approve the directors of my fund?

For a SIF and a SICAR, yes, by law — appointment and every replacement are subject to the CSSF's approval. For a UCITS and a UCI Part II fund the law requires that their identity be communicated to the CSSF forthwith, and the CSSF handles every new director as an approval request with CV, declaration of honour, criminal-record extracts and identity document. For a RAIF or an unregulated partnership, no: the CSSF supervises the authorised AIFM, not the fund. For every authorised manager the CSSF approves the board members and the conducting officers.

What happens when the NAV is wrong?

Circular 24/856 applies. The error is measured against the tolerance threshold of the fund type — 0.20% for money-market funds, 0.50% for UCITS bond and mixed funds, 1.00% for equity funds, up to 5% set by the directors for funds reserved to well-informed investors. If it reaches the threshold, the CSSF is notified within four to eight weeks, the NAV is corrected, investors who dealt at the wrong price and the fund are compensated by the party at fault, and the auditor reports where the compensation is large. Below the threshold the error is corrected and documented. The same circular covers investment breaches, cost and fee errors, swing-pricing and cut-off errors.

Must a Luxembourg fund have independent directors?

No law requires it, and neither does the AIFMD or the UCITS Directive; the European Commission is to assess by April 2029 whether to require at least one independent or non-executive director. The ALFI Code of Conduct recommends that boards consider independent members, and institutional investors often ask for at least one. For a sponsor an independent director is usually the cheapest credibility a fund can buy — provided the person has the time: Circular 18/698's cap of 20 mandates and 1,920 hours a year is the benchmark everyone uses.

Does DORA apply to my fund?

To its authorised AIFM or management company, yes, since 17 January 2025; to a registered sub-threshold AIFM, no. The fund itself is a DORA entity only if it is internally managed. Its data and operations nevertheless sit with entities that are covered — manager, administrator, depositary, transfer agent — so the board checks that each of them keeps the register of information, reports incidents and has the DORA clauses in its contracts.