It was not CSSF director-general ’s first time at the EFPA Finance Forum, he noted at the start of his keynote speech at the conference, having been present at the first edition over a decade ago. “I have the advantage of not having been given a topic, so basically, I can talk about what I want. And so what I wanted to give you is--first of all--a little bit about the priorities of 2025 for the CSSF,” he said, with a focus on the banking and the fund industries.

The priorities of the Luxembourg Financial Sector Supervisory Commission are largely aligned with those of the European Central Bank, the European Banking Authority and the European Securities and Markets Authority. “On the banking side, the first priority--obviously--is credit risk. You may have heard that there was a slight overheating and under construction in Luxembourg, and so we are following very closely the mortgage side of things, but even more importantly, the corporate lending, the construction, and what we call promotion or development in Luxembourg.”

“I can reassure you that there is no systemic risk there, but nevertheless, the non-performing loans--which is one metric that we follow very closely--is higher than it used to be. And also, I think we are not necessarily at the end of the tunnel, because when the construction of new houses and apartments stopped, obviously, the order book of all the people helping in the construction was still full, and for another two to three years. But that is coming to an end now. The government has implemented a certain number of measures, and so we will see how this works out.”

A second point of interest concerns ICT and cyber risks. “You have heard about Dora,” said Marx, referring to the . It aims to strengthen digital operational resilience through five pillars: ICT risk management; ICT incident management, classification and reporting; digital operational resilience testing; ICT third-party risk; and information sharing. “I think this is very important to bear in mind, especially given the international context that we have now.”

“The other side of things is the digital transformation. And I think in Luxembourg, we have a huge finance industry. We have a very good startup environment,” he continued. “But the sector is still under-utilising the possibilities of technology.” This has a certain number of disadvantages, he argued, from a revenue perspective, from an efficiency perspective and from a survival perspective. “At the end of the day, bankers will always focus on their core business, which is managing clients’ money and extending loans. But all the rest of it is going to be mutualised, externalised and so on. And I think fintechs have a big role to play. There are so many solutions that are available and that are not being used, which is quite surprising… We don’t have a choice going forward. We must think how to better utilise what’s out there.” Artificial intelligence, for example, can play a role in making compliance checks more efficient.

“The third priority is operational risk,” said Marx. “That’s--of course--regulatory compliance with new regulations, the transition to Basel III [international standards and minimums for the capital requirements of banks, editor’s note], ESG.”

“The objective here is to support the stability and resilience of the financial system,” he said. “We have many more priorities, but for banking, I would say those are the three key priorities.”

ESG and sustainability risks: importance of data

Turning to the fund industry, a key priority is liquidity risk. That’s something that’s “always high not only on our agenda, but also Europe’s agenda, and beyond that, I would say Iosco’s agenda and the Financial Stability Board at the G7 level.”

“Then we have ESG and sustainability risks. We will follow up on and finalise the common supervisory external sustainability risks and disclosures,” he continued. “We look at greenwashing risk, and we look at sustainability data. Data--in this area, like in all areas--is key. And again, this is an area where there’s still much improvement that can be achieved. Proper management of data is going to be the future.”

The CSSF also looks at asset valuation risk and IT risks, noted Marx.

“As you can see from these key priorities--both in the banking and the fund area--the EU and Luxembourg remain committed to the ESG agenda,” he said. And this, “despite voices in some jurisdictions--that I will not name--saying that climate change is not true and all of that is less of a priority. Or, indeed, the weakening of the Net-Zero Alliance, after the withdrawal of some large international institutions.”

The Net-Zero Banking Alliance is a global group of banks that have committed to aligning their activities with net-zero greenhouse gas emissions by 2050. It has like Bank of America, Citigroup, Goldman Sachs, JPMorgan Chase, Morgan Stanley and Wells Fargo in recent weeks.

“You should stay focussed on ESG,” Marx emphasised, referring to the report by the Intergovernmental Panel on Climate Change (IPCC) assessing the impacts of climate change. This is an “expert group of scientists in 195 countries, and I believe what they are saying, and what they have been saying for many years. There is a real impact of climate change on people,” he said, noting that 2024 was the warmest year on record. “I think this should be the ultimate wake-up call that we have to take this issue seriously.”

Cyberattacks expected to increase, be more impactful

Marx then switched gears, commenting on “hot topics” and providing some “general reflections that are not necessarily CSSF reflections,” but were more “personal.”

First: geopolitics. “As a regulator, obviously, we are watching closely what is happening in the world. We have a war that is at a two-hour flight from here.” Russia’s full-scale war against Ukraine has been continuing for three years now. “So obviously, we must be watching what is happening here, and we must also be thinking: what’s the impact on the financial centre.”

These days, there is a particular focus on US sanctions, he noted. “Since 2017, we had elected at the CSSF to expect all financial institutions to comply with US sanctions.” This is important because of payments in US dollars. “The risk is if you don’t comply with US sanctions, you are at risk of being cut off from the US correspondent banking system and the dollar payment system, which is equal to a death penalty normally in the finance sector. Therefore this is very important, and I would say it’s again a good time to check a little bit whether [sanctions compliance] is being done.”

I think we should be wary that we are likely to see also more cyberattacks

Claude Marx, director-general, CSSF

Another important element is cyber risk. “In the EU, we are now talking a lot about EU defence, and we have in mind, you know, Russian tanks coming to the EU and rolling down Boulevard Royal, and that is obviously something we should be worried about.” European Commission president Ursula von der Leyen last week  for the continent’s defence, which was on 6 March. But that’s all about physical security. “I think we should be wary that we are likely to see also more cyberattacks.”

“There have already been a number of cyberattacks; some of them have been state-sponsored. We have seen a number of sabotage actions, also state-sponsored. But I think we are only at the beginning, unfortunately, of this. We are going to be seeing more of those attacks and more impactful attacks, unfortunately, there is clearly a need to not only invest in making sure that Russian tanks don’t drive down Boulevard Royal, but also in cybersecurity from an EU perspective, but also from a Luxembourg national perspective, and then obviously, also in the financial centre.”

Dora can be helpful in this case as it requires people to focus on ICT risk management, digital operational resilience testing, and the sharing of information and intelligence. “Technology is helping,” said Marx. “Here, with generative AI, we can predict much better attacks.” The Luxembourg House of Financial Technology (Lhoft), he pointed out, often sees companies present solutions that can help address cyberattacks.

Savings and investment union “must succeed”

Another topic Marx discussed was the capital markets union, an initiative launched by then-European Commission president Jean-Claude Juncker in 2014. It aims to break down obstacles to cross-border investments, making it easier for companies and infrastructure projects to get the necessary financing. “I must say, the European Commission--and the European Union as a whole--has actually failed for many years on this agenda, and not much has happened.”

It’s back on the agenda, and with a new name: the savings and investment union. “Today, we don’t really have a choice. It must succeed,” said Marx. “And the reason is very simple. We’ve had two very expensive things to finance: first, the digital transition; and second, the green transition.”

“But now comes a third, very expensive thing that we have to finance, which is our defence.” Von der Leyen’s €800bn defence plan “is actually very good for the European economy. It’s good for the industry, and of course, it’s good for our defence. And hopefully a piece of that will go to cyber defence.”

This means that massive amounts of financing need to be found, “and the only way to do this is [through] private finance. And the only way to have private finance is to have efficient capital markets.” Levers to achieve the capital markets union include harmonisation, securitisation, common supervision and retail investment.

“That’s the really important one: retail investment,” said Marx. EU household savings represent around €35trn, of which roughly one-third (34%) is sitting in bank accounts, deposits or in cash. That figure is much higher than in the US (14%). “Just imagine having 10% more into the real economy. We talk about €3.5trn. That is money that we need to finance the three major blocs [the green transition, digital transition and defence].”

Marx highlighted two ways to boost the savings and investment union. “One is to get households to invest in the real EU economy, and we could do that through savings products that are simple… and benefit from tax advantages,” he said, providing an example of a Luxembourg product that existed 30-some years ago. The second way is through pension reform. “All countries have a pension issue. Nobody wants to talk about it, but it’s there. We need to move to mandatory funded pension systems with pillar two and then also pillar three.”

In Sweden, for example, there is the  to complement their public pension, as Bernard Delbecque, senior director of economics and research at the European Fund and Asset Management Association, explained during a webinar last year.

Simplification does not equal deregulation

“Another topic I want to touch upon is simplification,” said Marx. “We have had a real big wakeup call in the European Union, and the commission has finally recognised that we can’t continue to add layer after layer after layer to regulations.”

“That doesn’t work. It doesn’t work for the market; it doesn’t work for the regulator; it works for nobody. And so we need to simplify.”

“We need to get rid of rules that are not fit for purpose, that are not delivering on what they were intended to.” But, Marx cautioned, “simplify doesn’t mean deregulate.” Just two years ago--in March 2023--. One of them--Silicon Valley Bank--was the 16th largest bank in the US. A few weeks after, . Before, bank failures like this would have “triggered a global financial crisis,” he said. But “that hasn’t happened because of the capital requirements that we have in place, because of the Basel III agenda. So we should keep this in mind.”

Importance of financial education

Marx’s final topic was financial education, a subject “dear” to his heart. It’s not only important to prevent personal over-indebtedness, but also for fraud prevention. “What we have seen the last five, seven years is lots of fraud being rolled out through social media, through Tiktok, through Instagram, through Youtube,” he said. “It’s important to educate, especially young people who could be tempted to use those channels to become rich very quickly.”

But there’s another reason to invest in financial education, said Marx, coming back to an earlier point: the savings and investment union. If people don’t understand what a share, a bond or an investment fund is, how can they be expected to want to invest their money in the real economy? “There is a minimum financial education needed to make this happen.”

In 2015, he explained, the CSSF was tasked by the government to work out a strategy for financial education. “We have revised the strategy in the wake of the coalition agreement, but also in the wake of the fraud aspects and the capital markets union. And we’re looking forward with the government to rolling out a revised strategy.”