Global Trustee and Fiduciary Services Bite-Sized Issue 10 2026

6 AIFMD CRYPTOASSETS FINTECH FUND LIQUIDITY OPERATIONAL RESILIENCE SUSTAINABLE FINANCE/ ESG T+1 ASIA PACIFIC EUROPE NORTH AMERICA UNITED KINGDOM Global Trustee and Fiduciary Services Bite-Sized | Issue 10 | 2026 Quick Links • Specialised investment funds governed by the Law of 13 February 2007 (the “2007 Law”); and • Investment companies in risk capital governed by the Law of 15 June 2004 (the “2004 Law”). The CSSF says the update aligns with its ongoing efforts to facilitate and streamline administrative processes for financial market participants. The suspension of redemptions only (without suspension of subscriptions) does not qualify as an LMT under the 2026 Law but is integrated into the “LMT activation” module to simplify notification procedures for market participants. The CSSF says the activation and deactivation of a suspension of redemptions must be notified from 21 September 2026 through the eDesk “LMT activation” module. However, the administrative requirements, including the submission of supporting documentation, remain unchanged and must continue to be submitted to the CSSF through the usual communication channels. The CSSF reminds Luxembourg-domiciled funds subject to Part II of the 2010 Law that are not managed by a Luxembourg-domiciled authorised AIFM, that they must also notify the CSSF of the activation or deactivation of suspensions of subscriptions, repurchases and redemptions, as well as the creation of side pockets previously approved by the CSSF under the “LMT activation” module, as required under the respective sectoral laws. The same applies to Luxembourg- domiciled funds subject to the 2007 Law and the 2004 Law, which do not qualify as AIFs or are not managed by a Luxembourg-domiciled authorised AIFM. In addition, the CSSF reiterates the requirements under the 2026 Law to select, activate, and deactivate LMTs through the eDesk procedure. The CSSF wishes to emphasise that existing sub- funds, as from 16 April 2026, as well as new sub-funds, as from the date of their establishment, must comply with these requirements. Link to the Communiqué here OPERATIONAL RESILIENCE Additional CSSF Operational Instructions on DORAMajor ICT-related Incident Reporting On 29 September 2026, the Commission de Surveillance du Secteur Financier (CSSF) issued a communiqué drawing the attention of financial entities to the publication of the European Supervisory Authorities’ (EBA, EIOPA, and ESMA – the ESAs) operational instructions regarding the reporting of major ICT-related incidents under the Digital Operational Resilience Act (DORA). The CSSF says it expects financial entities to consider these practical instructions to facilitate the harmonised implementation of their incident reporting processes. The document detailing these operational instructions can be consulted through the following official channels: EBA: DORA incident reporting – Operational Instructions (webpage) ESMA: DORA incident reporting – Operational Instructions (webpage ) The CSSF says that, in addition to the messages conveyed in the ESAs’ releases, it would like to highlight supplementary operational instructions to be taken into account to enhance the quality of information submitted in the DORA major ICT-related incident reports, improve the efficiency of the reporting process and reduce subsequent exchanges. The CSSF says that financial entities are expected to take due account of these practical instructions. Link to Communiqué here AFM Publishes IT Recovery Strategy On 29 September 2026, the Netherlands Authority for the Financial Markets (AFM) published the results of its study into the extent to which asset managers are prepared for a major IT outage. The AFM says the study shows that, in general, the asset managers surveyed are well prepared for IT outages. The key processes, plans, and testing programs are in place. At the same time, the AFM sees room for further improvement. There is not always a clear connection between critical functions, recovery objectives, dependencies on IT service providers, and the way in which recovery is tested. It is precisely this connection that is important for ensuring that services can be restored quickly, even in the event of serious disruptions.