CSSF Warns: Decimal Global Limited Has No Luxembourg Licence
Luxembourg's financial-sector regulator, the Commission de Surveillance du Secteur Financier (CSSF), published a public warning on 14 October 2026 confirming that Decimal Global Limited is not authorised to provide investment services or any other financial services in or from Luxembourg, and that the entity is not subject to CSSF supervision in any form. For accounting firms, auditors, and CFOs whose clients may have exposure to this entity, the warning is an immediate compliance trigger, not background reading.
What the CSSF Warning Actually Says
The CSSF's notice is direct: Decimal Global Limited has not been granted any authorisation to provide investment services or other financial services in or from Luxembourg, and it is not supervised by the CSSF. The regulator characterises the entity's activities as fraudulent, which elevates the alert beyond a routine "not on our register" notice into an active fraud warning.
Why the Framing of "Fraudulent Activities" Matters
Regulators do not use the word "fraudulent" casually in formal public warnings. When the CSSF applies that characterisation, it signals that the entity in question is not merely unlicensed through administrative oversight or a pending application; it is operating in a manner the regulator considers deceptive. That distinction is legally significant for anyone who has already transacted with Decimal Global Limited, because it affects how those transactions should be assessed from a proceeds-of-crime and money-laundering-risk perspective.
Under Luxembourg's AML framework, which implements the EU's Anti-Money Laundering Directives, financial services providers and designated non-financial businesses and professions, a category that includes accountants and auditors, must assess whether funds originate from or are connected to fraud. A CSSF fraud warning is exactly the kind of red-flag trigger that the Financial Intelligence Unit (CRF) and CSSF supervisory guidance contemplate.
The Regulatory Basis for the Warning
The CSSF has authority under Luxembourg law to issue public alerts about entities carrying out regulated activities without authorisation. Luxembourg's financial services landscape requires any firm providing investment services, including services that touch crypto assets categorised as financial instruments, to hold the relevant CSSF licence. Operating without one is a criminal offence under Luxembourg law, regardless of where the entity is formally incorporated.
Implications for Accounting Firms and Auditors
When a regulator names an entity as fraudulent and unlicensed, the downstream compliance burden falls not only on investors who may have placed funds with that entity, but on the professional advisers, accountants, auditors, and tax practitioners who service those investors.
Client Portfolio Reviews
The first practical step for any accounting firm receiving this news is a targeted search of the client base. That means checking onboarding records, transaction histories, and any communications referencing Decimal Global Limited. If a match is found, the firm's AML compliance officer needs to be involved immediately. The question is not only whether funds were transferred to or from Decimal Global Limited, but whether any accounting entries, financial statements, or tax filings reflect balances or returns attributable to that entity.
Accounting records that carry asset valuations or income figures sourced from an entity now flagged as fraudulent may need to be reassessed. Depending on the materiality and the nature of the engagement, this could affect audit opinions, management accounts, or tax returns already submitted.
Suspicious Activity Reporting Obligations
Luxembourg's AML regime, overseen by the CRF and supervised for accountants and auditors by the Institut des Réviseurs d'Entreprises (IRE) and the Ordre des Experts-Comptables (OEC), requires a suspicious transaction report (STR) when a professional has reasonable grounds to suspect that funds are linked to money laundering or fraud. A CSSF public warning naming an entity as fraudulent and unlicensed provides those reasonable grounds. Firms should not wait for certainty before filing; the legal standard is suspicion, not proof.
The obligation to report sits alongside the tipping-off prohibition. Firms cannot alert the client that a report has been made or is being considered. That means the client relationship management and the AML reporting process must be handled separately and with care.
Digital Asset Accounting Records and Crypto Bookkeeping Software
If a client's exposure to Decimal Global Limited involved crypto assets, the accounting challenge deepens. Crypto bookkeeping software and digital asset accounting software used by the firm must be able to trace the transaction chain: which wallet addresses received or sent funds, at what time, and at what valuation. Where records are incomplete or where the client relied solely on statements issued by Decimal Global Limited itself, those figures are now unreliable. Firms should flag any crypto asset balance or gain figure that was sourced exclusively from the unlicensed entity and consider whether independent on-chain verification is possible.
This is one context where robust crypto accounting software workflows, capturing on-chain data directly rather than relying on third-party statements, prove their value. Auditors reviewing engagements with any exposure here should revisit how balances were verified at the prior period end.
Implications for CFOs and Finance Teams
For a corporate finance function, the warning raises two distinct concerns: counterparty risk and financial reporting integrity.
Counterparty Risk Assessment
Any payable, receivable, or investment recorded against Decimal Global Limited in a company's books now requires immediate review. An entity characterised as fraudulent by its host-country regulator is not a counterparty from whom a recovery of funds can be assumed. Finance teams should consider whether any asset recorded in connection with Decimal Global Limited should be written down or impaired in the current reporting period, and whether that impairment triggers any disclosure obligation under IFRS or Luxembourg GAAP.
The timing of the CSSF warning, 14 October 2026, is relevant for period-end purposes. Companies with a 31 December 2026 year-end will need to assess whether this is an adjusting or non-adjusting event under IAS 10. Given that the warning relates to fraudulent activities that presumably predated the publication date, there is a reasonable argument that the condition existed before the year-end, which would make it an adjusting event for those preparing accounts on a going-concern basis.
Internal Controls and Vendor Due Diligence
The wider lesson for CFOs is one of vendor and counterparty verification. Luxembourg's investment services regime is transparent: the CSSF publishes a public register of authorised entities, and checking that register before entering a financial services relationship is a basic control. If Decimal Global Limited was not on that register at the point of engagement, the internal control failure is at the onboarding stage.
Finance teams should use this warning as a prompt to audit their counterparty verification procedures, particularly for any relationships involving crypto assets or digital investment products, where the market still includes a higher proportion of unlicensed operators than traditional financial services.
The Broader Luxembourg Enforcement Context
This warning does not sit in isolation. The CSSF has been actively publishing alerts about unlicensed operators, and the pattern reflects broader supervisory pressure across the EU as MiCA implementation tightens the regulatory perimeter for crypto asset service providers. Entities that previously operated in regulatory grey areas are now being called out explicitly.
The warning about Decimal Global Limited follows a similar CSSF alert about Domiafx, another entity found to be operating investment services in Luxembourg without authorisation. Accounting firms tracking CSSF warnings on unlicensed operators in Luxembourg will recognise the pattern: the regulator is systematically working through entities flagged by investors or detected through supervisory monitoring and making them public.
At the EU level, the AMLA framework is also tightening the obligations on professional advisers. Firms should be aware of how the AMLA simplified due-diligence roundtables affect EU firms and what changes to customer risk categorisation are being discussed at the supranational level. An unlicensed entity flagged for fraud sits firmly at the enhanced-due-diligence end of that spectrum.
Practical Steps for Firms to Take Now
The checklist below is grounded in the specific facts of this warning and standard EU AML obligations. It is not a substitute for your firm's own legal and compliance advice.
Immediate Actions
First, search your client relationship management and onboarding systems for any reference to Decimal Global Limited, including variant spellings or abbreviations. Second, pull any transaction records, account statements, or correspondence referencing this entity and route them to your AML compliance officer. Third, check whether any financial statements, management accounts, or tax filings prepared for clients contain figures sourced from Decimal Global Limited. Fourth, assess whether an STR is required and, if so, file without delay and without tipping off the client.
Medium-Term Controls
Review your counterparty onboarding procedures to confirm that CSSF register checks are a mandatory step before any new financial services relationship is initiated. Where clients hold or have held crypto assets through third-party platforms or investment services providers, verify that those providers are on the CSSF register or, for cross-border services, on the relevant EEA national register. Update your periodic review timetable to include a check against the CSSF's public warning list, which is updated on an ongoing basis.
Frequently Asked Questions
Is Decimal Global Limited regulated anywhere in the EU?
The CSSF's warning states that the entity is not supervised by the CSSF and has not been granted any authorisation in Luxembourg. The warning does not confirm authorisation in any other EU jurisdiction. Firms should check the registers of any other relevant national competent authority if they have reason to believe the entity claimed authorisation elsewhere.
Does this warning mean client funds are necessarily lost?
The CSSF warning does not make a specific statement about the recoverability of client funds. However, the characterisation of the entity's activities as fraudulent means that firms should not assume funds are recoverable without independent legal advice. Any asset recorded in connection with Decimal Global Limited should be treated as potentially impaired until further information is available.
What is the reporting deadline for an STR in Luxembourg?
Luxembourg AML law does not set a fixed number of days for filing an STR, but the obligation arises as soon as the professional has grounds for suspicion. The CSSF's public fraud warning provides those grounds. Firms should file promptly and should not delay while seeking additional evidence; suspicion, not certainty, is the legal threshold.
How should crypto asset balances linked to Decimal Global Limited be treated in accounts?
Any crypto asset balance or gain figure sourced solely from statements or representations by Decimal Global Limited should be treated as unverified. Where independent on-chain verification is possible, that should be pursued. Where it is not, the balance may need to be written down or disclosed as a contingent asset depending on the circumstances. Your auditor should be informed immediately if any such balance appears in the financial statements.
Is this warning relevant for firms using crypto accounting software to manage client portfolios?
Yes. Crypto accounting software and digital asset accounting software are only as reliable as the source data they ingest. If transaction data from Decimal Global Limited was imported into a firm's accounting records, that data should be treated with heightened scepticism and cross-referenced against on-chain sources where possible. The warning underscores why data provenance, knowing where every figure in a crypto bookkeeping workflow originated, is a core control requirement.
Source: CSSF Luxembourg