Business Phone Systems for Fiduciaries in Luxembourg

Business Phone Systems for Fiduciaries in Luxembourg

Business Phone Systems for Fiduciaries in Luxembourg

by PBX.lu Editorial on July 30, 2026
Luxembourg has several hundred fiduciary firms, and most of them answer the phone on behalf of companies that are not their own. That single fact separates fiduciary telephony from banking telephony and from law firm telephony. This article sets out what a fiduciary needs from a phone system, which Luxembourg rules actually bite, and how to configure the system so it holds up under an inspection.
The word fiduciaire covers a wide range of firms in Luxembourg, from two-person bookkeeping practices to regulated corporate service providers with a hundred staff. The rules that apply to your phone system depend on which of those you are, so the article starts there.
🔎 Short answer A fiduciary needs a phone system that keeps client entities separate, records who spoke to whom, and satisfies professional secrecy and outsourcing rules. Most fiduciaries are not investment firms, so MiFID II trade recording does not apply. The binding constraints are professional secrecy, AML record keeping, CSSF Circular 22/806 on outsourcing, and GDPR. A Cloud PBX hosted in the EU by an ILR-licensed operator meets these once recording scope, retention, and access rights are set deliberately rather than left on default.

Why a fiduciary's phone system is not a smaller version of a bank's

Fiduciaire A Luxembourg firm providing accounting, tax, corporate secretarial, and company administration services to client companies. The term is commercial, not a regulated licence in itself.
Domiciliation agent A firm authorised to let a client company establish its registered office at the agent's address. Only credit institutions, professionals of the financial sector, and members of the regulated legal, audit, and accountancy professions may act as one.
The consequence is easy to state and hard to design around. If forty client companies are registered at your address, your main number is the published contact point for forty legal entities. A caller asking for a specific company is calling an entity with no employees, no desk, and no phone of its own. Reception has to route that call to the right client manager without revealing anything about the structure behind it.
Two more pressures shape the requirement. Fiduciary workload is intensely seasonal, clustering around annual accounts, tax filing deadlines, and AGM season, so inbound volume is uneven rather than steady. And client managers each carry a portfolio, which means the routing question is never "which department" but "who owns this entity today".
📇 The reception script problem
A caller says they are calling about a company you domicile. Confirming the relationship out loud can already be a disclosure. Practical setups avoid this by routing on the caller rather than the entity, using known caller numbers mapped to client managers, and by training reception to take a name and call back on a verified number rather than confirming anything on an unverified inbound call.

Which rules apply depends on your status

Fiduciaries in Luxembourg sit in one of three supervisory buckets, and mixing them up is the most common source of over-engineering or under-engineering a phone system.
🏛️ Bucket 1: CSSF-supervised specialised PFS Firms authorised as corporate domiciliation agents (Article 28-9 of the Law of 5 April 1993) or as professionals providing company incorporation and management services (Article 28-10). These carry the heaviest obligations: prudential supervision, statutory professional secrecy, and formal outsourcing governance.
📐 Bucket 2: Members of a regulated profession Expert-comptables supervised by the Ordre des Experts-Comptables, and réviseurs d'entreprises supervised by the Institut des Réviseurs d'Entreprises. Both bodies act as AML self-regulatory organisations for their members and set their own professional conduct rules.
🗂️ Bucket 3: Neither of the above Bookkeeping and administrative service firms operating under a business permit, without CSSF authorisation or membership of a regulated profession. AML supervision falls to the Administration de l'enregistrement, des domaines et de la TVA.
📌 The key point most fiduciaries get wrong MiFID II call recording obligations apply to investment firms handling client orders. A fiduciary that does not receive, transmit, or execute orders is generally outside that regime. Copying a bank's recording configuration therefore imports cost, storage, and privacy exposure without any legal benefit. Decide what to record from your own obligations, not from the sector next door.

Where the rules actually touch the phone system

Four obligations reach into telephony. None of them is about voice quality.
Professional secrecy. For specialised PFS, Article 41 of the Law of 5 April 1993 makes client information confidential under criminal sanction. Call recordings, voicemail messages, AI transcripts, and call detail records are all client information. Giving a telephony provider technical access to that data is a disclosure, and Article 41(2a) governs how it may be done. For expert-comptables, an equivalent professional secrecy duty applies through the profession's own rules.
AML and CFT record keeping. The Law of 12 November 2004 requires client due diligence and evidence that it was performed. Phone calls are rarely the primary record, but call notes, callback verifications, and recordings of unusual instructions can end up in the client file. Where they do, the telephony retention period has to match the AML retention period, not the provider's default.
Outsourcing governance. Circular CSSF 22/806, as amended by Circular 25/883, sets the outsourcing framework for supervised entities. It requires a register of arrangements, prior notification to the CSSF for critical or important functions, minimum contractual clauses, sub-outsourcing visibility, and a documented exit plan.
⚠️ A detail worth checking with your compliance officer DORA applies to banks, investment firms, payment and e-money institutions, fund managers, insurers, and crypto-asset service providers. Most fiduciaries are not in that list. Where DORA does apply, Circular 22/806 was narrowed to business process outsourcing only, because DORA covers ICT. Where DORA does not apply, Circular 22/806 remains fully applicable to both business process and ICT outsourcing. In other words, a non-DORA fiduciary still carries the full 22/806 treatment for a cloud telephony contract.
GDPR and recording. Recording a call processes personal data of both parties. You need a lawful basis, a clear announcement, a defined retention period, and a proportionate scope. Recording everything because the platform allows it is the classic failure. The call recording policy template covers the document itself, and data residency and related terms are defined in the glossary.
🔐 What to ask a provider before signing
Where are recordings and call detail records physically stored, and can that be fixed contractually to the EU. Who at the provider can technically access them, and is that access logged. Which subcontractors are in the chain. What happens to your data on exit, in what format, and within how many days. Can the provider support a CSSF notification with the documentation you will need. These questions belong in the outsourcing register regardless of which bucket you fall into.

A practical setup for a Luxembourg fiduciary

The following configuration covers the common case: a firm of ten to sixty people, a domiciliation portfolio, and clients calling in four languages.
Numbering. Keep one published main number for the firm and give every client manager a direct number. Do not publish separate numbers per client entity, which multiplies cost and creates a directory you have to maintain forever. Existing numbers can move across with you, and the porting process in Luxembourg takes planning rather than luck.
Language before department. Route on language first, then on function, then to the individual. Luxembourg fiduciary clients typically call in French, German, English, and Luxembourgish, and a wrong-language transfer costs more time than an extra menu level. The multilingual routing guide sets out the menu structure.
Recording scope, not recording everything. Enable recording on client-facing lines where instructions are received. Exclude reception, HR, IT, and internal-only extensions. Set retention explicitly against your AML and file retention periods, then leave it alone. Call recording explains the mechanics.
Access rights that mirror your governance. The compliance officer or managing partner gets archive access, client managers get their own calls only, and every retrieval is logged. If a client manager can pull a colleague's recordings, you have created a secrecy problem inside your own firm.
One business identity on mobile. Client managers travel to notaries, banks, and client offices. Their business number should ring on desk, laptop, and mobile, and outbound calls should present the business number. Personal mobile numbers in a client's contact list survive the employee's departure, which is both a secrecy risk and a client-ownership risk. See fixed mobile convergence.
Plan for the deadline weeks. Add call queues with position announcements and overflow rules for the periods around filing deadlines, and review analytics after each peak rather than guessing. Continuity matters more than average uptime here, and the business continuity guide covers failover to mobile when a line or site goes down.
Offboarding as a standing procedure. When a client manager leaves, their direct number should be reassigned or forwarded the same day, and their recording access revoked before the laptop is returned.

Provider considerations in Luxembourg

Four operators active in the Luxembourg market, described here to illustrate the trade-offs a fiduciary should weigh rather than to recommend one. The full list is on the provider comparison page.
🇱🇺 Voxbi, Cloud PBX by Mixvoip Luxembourg operator, ILR-licensed, with published pricing and numbers across LU, BE, FR, and DE in one account. Suits fiduciaries wanting per-extension recording control and transparent per-user cost without a sales cycle. Honest limitation: Mixvoip is full-stack rather than voice-only, but it layers over multi-backbone partners instead of owning a national fibre backbone and its own Tier III or IV data centres.
🇱🇺 POST Telecom and DEEP The national operator and its B2B brand, with the largest network footprint in the country. Relevant detail for regulated fiduciaries: CSSF prudential supervision extends to POST Luxembourg's provision of financial services, which can shorten some compliance conversations. Trade-off: pricing is generally quote-based.
🇱🇺 Cegecom Business ISP and telecom operator with its own infrastructure, offering Cloud PBX and SIP trunking. Suits fiduciaries that want connectivity and telephony from an operator owning more of the physical path. Trade-off: fewer self-service controls than platform-first providers.
🇱🇺 Telkea Historic Luxembourg ICT and telecom operator offering managed telephony alongside connectivity and managed IT. Suits firms with no internal IT function that prefer a single managed contract. Trade-off: a managed model gives you less direct control over day-to-day configuration.
🔗 On bundling telephony with your internet line
Bundling can simplify billing and support. It also couples two decisions: if you later change internet provider, you may be forced to change phone system at the same time. For a fiduciary with an outsourcing register and an exit plan to maintain, keeping the two contracts separable is worth asking about explicitly. Some providers support either arrangement; the point is to ask before signing, not after.

Three mistakes that come up repeatedly

Recording everything "to be safe". It increases storage cost, widens the secrecy exposure, and creates a discovery surface you have to defend. Scope it, or you have made the risk worse rather than better.
Treating a cloud telephony contract as a utility purchase. For a supervised fiduciary it is an outsourcing arrangement with register, notification, and exit-plan consequences. The time to discover that is before signature.
Leaving retention on the provider default. Defaults are typically six to twenty-four months and are set for general business, not for AML file retention. Two numbers that should match, and usually do not.
📚 Working out what your firm actually needs? Explore the features guide, compare providers active in Luxembourg and the Greater Region, or read the industry pages for financial services and legal and professional services. If you are still scoping, the Cloud PBX buying checklist works through cost and requirements step by step.
📅 Ready to explore Cloud PBX for your business? A short conversation with an independent consultant, covering your status, your client portfolio, and your compliance obligations. Free, about twenty minutes.
Book a Demo | Compare providers | Explore features