AML/CFT and KYC in Luxembourg practice

Learning objectives

• Identify which of the four instruments in the Luxembourg framework (the Law of 12 November 2004, the Grand-ducal Regulation of 1 February 2010, CSSF Regulation 12-02 and CSSF circulars) carries a given obligation, and state which of them bind and which do not.
• State what articles 2, 3, 4 and 5 of the Law of 12 November 2004 require, and locate the two articles inserted in July 2026, distinguishing whom each is addressed to: article 9-1quinquies on the national risk assessment, which binds the Comite de prevention rather than the entity, and article 5-1 on flagging by the CRF, which is voluntary and open only to article 2(1) points 1 and 20.
• Determine whether an entity is in scope under article 2, including at the three edges the module identifies: the fund and its management company, the registered manager, and the service provider.
• Navigate CSSF Regulation 12-02 to the provisions on risk assessment, due diligence, the content of internal procedures in article 38, the two responsible persons in articles 40 to 45, and the external audit report in article 49.

Learning objectives

• Distinguish the responsable du respect (RR) from the responsable du contrôle (RC): which of the two carries the responsibility from the management body, and which runs the function and is the privileged contact point under article 42(4).
• Apply article 40 of CSSF Regulation 12-02 to appointment and notification, including that every change of holder is notifiable, and state what the CSSF assesses and what the declaration of honour requires.
• Apply articles 41 and 43 to delegation and to the accumulation of functions, and record in writing, in advance, the reasoning for any combination of roles.
• Identify the three documents that leave the entity each year (the RC summary report under article 42(6), its submission by the RR under article 42(7), and the auditor report under article 49) and state what article 8-4 of the 2004 Law permits against a named individual.

Learning objectives

• Produce a documented risk assessment at the level of your entity, and read it against the four things an inspector looks for: that it exists as a dated document with an author and an approval, that it is about you, that something follows from it, and that it is alive.
• Carry the identification of a legal-person customer through its ownership and control structure to the end of the chain, and record the purpose of the relationship rather than leaving it as the thinnest part of the file.
• Apply the beneficial ownership rules: the 25 per cent starting point, control as a second test, the fallback to senior managing officials, the standing of the RBE after the CJEU judgment of 22 November 2022 and the Law of 23 January 2025, and the duty to report a discrepancy between the register and your own findings.
• Apply enhanced due diligence to a politically exposed person (senior management approval, source of wealth distinguished from source of funds, and enhanced ongoing monitoring) and state what remote onboarding and due diligence on the asset side add to a fund.

Learning objectives

• Distinguish ongoing monitoring as an obligation under article 3 from the system that supports it, and keep the customer profile the monitoring measures against current.
• Apply the three thresholds in article 5 (knowledge, suspicion, and reasonable grounds to suspect) including attempted transactions and the absence of any minimum amount, and act on the standard of time the article sets.
• File through goAML as the exclusive channel, with the entity registration and the certificate arranged before they are needed, and include the information and documents that prompted the report.
• Apply the prohibition on disclosure and the duty in article 5(3) to refrain from carrying out the transaction on your own suspicion, and state what article 5-1, inserted by the Law of 22 July 2026, does and does not require, including who may request the flags, the prohibition on revealing them and the six month deletion obligation.
• Distinguish the source-of-funds question in money laundering from the intended-use and recipient questions in terrorist financing.
• Apply article 5 to suspected terrorist financing, including small amounts, attempted transactions and funds linked to terrorists.
• Assess an NPO through its governance, funding, activities, beneficiaries and delivery channels.
• Distinguish the CRF reporting path from applicable sanctions, asset-freeze and notification duties.

Learning objectives

• Distinguish the sanctions regime from the AML regime: a prohibition that is not calibrated to risk, with no de minimis, and a different set of authorities including the Ministry of Finance for execution and exceptional authorisations.
• Determine whether Circular CSSF 25/896 is addressed to the entity at all, and operate screening to the standard applicable since 30 December 2025: which lists, which persons including beneficial owners and the asset side, at which moments, and the resolution and recording of every hit.
• Act on a confirmed match: freeze, do not make funds or economic resources available directly or indirectly, notify the Ministry of Finance, never release on your own authority, and recognise where an article 5 obligation to the CRF arises alongside.

Learning objectives

• Submit the AML market entry form correctly for a fund structure (once for the umbrella rather than once per sub-fund) and recognise when a material change means the supervisor no longer holds an accurate picture of the entity.
• Run the annual cycle of the self assessment questionnaire, the auditor report and the sector-wide data collection, and reconcile the self assessment with the auditor report before either is filed.
• Explain what changed in 2026, when the CSSF deployed AMLA data collection templates through its circular letters of February and March in place of its own questionnaire, and state how few entities the AMLA will directly supervise.

Learning objectives

• Explain what the direct applicability of Regulation (EU) 2024/1624 from 10 July 2027 does to internal procedures that cite Luxembourg provisions, and why the citation work is the largest item by volume.
• State three figures the way the text states them: the EUR 10 000 large cash payment limit as a ceiling member states may lower, the 25 per cent beneficial ownership threshold retained with a power to lower it to at most 15 per cent by delegated act, and 10 July 2029 for professional football clubs and agents.
• Distinguish the two roles of the AMLA (direct supervision of a small number of selected entities, and standard setting and coordination that reaches everybody) and identify which of them applies to your entity.
• Build the gap analysis as a four-column table, sequenced by lead time rather than by importance, with a named owner and a review date.