Why this framework looks the way it is

Before we open a single legal text, you need to understand why the Luxembourg anti money laundering framework is built out of four separate instruments rather than one. Because if you do not, you will spend the next two years looking for obligations in the wrong document. The framework has four layers, and each one exists for a different reason. At the top there is a law voted by parliament, the Law of 12 November 2004.

It sets out the obligations in principle. It says that you must know who your customer is, that you must assess risk, that you must report suspicion. It does not tell you how. Below that there is a grand ducal regulation, the one of 1 February 2010. Its job is to fill in the detail that parliament deliberately did not put in the law, because detail changes faster than laws can be amended. Below that again there is a CSSF regulation, number 12-02.

This is the one you will actually live in. It is where the operational requirements sit: what your organisation must look like, who must be appointed, what must be documented, what must be reported and when. And around all of it sit CSSF circulars, which are not law at all. They are the supervisor telling you how it intends to read the rules. We will come back to that distinction, because it matters more than most people realise.

One more thing about this framework before we go further. It is not stable. In July 2026 alone, two separate laws amended the 2004 Law. And on 10 July 2027, under article 90 of Regulation (EU) 2024/1624, a European regulation takes over much of what you are about to learn and applies directly, without any Luxembourg text in between. Not all of it: Directive (EU) 2024/1640 sits alongside the Regulation and still has to be transposed, so the Luxembourg layers do not disappear, they narrow. That is not a reason to skip this module. It is the reason to do it properly.