The Law of 12 November 2004, and what it actually requires

Open the coordinated text of the 2004 Law. Coordinated means the CSSF has consolidated every amendment into one readable document, and you should always work from that version rather than the original, because the original is now unrecognisable. Three articles carry most of the weight. Article 2 tells you who is caught. We will spend the whole of the next lesson on it, because getting this wrong is the single most expensive mistake in this field.

Article 3 is customer due diligence. It states the obligation to identify the customer, to identify the beneficial owner, to understand the purpose of the relationship and to monitor it on an ongoing basis. Note the structure of the sentence: these are four separate obligations, not one obligation with four parts. In an inspection they are tested separately, and you can fail one while passing the other three. Article 4 is internal organisation.

This is where the requirement to appoint responsible persons comes from, which we cover in Module 2. Now, the reporting obligation. Article 5 requires you to report suspicion to the Cellule de Renseignement Financier, the CRF. Not to the CSSF, not to the police. To the CRF, and through a single channel, which we cover in Module 4. And here is what changed this summer. The Law of 16 July 2026 inserted a new article 9-1quinquies.

Read who it is addressed to before you read what it says, because it is not addressed to you. Article 9-1quinquies puts the national risk assessment on the Comité de prévention: the committee keeps it up to date and revises it at least every four years, more often or by ad hoc sectoral assessments if the risk situation demands, and it must take account of the European Commission's supranational assessment. The minister publishes a report on the results. That is state architecture, not an entity obligation. Your obligation to do something with it is older and sits elsewhere, in article 2-2, and we come to it in Module 3. The Law of 22 July 2026 inserted a new article 5-1, dealing with flagging by the CRF. That is, the situation where the financial intelligence unit itself signals something to you, rather than you reporting to it. It runs in the opposite direction to article 5, it is new, and it reaches a much narrower population than article 5 does.

If you are watching this and you have a set of internal procedures written before the summer of 2026, they do not cover either of these articles. That is worth checking this week.