Illustrative firm examples
Luxembourg country research brief
Research dated 2026-10-11 · Reviewed 2026-10-10
Version ce129eb346c3
ce129eb346c3a62bfcb20a818f95598876d98f5233161138ac282d868c12bfa3Scope: Illustrative firm examples. The selector is not an authorisation or legal-applicability determination. Source-check observations concern retrieval/access only and do not establish legal currentness; the research date is the content date boundary. Source health: review-required, checked 2026-10-12T06:15:09.119Z.
Framework and authorities
Statutory perimeter and authorities
Luxembourg's 12 November 2004 anti-money laundering and countering the financing of terrorism (AML/CFT) Law covers Article 2's financial and non-financial professionals. The CSSF supervises its supervised, authorised or registered persons; the CAA has an insurance-sector perimeter; the AED supervises non-financial professionals within its remit; self-regulatory bodies have statutory functions. Check the legal actor, activity, product and supervisory route, including CAA Regulation 20/03. The Cellule de renseignement financier (CRF), Luxembourg's financial intelligence unit, requires electronic declarations and communications through goAML, with LuxTrust registration.
Dated evidence and editorial profiles
These examples use reviewed national provisions; profile tags establish neither statutory applicability nor authorisation. The retained law consolidation is applicable on 8 August 2026. CSSF's page, retrieved 10 October, states an update on 7 October; that does not verify subsequent amendments or October legal currentness.
Risk, FATF and sanctions context
National and sector risk are dated context, not a firm score
The national risk assessment (NRA) 2025 covers money-laundering (ML) risk over 2020-2023 and reflects the position at end-2023. It assesses threats, sector vulnerabilities and mitigating factors; the AED index distinguishes this ML update from separate, older terrorist-financing (TF) and legal-person assessments. CSSF's Version 3-2025 collective-investment assessment is a sector-specific update, discusses evolving ML and TF exposure, and directs supervised entities to use its findings proportionately. Neither assessment is a present-day firm or customer rating. For a fund, wealth or other financial profile, test the actual entity, activity, customer, geography, product and distribution channel against applicable supervisory material rather than importing a national or sector label.
Sanctions require instrument-specific analysis
The AED information page describes financial restrictive measures as binding on its identified persons and territorial connections, but is not a designation list or complete statement of each measure. Identify the actual UN, EU or national instrument, actor and territorial nexus, covered conduct and assets, ownership or control rules, exception or licence, and reporting route. No live designation list, match, licence or transaction was checked. Financial Action Task Force (FATF) country-list status is not asserted: a complete dated list statement was not retained. The future EU AML Regulation layer is not treated as a current Luxembourg firm duty here.
Selected firm implications
Meaning: Article 2-2 makes the assessment firm-specific. Consider relevant customer, geographic, product, service, transaction and distribution-channel factors before selecting the overall risk level and controls, and make the documented assessment available to the competent supervisor or self-regulatory body.
Conditions: The measures must be proportionate to the nature and size of the professional. New-product, practice, delivery-mechanism and technology risks must be assessed before launch or use, including technology applied to existing products.
Exceptions: A supervisor or self-regulatory body may decide an individual documented assessment is not required where the specific sector risks are clearly identified and understood; this is not a general firm-level exemption from identifying and managing risk.
Suggested action: For an in-scope professional, document and keep current a proportionate money-laundering and terrorist-financing (ML/TF) risk assessment; incorporate relevant national, supranational and supervisory information; assess new products, practices, distribution mechanisms and technologies before launch or use, then mitigate identified risk.
Legislation / Binding · Article 2-2Meaning: The separate e-money derogation permits omission only of the Article 3(2)(a)-(c) and 3(4) measures, and only when all five conditions hold: non-reloadable or capped at EUR 150 monthly for Luxembourg-only use; stored value no more than EUR 150; goods/services only; no anonymous e-money funding; and issuer monitoring sufficient to detect unusual or suspicious activity.
Conditions: This lower-risk permission is available to professionals in scope only while the relationship or transaction remains lower risk. The e-money alternative requires every listed value, use, funding and monitoring condition; it is not a general waiver of CDD.
Exceptions: Simplified CDD is unavailable if risk is not lower, suspicion exists, prior identity data is doubtful, or a specified higher-risk case applies. The e-money derogation does not cover cash redemption/withdrawal over EUR 50 or remote payments over EUR 50 per transaction. Credit/financial institutions acting as acquirers may accept third-country anonymous prepaid cards only under equivalent standards. A Grand-Ducal regulation may extend, restrict or prohibit this regime.
Suggested action: A professional may apply simplified customer due diligence (CDD) only after assessing lower money-laundering and terrorist-financing risk. Consider at least Annex III factors, retain enough information to evidence eligibility, monitor sufficiently to detect unusual or suspicious activity, and keep eligibility under review.
Legislation / Binding · Article 3-1Notices and limitations
- Illustrative bank, payments and crypto examples, not an assessed firm profile.
- Product/customer exposure alone is not statutory applicability. This is not a licensing guide.
- Local entity / domestic activity selected.
- 2 representative obligations; see the full register for other duties.
- Source observations are unavailable, stale, failed or review-required. This dated brief does not confirm today's legal position.
- Law edition: 8 August 2026; later changes are unverified. NRA and sector findings are dated context, not a firm rating.
- No FATF classification or live sanctions check is claimed. Publication rights are unresolved.
Evidence sources
Original source documents are not reproduced in this brief. Retained originals are private research evidence; use the official-source links.
- Legislation · Journal officiel du Grand-Duché de Luxembourg / Legilux · Consolidated version applicable 8 August 2026; exact retained Legilux XML · Articles 2, 2-1, 2-2(1)-(3), 3-1(1)-(6), Annex III; cross-references: 3(2)(a)-(c), 3(4). Dated 8 August 2026; October currentness unverified.
- Official Supervisory Page · Commission de Surveillance du Secteur Financier (CSSF) · Official page; page states last updated 7 October 2026 · Approach to AML/CFT supervision and CSSF powers; HTML snapshot
- Official Supervisory Page · Administration de l'enregistrement, des domaines et de la TVA (AED) · Official page snapshot retrieved 10 October 2026 · AED supervision of non-financial professionals; HTML snapshot
- Official Regulatory Index · Commissariat aux Assurances (CAA) · Official index snapshot retrieved 10 October 2026; referenced consolidated instruments retain their own dates · CAA AML/CFT legislation and regulations index; not a determination of insurance-product scope
- Sector Regulation · Commissariat aux Assurances (CAA) · Informational coordinated version dated 9 January 2025, incorporating Regulation 24/02; Mémorial texts prevail · Article 2(1)-(4): supervised-person, insurance-product, cross-border and co-insurance boundaries
- Official Fiu Page · Cellule de renseignement financier (CRF) · Official page snapshot retrieved 10 October 2026 · CRF reporting channel and goAML registration information; HTML snapshot
- Official Risk Assessment Index · Administration de l'enregistrement, des domaines et de la TVA (AED) · Official index snapshot retrieved 10 October 2026 · NRA 2025 description, scope, and linked risk assessments; HTML snapshot
- Risk Assessment · Government of the Grand Duchy of Luxembourg / Ministry of Justice · English supporting report; observation period 2020-2023; report reflects situation at end-2023 · Executive summary pp. 2-3; methodology pp. 13-23; sector vulnerability assessments pp. 78-120; full 200-page report
- Sector Risk Assessment · Commission de Surveillance du Secteur Financier (CSSF) · Version 3 - 2025; report update, not an October 2026 firm rating · Methodology and scope pp. 5-6; ML risk evolution pp. 8-12; TF analysis pp. 14-19; full 20-page report
- Official Sanctions Information · Administration de l'enregistrement, des domaines et de la TVA (AED) / Ministry of Finance · Official information page snapshot retrieved 10 October 2026; not a designation list or complete legal text · General sanctions scope and links; HTML snapshot
AML/CFT Law, consolidated to 8 August 2026
Consolidated version applicable 8 August 2026; exact retained Legilux XML · Articles 2, 2-1, 2-2(1)-(3), 3-1(1)-(6), Annex III; cross-references: 3(2)(a)-(c), 3(4). Dated 8 August 2026; October currentness unverified.
Source record
Retrieved 2026-09-27T11:00:00Z. SHA-256: 85970a0e23228513cbd3f1dc5bcbeb825da42c0992b2c1fdef422e4f5368eac6
Source retrieval check
failed · Checked 2026-10-12T06:15:00.513Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
CSSF AML/CFT framework page
Official page; page states last updated 7 October 2026 · Approach to AML/CFT supervision and CSSF powers; HTML snapshot
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: 0af14eedcf198be938c610a78ef24be989eb454f63167416b0351616e24c7ccd
Source retrieval check
review-required · Checked 2026-10-12T06:15:00.919Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
AED AML/CFT supervisory page
Official page snapshot retrieved 10 October 2026 · AED supervision of non-financial professionals; HTML snapshot
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: cd854e2b90fbe2ce4255f3f1700303f97c67c2cc7f80bbdd22e516ae84e196f7
Source retrieval check
observed · Checked 2026-10-12T06:15:03.826Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
CAA AML/CFT laws and regulations index
Official index snapshot retrieved 10 October 2026; referenced consolidated instruments retain their own dates · CAA AML/CFT legislation and regulations index; not a determination of insurance-product scope
Source record
Retrieved 2026-10-10T22:59:28Z. SHA-256: b11a07ffc2f5c21da0c8c3f83c3b00cf4bdaba85c5ec48b09b74d3c7fcf8a767
Source retrieval check
review-required · Checked 2026-10-12T06:15:04.716Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
CAA Regulation 20/03
Informational coordinated version dated 9 January 2025, incorporating Regulation 24/02; Mémorial texts prevail · Article 2(1)-(4): supervised-person, insurance-product, cross-border and co-insurance boundaries
Source record
Retrieved 2026-09-27T11:00:05Z. SHA-256: 055d2dc239d0917a5f4b50cb8aeadb0046ee917723ac9af6e9cdda6ea2d9e5a9
Source retrieval check
observed · Checked 2026-10-12T06:15:05.736Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
CRF reporting page
Official page snapshot retrieved 10 October 2026 · CRF reporting channel and goAML registration information; HTML snapshot
Source record
Retrieved 2026-10-10T22:59:28Z. SHA-256: 956c06b66f3abeeda46848a57257a0f2b907b8977b626cc8357a67282589205c
Source retrieval check
review-required · Checked 2026-10-12T06:15:06.218Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
AED national-risk index
Official index snapshot retrieved 10 October 2026 · NRA 2025 description, scope, and linked risk assessments; HTML snapshot
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: 92b3185481c73deae4d35d4e856471b0e1150826842fd690a5229ddce859fcdc
Source retrieval check
observed · Checked 2026-10-12T06:15:07.118Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
Luxembourg NRA 2025
English supporting report; observation period 2020-2023; report reflects situation at end-2023 · Executive summary pp. 2-3; methodology pp. 13-23; sector vulnerability assessments pp. 78-120; full 200-page report
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: dbe663a88d8db1842cf6abd61bbb42b4f6de4d6ffea57b98fddbbac9639812a3
Source retrieval check
observed · Checked 2026-10-12T06:15:07.898Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
CSSF collective-investment sector risk assessment
Version 3 - 2025; report update, not an October 2026 firm rating · Methodology and scope pp. 5-6; ML risk evolution pp. 8-12; TF analysis pp. 14-19; full 20-page report
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: 1c92a6ddaac097d7b24f28b8c2cc2db1c69d041f88860105fcdf2e97556f676d
Source retrieval check
observed · Checked 2026-10-12T06:15:08.598Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
AED financial-sanctions information page
Official information page snapshot retrieved 10 October 2026; not a designation list or complete legal text · General sanctions scope and links; HTML snapshot
Source record
Retrieved 2026-10-10T22:58:59Z. SHA-256: 49316eb5a81ce2aa99b7f6ec038f4448119d6c5d35dc262c3196c25ceb89922a
Source retrieval check
observed · Checked 2026-10-12T06:15:09.119Z
A retrieval check is an access observation only; it does not establish legal currentness. Research content date boundary: 2026-10-11.
This brief relies on the identified official source edition. Open it using the official-source control.
Retail bank
Meaning
Article 2-2 makes the assessment firm-specific. Consider relevant customer, geographic, product, service, transaction and distribution-channel factors before selecting the overall risk level and controls, and make the documented assessment available to the competent supervisor or self-regulatory body.
Full public provision explanation
Every professional must take proportionate steps to identify, assess and understand its own money-laundering and terrorist-financing (ML/TF) risk, factoring in client, geographic, product, service, transaction and distribution-channel risk. It must weigh all relevant risk factors before setting its overall risk level and the type/level of mitigating measures, fold in findings from the national/supranational risk assessment and from its supervisor, self-regulatory body (SRO) or European Supervisory Authority, and document, keep current and make the risk assessment available to its supervisor or SRO (supervisors/SROs may waive individual documented assessments where sector risk is already clearly identified and understood). Before launching a new product, practice, distribution mechanism or technology (including on existing products), the professional must assess the ML/TF risk it creates and take appropriate mitigating steps.
Suggested action
For an in-scope professional, document and keep current a proportionate money-laundering and terrorist-financing (ML/TF) risk assessment; incorporate relevant national, supranational and supervisory information; assess new products, practices, distribution mechanisms and technologies before launch or use, then mitigate identified risk.
Conditions
The measures must be proportionate to the nature and size of the professional. New-product, practice, delivery-mechanism and technology risks must be assessed before launch or use, including technology applied to existing products.
- Measures must be proportionate to the nature and size of the professional.
Exceptions
A supervisor or self-regulatory body may decide an individual documented assessment is not required where the specific sector risks are clearly identified and understood; this is not a general firm-level exemption from identifying and managing risk.
- Supervisory authorities/SROs may waive the requirement for an individual documented risk assessment where sector-specific risks are already clearly identified and understood.
Payments and e-money
Meaning
The separate e-money derogation permits omission only of the Article 3(2)(a)-(c) and 3(4) measures, and only when all five conditions hold: non-reloadable or capped at EUR 150 monthly for Luxembourg-only use; stored value no more than EUR 150; goods/services only; no anonymous e-money funding; and issuer monitoring sufficient to detect unusual or suspicious activity.
Full public provision explanation
Where a professional's own risk assessment identifies lower money-laundering and terrorist-financing (ML/TF) risk, it may apply simplified customer due diligence (CDD), but only after confirming the lower-risk degree (taking Annex III factors into account) and while still exercising sufficient transaction/relationship monitoring to catch anything unusual. It must always hold enough information to justify eligibility for simplified measures and keep that eligibility under review. A narrow e-money derogation lets professionals skip certain CDD steps only if all of: the instrument cannot be reloaded (or is capped at EUR 150/month, Luxembourg-only); maximum stored value is EUR 150; it is usable only for goods/services; it cannot be funded with anonymous e-money; and the issuer monitors transactions. The derogation does not apply to cash redemptions/withdrawals above EUR 50 or remote payments above EUR 50/transaction, and credit/financial institutions acting as acquirers may only accept third-country anonymous prepaid cards meeting equivalent standards. Simplified measures cannot be used if information suggests risk is not lower, if money laundering or terrorist financing is suspected, if the truth or relevance of earlier identity data is doubtful, or in specified higher-risk cases. A Grand-Ducal regulation may modify or extend the regime to other customers, products or transactions, or restrict or prohibit its use.
Suggested action
A professional may apply simplified customer due diligence (CDD) only after assessing lower money-laundering and terrorist-financing risk. Consider at least Annex III factors, retain enough information to evidence eligibility, monitor sufficiently to detect unusual or suspicious activity, and keep eligibility under review.
Conditions
This lower-risk permission is available to professionals in scope only while the relationship or transaction remains lower risk. The e-money alternative requires every listed value, use, funding and monitoring condition; it is not a general waiver of CDD.
- Applies when a professional chooses to apply simplified CDD, or (paragraph 4) to e-money issuers using the e-money derogation and to credit and financial institutions acting as acquirers.
Exceptions
Simplified CDD is unavailable if risk is not lower, suspicion exists, prior identity data is doubtful, or a specified higher-risk case applies. The e-money derogation does not cover cash redemption/withdrawal over EUR 50 or remote payments over EUR 50 per transaction. Credit/financial institutions acting as acquirers may accept third-country anonymous prepaid cards only under equivalent standards. A Grand-Ducal regulation may extend, restrict or prohibit this regime.
- Simplified customer due diligence is unavailable where information suggests risk is not lower, there is suspicion, earlier data is doubtful, or a specified higher-risk case applies. Under Article 3-1(6), a Grand-Ducal regulation may modify or extend the regime, or restrict or prohibit it for specified customers, products or transactions.