Annex to Circular CSSF 22/822

For Luxembourg-supervised financial institutions, this is a prompt to reconcile internal country-risk lists with the regulator's expectations. Compliance teams should confirm whether any new or removed jurisdictions affect existing customers, counterparties, or transactions; update onboarding, periodic review, screening, and transaction-monitoring parameters; and ensure EDD files evidence the rationale for any counter-measures. The update also calls for MLRO sign-off on risk-assessment changes and targeted training for front-office and monitoring staff.

Firms should be mindful that outdated jurisdictional controls can create financial-crime, reputational, and supervisory risks, while a timely, documented refresh can demonstrate a robust risk-based approach. No new deadline is stated, but RegCanary recommends immediate gap analysis and prompt implementation.