Banking & finance
AML/KYC compliance in Luxembourg: due diligence obligations and the role of the CSSF
Quick answer
AML/KYC compliance in Luxembourg requires obliged entities (banks, fund managers, accounting and legal professionals, among others) to apply customer due diligence: identify the customer, verify their identity, understand the source of funds and identify the beneficial owner. The CSSF supervises the financial sector.
In Luxembourg, the fight against money laundering and terrorist financing (AML/CFT) rests on customer due diligence obligations imposed on obliged entities. They must identify their customers, verify their identity, understand the purpose of the relationship and the source of funds, and identify the beneficial owner. A risk-based approach adjusts the intensity of the checks. The CSSF supervises the financial sector and may sanction breaches. Cerno's lawyers support compliance projects and the structuring of banking and financial matters.
In short
- AML/KYC aims to prevent money laundering and terrorist financing (AML/CFT).
- Obliged entities (banks, PSF, fund managers, notaries, lawyers, chartered accountants and others) are subject to it.
- Customer due diligence covers the identification, verification and ongoing monitoring of the relationship.
- The beneficial owner must be identified and their identity verified.
- A risk-based approach adjusts the intensity of due diligence (simplified or enhanced).
- The CSSF supervises the financial sector and ensures compliance with AML/CFT obligations.
- Non-compliance exposes the obliged entity to administrative sanctions (fines of up to twice the benefit derived from the breach or EUR 1,000,000, and up to EUR 5,000,000 or 10% of total annual turnover for credit and financial institutions) and criminal sanctions, assessed case by case.
| Category | Examples | Usual supervisor |
|---|---|---|
| Banking sector | Credit institutions (banks) | CSSF |
| Financial sector | Professionals of the financial sector (PSF) | CSSF |
| Asset management | Management companies, fund managers | CSSF |
| Insurance | Insurance undertakings (certain products) | Insurance sector authority |
| Legal and accounting professions | Notaries, lawyers, chartered accountants, statutory auditors | Chamber of Notaries, Bar Associations, OEC, IRE (AML/CFT) |
| Corporate services | Domiciliation and service providers | Competent authority |
AML/KYC compliance in Luxembourg: what is it about?
Quick answer. AML (anti-money laundering) refers to the fight against money laundering and terrorist financing (AML/CFT). KYC (Know Your Customer) is its operational translation: the obligation, for certain professions, to know their customer before and during the business relationship. Together, they form the foundation of financial compliance in Luxembourg.
In practice, the professionals concerned must identify their customer, verify their identity using reliable documents, understand the purpose and nature of the relationship, look into the source of funds and identify the beneficial owner, that is, the natural person or persons who genuinely control the customer or on whose behalf a transaction is carried out.
These obligations are not specific to Luxembourg: they transpose international standards (in particular those of the Financial Action Task Force) and a harmonised European framework. Luxembourg, a leading financial centre, attaches particular importance to them, under the supervision of the CSSF (Luxembourg financial sector supervisory commission) for the financial sector.
The legal framework for combating money laundering
In Luxembourg, the fight against money laundering and terrorist financing rests on a dedicated legislative framework, supplemented by regulations and circulars issued by the supervisory authorities. The reference text in this area is the law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended several times to incorporate European developments.
This framework is evolving: successive European directives and international recommendations lead to regular adjustments. To know the state of the law in force, refer to the official texts published on Legilux and to the CSSF's guidance, rather than to summaries frozen in time.
The system combines preventive obligations (due diligence, internal organisation, training) and obligations to cooperate with the authorities, in particular the obligation to report suspicious transactions to the competent financial intelligence unit.
Obliged entities
AML/CFT obligations do not apply to everyone: they target obliged entities exhaustively defined by law. These are mainly players in the financial sector, but not only. Certain non-financial professions are also covered when they are involved in sensitive transactions.
Obliged entities include in particular credit institutions (banks), professionals of the financial sector (PSF), fund managers and management companies, insurance undertakings offering certain products, as well as professions such as notaries, lawyers, chartered accountants, statutory auditors and providers of services to companies and trusts. Intermediaries in certain high-value assets may also fall within the scope.
Each category falls under its own AML/CFT supervisory authority or self-regulatory body. The CSSF supervises the professionals within its scope; for AML/CFT, the Institute of Registered Auditors (Institut des Réviseurs d’Entreprises, IRE) supervises statutory auditors and audit firms (approved or not), the OEC chartered accountants and the Bar Associations (Ordres des avocats) lawyers. This AML/CFT supervision must be distinguished from the public audit oversight powers. Official allocation of supervisors.
Customer due diligence (KYC)
Customer due diligence is the core of the system. It requires the obliged entity to identify its customer and to verify their identity on the basis of documents, data or information obtained from a reliable and independent source, before entering into the business relationship.
Due diligence does not stop once the file is opened. The entity must exercise ongoing due diligence throughout the relationship: monitor transactions to check that they are consistent with its knowledge of the customer, their business and their risk profile, and update the information collected. An unusual transaction, or one with no apparent economic rationale, calls for closer examination.
This knowledge of the customer also determines whether an account can be opened: preparing a solid KYC file is a prerequisite to open a business bank account in Luxembourg.
Identifying the beneficial owner
Identifying the beneficial owner is one of the most sensitive aspects of compliance. The beneficial owner is the natural person who ultimately owns or controls the customer, or on whose behalf a transaction is carried out. The aim is to prevent intermediary structures from concealing the identity of the persons genuinely concerned.
For a company, these are typically the persons who hold, directly or indirectly, a significant share of the capital or voting rights, or who exercise control by other means. Where no person can be identified on these bases, the law provides for fallback criteria. The obliged entity must understand the ownership and control structure of the customer.
Luxembourg also maintains a Register of Beneficial Owners (RBE), in which companies must declare their beneficial owners. This declaration is one of each entity's own obligations and supplements, without replacing, the due diligence carried out by the obliged professionals.
The risk-based approach
The AML/CFT system rests on a risk-based approach. The idea is simple: the intensity of due diligence must be proportionate to the risk presented by a relationship or a transaction. Not every situation justifies the same level of checks.
Where the risk is low, simplified due diligence may be accepted under the conditions laid down by the regulations. Conversely, certain situations require enhanced due diligence: customers with a high risk profile, complex structures, transactions with politically exposed persons or higher-risk jurisdictions. Enhanced measures may include additional checks on the source of funds and of wealth.
This approach requires each obliged entity to carry out a risk assessment, adopt appropriate internal policies and procedures, train its staff and appoint the compliance officers required by the texts.
Suspicious transaction reporting and record keeping
Beyond due diligence, obliged entities have an obligation to cooperate with the authorities. When they know, suspect or have reasonable grounds to suspect that a transaction is linked to money laundering or terrorist financing, they must file a report with the competent financial intelligence unit.
This report is regulated: in principle, it comes with a prohibition on informing the customer or third parties of its existence. The entity must also respond to requests from the authorities and, where relevant, refrain from executing certain transactions in the manner provided for by law.
Finally, entities must keep the documents and information relating to customer identification and to transactions, for a period set by the regulations, to allow any checks and investigations. The precise rules on periods and form are set by the texts in force.
The role of the CSSF
The CSSF (Commission de surveillance du secteur financier) is the supervisory authority for most of the Luxembourg financial sector. In AML/CFT matters, it ensures that the entities it supervises comply with their due diligence, organisational and reporting obligations.
It acts by issuing circulars and guidance, by carrying out on-site and desk-based inspections, and by monitoring professionals' internal systems. The CSSF regularly publishes documents setting out its expectations on compliance governance, risk management and internal control.
Other authorities act depending on the sector (the Insurance Commissioner, the AED, the professional bodies). Cerno's lawyers assist banking and financial players in their dealings with the CSSF and in upgrading their compliance systems.
Sanctions for non-compliance
Non-compliance with AML/CFT obligations exposes the obliged entity, its directors and sometimes its compliance officers to sanctions. These may be administrative (imposed by the supervisory authority) or criminal, depending on the seriousness of the breaches.
Administrative sanctions may in particular take the form of injunctions, warnings, financial penalties or measures affecting the conduct of the business. Under article 8-4 of the amended law of 12 November 2004, administrative fines may reach twice the benefit derived from the breach, where it can be determined, or EUR 1,000,000, and EUR 5,000,000 or 10% of total annual turnover for credit and financial institutions. Under criminal law, money laundering and terrorist financing are offences punishable by law. The nature and amount of sanctions depend on the circumstances and are assessed case by case by the competent authorities and courts.
These amounts are ceilings: there is no automatic scale, and the measures reported in certain communications concern specific cases that cannot be generalised. For any question about a risk of sanction, you should seek appropriate legal advice.
The lawyer's role in achieving compliance
AML/KYC compliance is a technical and shifting area, at the intersection of financial law, company law and risk management. A law firm helps obliged entities to map out their obligations, assess their risks and formalise internal policies and procedures consistent with the framework in force.
Support may cover drafting or reviewing KYC procedures, analysing complex customer files, identifying the beneficial owner in international structures, preparing for CSSF inspections or training teams. For family wealth groups, it overlaps with family office and structuring issues.
Cerno's lawyers act in an advisory and assistance capacity, without taking the place of their clients' internal compliance functions. To assess a specific need, you can request a quote and describe your situation.
| Step | Purpose |
|---|---|
| Identification | Collect the identity of the customer and of the beneficial owner |
| Verification | Confirm identity through reliable and independent sources |
| Understanding the relationship | Establish the purpose and nature of the relationship and the source of funds |
| Risk assessment | Classify the relationship using a risk-based approach |
| Ongoing due diligence | Monitor transactions and update information |
| Reporting and record keeping | Report suspicions and keep the required documents |
Depending on your profile
For obliged entities
Bank, PSF, fund manager or accounting professional: your obligations cover identifying and verifying the customer, identifying the beneficial owner, a risk-based approach and reporting suspicious transactions. The CSSF expects formalised, up-to-date internal procedures.
For client companies
As a customer of a bank or of an obliged professional, expect to have to document your identity, your ownership structure, your beneficial owners and the source of your funds. A complete KYC file speeds up the start of the relationship and limits repeated requests for documents.
For family offices
International wealth structures raise questions of beneficial ownership and enhanced due diligence. A clear map of the chain of ownership and consistent documentation make dealings with banks and obliged providers easier, and secure the structuring.
Official sources
Update history
- : Ceilings for administrative fines under article 8-4 of the law of 12 November 2004 completed: twice the benefit derived from the breach, total annual turnover of credit and financial institutions.