An investor file can pass identity checks and still leave a Luxembourg fund unable to explain who controls the investor or why the money is being invested. Customer due diligence has to answer those questions and preserve the evidence for the people who approve the relationship.
This guide focuses on Luxembourg financial-services firms under CSSF AML/CFT supervision, including funds, investment fund managers and banks. It separates current requirements from the coming EU AML Regulation. For help clearing a file backlog, see our Luxembourg KYC services.
Establish which Luxembourg AML rules apply
The Law of 12 November 2004, as amended, sets the core anti-money laundering and counter-terrorist financing obligations. These include customer due diligence, adequate internal management and cooperation with the authorities. The CSSF publication page identifies its consolidated version as updated on 8 August 2026. Its English translation is informational; the official French legal text controls.
CSSF Regulation No 12-02, as amended, adds detailed requirements for the professionals within its scope. Read it with the Grand-ducal Regulation of 1 February 2010 and the applicable sector rules, circulars and guidance. A law or regulation creates obligations; a regulator FAQ explains its application. The file-work recommendations in this guide are AgentKYZ’s recommendations.
The CSSF does not supervise every Luxembourg entity. Insurance-sector and other obliged entities can fall under different competent authorities, including the Commissariat aux Assurances or the Administration de l’enregistrement, des domaines et de la TVA. Establish the entity’s activity and supervisory status before using a CSSF checklist. An investment fund’s status and its manager’s status also need separate assessment.
For a remediation project, we recommend recording the legal entity, business activity, relevant rules and approved AML policy before selecting the files. This prevents one group-wide checklist from obscuring different responsibilities.
Make the CDD file explain the relationship
Article 3 of the AML Law covers identifying and verifying the customer and beneficial owner, understanding the purpose and intended nature of the business relationship, and ongoing monitoring. Checks also address a person acting on the customer’s behalf and their authority to do so. KYC is the operational term often used for this work; collecting identity documents is only part of CDD.
For a corporate customer, understand its business, legal existence, ownership and control. Record the expected activity so that subsequent transactions can be assessed against it. The depth of the work must reflect the customer, geography, product, transaction and delivery-channel risks.
For fund investor onboarding, define who the investor is and how it holds the interest. A nominee, intermediary or layered holding structure needs an assessment of the underlying relationship and the evidence available. Agree the division of work between the fund, investment fund manager and registrar or transfer agent. An administrator’s completed checklist does not by itself establish that each party has met its own obligations.
Investor KYC also does not cover an entire fund AML programme. Investment-side risks and distribution arrangements need their own assessment. Define those workstreams separately when scoping operational support.
Trace beneficial ownership beyond the RBE extract
Article 1(7) of the current AML Law addresses natural persons who ultimately own or control the customer. For corporate entities, a shareholding of 25% plus one share or an ownership interest of more than 25% is an indication of ownership. Control through other means also matters. A percentage filter alone can miss the person controlling the structure.
The senior-managing-official fallback has conditions. The law requires exhausting the possible means of identification and the absence of grounds for suspicion; it is not a shortcut when an ownership chain is difficult to evidence. Record the steps taken and the basis for the conclusion.
For trusts and fiducies, the law identifies specific roles, including settlors, trustees or fiduciaries, protectors where present, beneficiaries or the relevant class, and others exercising ultimate control. A company-shareholding test cannot substitute for those checks.
The Registre des bénéficiaires effectifs (RBE) is a source of information. Article 3(2a) prohibits relying exclusively on central registers to meet CDD obligations. Compare register information with the ownership documents and other evidence, investigate inconsistencies and address any applicable discrepancy-reporting duties. Keep the unresolved ownership link visible in the file.
Use enhanced due diligence where the risk requires it
Article 3-2 sets enhanced due diligence requirements. Politically exposed persons, relevant high-risk-country exposure and other higher-risk circumstances require assessment under the applicable provisions. For PEP relationships, the law addresses senior-management approval, measures to establish source of wealth and source of funds, and enhanced ongoing monitoring.
Source of funds explains the origin of the money used in a relationship or transaction. Source of wealth explains how the person accumulated their wealth. A transfer confirmation can show the sending bank without explaining the activity that generated the money. Select supporting evidence that answers the relevant question.
Sanctions checks and PEP checks serve different purposes. A PEP match does not itself mean the person is sanctioned or has committed an offence. Record the match assessment and follow the applicable sanctions rules, escalation process and approval requirements. Unresolved screening concerns should remain open for the authorised team.
Keep reviews current and records retrievable
Article 3(5) requires CDD on existing customers at appropriate times based on risk and when relevant circumstances change. The approved policy should define review frequencies and triggers. Changes in ownership, control, activity or adverse information may require a review before its scheduled date. Track overdue reviews and retain the evidence supporting each update.
Ongoing monitoring includes scrutiny of transactions against the firm’s knowledge of the customer, business and risk profile. A document-refresh project does not replace transaction monitoring. Specify what the project includes and which monitoring responsibilities remain elsewhere.
Article 3(6) generally requires CDD records and transaction evidence to be retained for five years after the relationship ends or the occasional transaction. Extensions and other legal retention requirements can apply. Agree retention, access and deletion rules with the responsible team; do not treat five years as an automatic deletion instruction in every case.
Our operational recommendation is to hand over an indexed file that links each conclusion to its evidence, records the policy used and identifies the owner of every outstanding action. The firm must be able to retrieve the underlying documents, including those held by a service provider.
Keep RR and RC responsibilities explicit
The CSSF FAQ on persons involved in AML/CFT requires both an RR and an RC for Luxembourg investment funds and investment fund managers under CSSF AML/CFT supervision.
The responsable du respect des obligations (RR) holds responsibility for compliance with AML/CFT professional obligations at management-body level. The responsable du contrôle du respect des obligations (RC) controls compliance with those obligations. Appointment arrangements differ between a fund and an investment fund manager. The FAQ addresses knowledge, availability and access to the documents and systems needed for the role.
A fund can appoint a third-party RC subject to the relevant conditions, including a named personal mandate and contractual arrangements. Buying KYC file work does not make that appointment. Agree which matters go to the RC, which require management approval and who records the final decision. AgentKYZ’s managed KYC service does not replace either role.
Outsource file work with documented oversight
Article 37 of CSSF Regulation No 12-02 requires an outsourcing contract to describe the due diligence work and information flows. It also addresses provider selection, a pre-contract risk assessment, ongoing controls, access to information and supporting evidence, and compliance with professional secrecy and data-protection requirements.
For funds and investment fund managers delegating to a registrar or transfer agent, Article 37 specifically addresses the board’s and manager’s continuing responsibility, access to information and formalised ongoing supervision. The transfer agent can also have its own AML/CFT obligations.
Outsourcing differs from third-party reliance under Article 3-3 of the AML Law. Reliance has eligibility and information-access conditions, and ultimate responsibility remains with the relying professional. A service contract or shared file does not automatically satisfy those conditions.
Before handing over files, our recommendation is to agree:
- The population, checks and policy version governing the work.
- Who requests missing evidence and who handles urgent concerns.
- The provider’s resources, subcontractors and the firm’s oversight arrangements.
- Document access, data location, confidentiality, retention and exit terms.
- The acceptance criteria and the authorised people who decide on exceptions.
Assess any additional outsourcing, notification or approval requirements applicable to the entity and arrangement. File testing can support oversight, but it is not a substitute for a programme-wide independent AML audit. A separately scoped Shadow KYC review can examine files already held by an administrator.
Escalate suspicion without waiting for the backlog to clear
Article 5 requires prompt reporting to Luxembourg’s Financial Intelligence Unit, the Cellule de renseignement financier (CRF), where the professional knows, suspects or has reasonable grounds to suspect money laundering, an associated predicate offence or terrorist financing. Attempted suspicious transactions are included, regardless of amount. The CRF provides reporting instructions and goAML guidance.
An incomplete file is not automatically a suspicious transaction. It needs assessment, and a suspicion must not wait for routine remediation to finish. Escalate through the approved internal process, observe the prohibition on tipping off and respond to the CRF’s requests. Operational reviewers should not promise a customer that a concern has been cleared before the responsible team has assessed it.
Prepare for the EU AMLR without applying future rules early
Regulation (EU) 2024/1624, commonly called the AMLR, generally applies from 10 July 2027. The CSSF’s explanation of the EU package covers the single rulebook, the sixth AML Directive and the EU Anti-Money Laundering Authority, AMLA.
Keep the current Luxembourg control framework and the AMLR implementation plan distinct. For example, the AMLR’s corporate ownership threshold uses 25% or more, while the current Luxembourg law describes 25% plus one share or more than 25% as an indication of ownership. Control through other means remains relevant. Changing a percentage field alone will not complete the transition.
Map future requirements against your policies, ownership logic, evidence fields and provider contracts. Check applicable technical standards and effective dates as implementation develops. For the files that need work now, scope a Luxembourg KYC remediation engagement against your current approved policy.