--- title: "Luxembourg (LU) — Financial-Integrity Intelligence · Sentinel" canonical: https://sentinel.gi/jurisdictions/luxembourg/ source_html: /jurisdictions/luxembourg/index.html description: "Financial integrity intelligence for Luxembourg (LU): sanctions, beneficial ownership, enabler jurisdictions, conflict finance, digital assets and compliance technology — with sourced findings." generated_at: 2026-11-08T04:46:02Z content_sha256: 0ce528d4d83f60eb51562cd954825e4f38b28f678fc7a7e259f1b227c36d773c generator: "fe-fleet/md-twin@1.0" --- # Luxembourg (LU) — Financial-Integrity Intelligence · Sentinel Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. Financial Integrity Monitor # Luxembourg LU Domains covered 8 of 8 Sources 142 Role actions 8 Horizon <90d 0 Jurisdiction profile FATF status: Largely Compliant Tier: A Risk direction: Stable Enablement vs enforcement: Mixed Luxembourg's AML/CFT regime rests on the 2004 AML/CFT Law as amended to transpose EU AMLD4/5, supervised by the CSSF (financial sector, VASPs) and the CRF-FIU (prosecutor's office). More FATF's 2023 MER found a solid technical framework and good financial-intelligence use, but weak domestic ML investigation/prosecution, asset recovery, and non-financial-sector supervision. Key deficiencies - Very low number of domestic money-laundering investigations, prosecutions and convictions relative to Luxembourg's risk profile as a global financial centre - Weak domestic asset recovery capacity, despite effective handling of foreign confiscation requests - Risk-based supervision of TCSPs, real estate, notaries and professional directors still in early implementation stages, with some high-risk DNFBP inspections not yet started - Beneficial ownership register (RBE) public access closed since the 2022 CJEU Sovim ruling, reversing 2019 transparency gains - Poor non-profit-organisation sector understanding of terrorist-financing risk despite Luxembourg's exposure as an international financial centre Recent developments (18m) - Luxembourg's 2025 National Risk Assessment on money laundering published by the Ministry of Justice (May 2025) - FATF follow-up monitoring of Luxembourg's 2023 Mutual Evaluation updated December 2025 - EU AML Package (AMLR, AMLA Regulation, 6AMLD) entered into force with a phased 2027-2028 implementation horizon directly affecting Luxembourg's supervisory architecture - EU high-risk third country list updated via Delegated Regulations (EU) 2026/46 and (EU) 2026/83 (Dec 2025), altering enhanced due-diligence obligations for Luxembourg obliged entities - Russian Central Bank litigation against EU Council sanctions regulation filed at the EU General Court, seated in Luxembourg (March 2026) - Luxembourg Recovery and Resilience Plan AML supervision-reform milestone due August 2026 Law made at European Economic Area level that applies in Luxembourg is covered once, on the [European Economic Area](/jurisdictions/eea/) page. This page covers Luxembourg’s own layer: implementation, national authorities, national options and local enforcement. Brief ## Lead signal #### Lead Signal Luxembourgs supervisory posture this cycle is defined by the CSSFs reprimand of CF Fund Services, issued after an inspection covering the second quarter of 2023 through the fourth quarter of 2024. The decision found that the firm delayed filing one suspicious activity report by roughly nine months and failed outright to file a second report concerning a prospective investor linked to a politically exposed person under a fraud and corruption investigation. The same inspection also identified inadequate follow-up after a fund-share transfer was rejected. Taken together, the findings describe a gap between a firms formal anti-money-laundering and counter-terrorist-financing obligations and its operational capacity to act on red flags once they surface inside a fund-services relationship involving a high-risk counterparty. Read full brief #### Lead Signal Luxembourgs supervisory posture this cycle is defined by the CSSFs reprimand of CF Fund Services, issued after an inspection covering the second quarter of 2023 through the fourth quarter of 2024. The decision found that the firm delayed filing one suspicious activity report by roughly nine months and failed outright to file a second report concerning a prospective investor linked to a politically exposed person under a fraud and corruption investigation. The same inspection also identified inadequate follow-up after a fund-share transfer was rejected. Taken together, the findings describe a gap between a firms formal anti-money-laundering and counter-terrorist-financing obligations and its operational capacity to act on red flags once they surface inside a fund-services relationship involving a high-risk counterparty. The reprimand lands alongside a second, structurally distinct development: on 7 October 2026 the Ministry of Justice-led National Prevention Committee published an updated, terrorist-financing-specific National Risk Assessment covering the 2021 to 2024 observation period. The assessment applies the FATF three-stage risk framework across banks, payment and e-money institutions, virtual-asset service providers and non-profit organisations, and it names digital platforms, crypto-assets and intra-EU cross-border flows as strategic priorities going forward. Read together, the enforcement action and the risk assessment point in the same direction: Luxembourgs authorities are treating reporting discipline and typology awareness around digital and cross-border channels as the live edge of the regime, even though the jurisdictions own self-assessment finds no completed terrorist attack on its soil and no established domestic terrorist group. #### Other Developments AMLA technical standards move into relay with CSSF. On 7 October 2026 the Anti-Money Laundering Authority adopted three draft Regulatory Technical Standards, including a risk-assessment methodology under Article 40(2) of the sixth Anti-Money Laundering Directive. The CSSF communicated the adoption to Luxembourg obliged entities and flagged AMLAs sectoral roundtables on simplified due diligence. The underlying RTS text itself was not independently retrieved this cycle, so the finding rests on the CSSFs own communiqué describing the adoption rather than a reading of the standards themselves. CSSF issues its first tokenisation guidance. On 2 October 2026 the CSSF published the first version of its FAQ on fund tokenisation, addressing the digital representation of fund assets on distributed ledger technology and the notification duties that attach to a prospective control agent under the Dematerialised Securities Law. This is a secondary report of the CSSFs own publication rather than a direct reading of the FAQ text, and it signals that the supervisor is beginning to formalise expectations for a product area it has flagged as a strategic priority in the parallel terrorist-financing risk assessment. #### Cross-Monitor Connections The CSSFs tokenisation FAQ sits at the intersection of this jurisdictions financial-crime posture and its digital-asset market infrastructure, where a payments-and-market-structure reading of the same CSSF publication would focus on settlement mechanics and product design rather than on the control-agent notification and anti-money-laundering exposure emphasised here. Similarly, the National Risk Assessments naming of crypto-assets as a strategic monitoring priority connects directly to any digital-asset-specific regulatory tracking being conducted elsewhere in the fleet, since a terrorist-financing risk designation for a product category typically precedes or accompanies licensing and supervisory attention for that same category. #### Outlook The CSSFs reprimand of CF Fund Services, while a single enforcement action, is likely to be read by the fund-services sector as a signal that the supervisor expects prompt reporting discipline specifically where a politically exposed person is involved, and firms with comparable investor-onboarding exposure may face closer scrutiny of their own suspicious-activity-report timelines. On the architecture side, the adoption of AMLAs first draft technical standards marks an early, concrete step in the EU AML Packages build-out, with the directly applicable AML Regulation and the transposition deadline for the sixth Directive both falling on 10 July 2027; Luxembourg obliged entities should expect further relayed guidance from the CSSF as AMLA finalises its methodology and governance expectations between now and then. The updated National Risk Assessments designation of digital platforms and crypto-assets as strategic priorities suggests that the next phase of supervisory attention in Luxembourg will increasingly test whether the jurisdictions established fund-services and digital-asset infrastructure can meet reporting and typology-awareness standards that were, until this cycle, chiefly articulated in general terms. Earlier periodic briefs (5) 25 Oct 2026 · fim-2026-10-25 #### Lead Signal Luxembourgs supervisory posture is defined by the CSSFs reprimand of CF Fund Services, issued after an inspection covering the second quarter of 2023 through the fourth quarter of 2024. The decision found that the firm delayed filing one suspicious activity report by roughly nine months and failed outright to file a second report concerning a prospective investor linked to a politically exposed person under a fraud and corruption investigation. The same inspection also identified inadequate follow-up after a fund-share transfer was rejected. Taken together, the findings describe a gap between a firms formal anti-money-laundering and counter-terrorist-financing obligations and its operational capacity to act on red flags once they surface inside a fund-services relationship involving a high-risk counterparty. The reprimand lands alongside a second, structurally distinct development: on 7 October 2026 the Ministry of Justice-led National Prevention Committee published an updated, terrorist-financing-specific National Risk Assessment covering the 2021 to 2024 observation period. The assessment applies the FATF three-stage risk framework across banks, payment and e-money institutions, virtual-asset service providers and non-profit organisations, and it names digital platforms, crypto-assets and intra-EU cross-border flows as strategic priorities going forward. Read together, the enforcement action and the risk assessment point in the same direction: Luxembourgs authorities are treating reporting discipline and typology awareness around digital and cross-border channels as the live edge of the regime, even though the jurisdictions own self-assessment finds no completed terrorist attack on its soil and no established domestic terrorist group. #### Other Developments AMLA technical standards move into relay with CSSF. On 7 October 2026 the Anti-Money Laundering Authority adopted three draft Regulatory Technical Standards, including a risk-assessment methodology under Article 40(2) of the sixth Anti-Money Laundering Directive. The CSSF communicated the adoption to Luxembourg obliged entities and flagged AMLAs sectoral roundtables on simplified due diligence. The underlying RTS text itself was not independently retrieved, so the finding rests on the CSSFs own communiqué describing the adoption rather than a reading of the standards themselves. CSSF issues its first tokenisation guidance. On 2 October 2026 the CSSF published the first version of its FAQ on fund tokenisation, addressing the digital representation of fund assets on distributed ledger technology and the notification duties that attach to a prospective control agent under the Dematerialised Securities Law. This is a secondary report of the CSSFs own publication rather than a direct reading of the FAQ text, and it signals that the supervisor is beginning to formalise expectations for a product area it has flagged as a strategic priority in the parallel terrorist-financing risk assessment. #### Cross-Monitor Connections The CSSFs tokenisation FAQ sits at the intersection of this jurisdictions financial-crime posture and its digital-asset market infrastructure, where a payments-and-market-structure reading of the same CSSF publication would focus on settlement mechanics and product design rather than on the control-agent notification and anti-money-laundering exposure emphasised here. Similarly, the National Risk Assessments naming of crypto-assets as a strategic monitoring priority connects directly to any digital-asset-specific regulatory tracking being conducted elsewhere in the fleet, since a terrorist-financing risk designation for a product category typically precedes or accompanies licensing and supervisory attention for that same category. #### Outlook The CSSFs reprimand of CF Fund Services, while a single enforcement action, is likely to be read by the fund-services sector as a signal that the supervisor expects prompt reporting discipline specifically where a politically exposed person is involved, and firms with comparable investor-onboarding exposure may face closer scrutiny of their own suspicious-activity-report timelines. On the architecture side, the adoption of AMLAs first draft technical standards marks an early, concrete step in the EU AML Packages build-out, with the directly applicable AML Regulation and the transposition deadline for the sixth Directive both falling on 10 July 2027; Luxembourg obliged entities should expect further relayed guidance from the CSSF as AMLA finalises its methodology and governance expectations between now and then. The updated National Risk Assessments designation of digital platforms and crypto-assets as strategic priorities suggests that the next phase of supervisory attention in Luxembourg will increasingly test whether the jurisdictions established fund-services and digital-asset infrastructure can meet reporting and typology-awareness standards that were, until this cycle, chiefly articulated in general terms. 11 Oct 2026 · fim-2026-10-11 #### Lead Signal Luxembourg's beneficial-ownership supervisory posture moved onto a firmer footing this cycle. The Registre des Beneficiaires Effectifs (RBE), operated by Luxembourg Business Registers, transitions from a prior information-and-prevention approach to a progressive sanctions regime for data-quality anomalies, effective from September 2026 under the Law of 23 January 2025. The shift is paired with a nationwide police verification campaign, announced 19 May 2026 by the Public Prosecutors Offices of Luxembourg and Diekirch, under the Grand Ducal Police. This is a structural change in enforcement architecture rather than an isolated case: it closes the gap between registration obligation and consequence for non-compliant filings, a gap that has long been the primary critique of beneficial-ownership registers across the enabler-jurisdiction literature. Alongside the RBE shift, the Luxembourg Ministry of Finance published its first vertical risk assessment on proliferation-financing and terrorist-financing targeted financial sanctions, dated 21 September 2026 and announced via press release on 24 September 2026. The CSSF's own publication channel is the source for this development, strengthening the documentary basis for Luxembourg's sanctions-risk self-assessment architecture. #### Other Developments CSSF administrative sanctions continue against both fund managers and auditors. An unnamed alternative investment fund manager was sanctioned by the CSSF in a decision dated 9 July 2026, published anonymously on 5 October 2026 under Article 63-3 of the Law of 5 April 1993 on the financial sector, which permits anonymised publication in defined circumstances. Separately, an unnamed approved statutory auditor was sanctioned in a decision dated 3 February 2026, appearing on the CSSF's sanctions index on 7 October 2026. The entity name and the specific breach provision for the auditor sanction were not independently confirmed this cycle, as the underlying decision document was not opened. Banking Circle SA obtained a licence trio spanning banking, e-money and crypto-asset services. Banking Circle became the first Luxembourg institution to hold banking, electronic-money-token issuer, and crypto-asset service provider licences simultaneously, with CASP authorisation effective 15 April 2026. This is reported via trade press; the CSSF's own CASP register was not independently queried this cycle to corroborate the licensing action directly. #### Cross-Monitor Connections The RBE enforcement tightening and the Banking Circle licensing convergence both carry direct relevance to the World Payments Monitor's stablecoin and licensing tracks, where the same CASP authorisation and the same regulatory architecture are assessed from a market-access and product-innovation lens rather than an integrity lens. The Ministry of Finance's proliferation-financing and terrorist-financing vertical risk assessment is a natural anchor point for any Weapons/Dual-Use-tracking monitor attentive to targeted financial sanctions infrastructure, though no such cross-reference claim was available in this cycle's structured input beyond the sanctions domain itself. #### Outlook The RBE's move to a progressive sanctions regime, combined with the police verification campaign, positions Luxembourg's beneficial-ownership infrastructure for a more consequential compliance cycle through the remainder of 2026 and into 2027, when the EU's AMLR reaches full direct application and AMLA's supervisory build-out continues (10 July 2027). Whether Luxembourg's own transposition of the AMLD6 harmonised beneficial-ownership definition, with a transposition deadline of 10 July 2026 that has now passed, has been completed could not be independently confirmed against a Mémorial publication this cycle, and that gap bears watching into the next reporting window. Continued anonymised publication of CSSF administrative sanctions against fund managers and auditors suggests supervisory activity remains steady, though the practice of anonymisation under Article 63-3 limits the market's ability to draw firm-specific lessons from each sanction. 28 Sep 2026 · fim-2026-09-28 #### Lead Signal Luxembourg occupies an unusually central position in the EU sanctions-renewal architecture this cycle. Luxembourg has linked a French and Slovak demand to delist Alisher Usmanov to its own position on Mikhail Fridman, who is separately arbitrating against Luxembourg over frozen assets, a manoeuvre that deepens an EU sanctions-renewal delisting deadlock ahead of the sanctions list's scheduled renewal. This is a structural signal about how designation-criteria divergence pressure among member states can operate through a single jurisdiction's negotiating leverage, rather than an isolated bilateral dispute. Separately, the Bank of Russia filed a claim in a Luxembourg court on 15 September 2026 seeking to protect a Moscow Arbitration Court award against Euroclear over an estimated USD 230 billion in frozen assets, following the EU's indefinite extension of the sovereign-asset freeze under Council Regulation (EU) 2025/2600. Both developments are probable-to-uncertain in evidentiary terms, each resting on a single quality-press or specialist-legal source without independent confirmation of a Council document or court filing, but together they mark Luxembourg as a jurisdiction where sanctions-architecture contestation is now actively litigated and negotiated, not merely administered. #### Other Developments The MiCAR transitional-period expiry on 1 July 2026 closed the authorisation gap for Luxembourg virtual-asset service providers under MiCAR Article 143(3). The CSSF has confirmed directly that unauthorised crypto-asset service provision in Luxembourg is now unlawful, a Tier 1 primary-source-confirmed development. This is a structural hardening of the supervisory perimeter, not an incident: it converts a population of previously-tolerated legacy operators into either fully-authorised or unlawful actors overnight, with no intermediate category remaining. CSSF enforcement activity in the banking sector surfaced two fines this cycle bearing on sanctions-screening and AML/CFT compliance. Stonehage Fleming Luxembourg S.A. was fined EUR 56,000 for AML/CFT compliance failings, including hundreds of delayed sanctions-screening alerts and 42 unnoticed alerts, breaching AML/CFT Law Article 3(2)(d) and CSSF Regulation 12-02 Article 33(1). Separately, Rakuten Europe Bank S.A. was fined EUR 185,000, announced 6 January 2026, for AML/CFT deficiencies identified in 2023, including delayed restrictive-measures screening and an outdated transaction-monitoring system. Both cases point to a live sanctions-screening enforcement gap in Luxembourg's banking sector that the CSSF is actively working through. #### Cross-Monitor Connections The Bank of Russia litigation against Euroclear-adjacent settlement infrastructure in Luxembourg courts has a direct world-payments dimension, given Euroclear's role in cross-border settlement, and readers tracking correspondent-banking and settlement-access risk should note the overlap between this sanctions-architecture development and payment-infrastructure exposure. The MiCAR transitional-period expiry similarly connects to the crypto monitor's licensing coverage of the same CSSF action, viewed here through the sanctions-evasion and unauthorised-provision enforcement lens rather than the licensing-taxonomy lens. #### Outlook The EU sanctions list's scheduled renewal is the key date to watch, given Luxembourg's now-confirmed role in the Usmanov/Fridman delisting linkage; a renewal that resolves or entrenches this deadlock would be a significant signal for designation-criteria divergence pressure across the EU more broadly. On the crypto-asset front, watch for the CSSF's first enforcement action against an entity operating without CASP authorisation post-1 July 2026, which would be the first live test of the newly-hardened perimeter. On the banking-sector AML/CFT front, continued CSSF fining activity focused on sanctions-screening delays would confirm this cycle's two cases as part of a broader supervisory sweep rather than isolated incidents. 14 Sep 2026 · fim-2026-08-21 #### Lead Signal Luxembourg's beneficial-ownership enforcement architecture materially hardened this cycle. On 28 January 2026, the Luxembourg Business Registers (LBR), together with the Ministry of Justice, announced a phased reform of the RCS (register of commerce and companies) and RBE (register of beneficial owners), operationalising the Law of 23 January 2025 through a graduated administrative-sanctions regime: public warnings escalating to daily penalties of EUR 40 capped at EUR 3,600, plus late fees of EUR 50 to 500 (assessed confidence; sourced to a law-firm summary of the underlying Ministry of Justice release rather than a primary LBR text retrieved this cycle). The reform was followed, in a second and independently sourced development, by Luxembourg's Public Prosecutor's Office announcing systematic nationwide checks across all four police regions on companies' RBE compliance, with breaches punishable by criminal fines ranging from EUR 1,250 to EUR 1,250,000 (assessed confidence; sourced to reporting citing the prosecutor's own statement, with the primary release not independently retrieved). Read together, the administrative-sanctions build-out and the criminal-enforcement announcement constitute a two-track hardening of Luxembourg's corporate-transparency enforcement posture, timed ahead of the 10 July 2026 deadline for transposing 6AMLD Articles 11-13 and 15 into domestic law. Both developments rest on secondary reporting of underlying primary-source LBR and prosecutorial statements; no primary LBR release or prosecutorial announcement was independently retrieved this cycle, which tempers precision on implementation timing even as the direction of travel toward stricter enforcement is clear. #### Other Developments MiCA transitional window closes for legacy virtual-asset providers. The CSSF confirmed that, as of 1 July 2026, the 18-month MiCA grandfathering period for CSSF-registered virtual-asset service providers ended; providers that have not been granted (or have been refused) CASP authorisation may no longer offer crypto-asset services in the European Union (high confidence; primary CSSF publication). The closure follows a 2025 national risk assessment that classified Luxembourg's crypto sector as high risk, and narrows materially the population of unsupervised crypto operators able to continue serving EU customers from Luxembourg. No specific enforcement action against a named non-compliant provider was identified this cycle; the finding is the regime-transition fact itself. CSSF sets supervisory expectations for frontier-AI cyber risk. In a July 2026 supervisory communication, the CSSF invited supervised entities to review recent ESRB (7 July 2026) and FSB (10 June 2026) publications on frontier artificial intelligence, and clarified that management bodies are expected to establish governance structures for AI-enabled cyber risk consistent with existing DORA ICT risk-management requirements (high confidence; primary CSSF publication). This is expectation-setting supervisory guidance rather than a discrete enforcement action or new binding rule, but it signals that AI-driven cyber exposure is now an active line of supervisory attention within Luxembourg's financial sector. #### Cross-Monitor Connections The beneficial-ownership hardening documented above sits inside the broader EU AML Package architecture that this monitor tracks as a standing structural matter: the AML Regulation (AMLR, Regulation (EU) 2024/1624, directly applicable), the sixth AML Directive (6AMLD, transposed per Member State), and the AMLA Regulation (Regulation (EU) 2024/1620) establishing the Anti-Money Laundering Authority together shift supervision from a purely national model toward a hybrid EU-level regime. Luxembourg's RCS/RBE reform and the prosecutor's nationwide RBE checks are domestic groundwork occurring ahead of the 10 July 2026 6AMLD transposition deadline and the later 10 July 2027 AMLR direct-application date; they should be read as implementation of that durable architecture rather than as freestanding Luxembourg-specific initiatives. The MiCA CASP transition connects to the world-payments monitor's coverage of non-bank payment and e-money institution supervision, since the same CSSF supervisory apparatus oversees both crypto-asset service providers and payment/e-money firms in Luxembourg. The CSSF's frontier-AI supervisory communication similarly connects to the compliance-technology dimension of both the world-payments and crypto monitors' coverage of DORA-linked operational-resilience expectations. #### Outlook The near-term marker to watch is Luxembourg's transposition of 6AMLD Articles 11-13 and 15 by 10 July 2026; the current evidence base does not establish transposition status as of this cycle with certainty, and that gap should close in coming cycles. Further out, the AMLR's direct application from 10 July 2027 will replace the national AML/CFT Law of 12 November 2004 as the operative single rulebook, and CSSF-supervised entities' transition planning toward that date is at an early stage. On the crypto side, the immediate question is how the CSSF handles the post-1 July 2026 population of providers that neither obtained nor were refused CASP authorisation before the grandfathering window closed. On compliance technology, watch for whether the CSSF's frontier-AI expectation-setting communication is followed by more formal rulemaking or a supervisory review cycle. 11 Aug 2026 · fim-2026-08-05 #### Lead Signal The closure of MiCA's EU-wide VASP transitional regime on 1 July 2026 is this cycle's lead signal for Luxembourg. The CSSF confirmed directly that entities registered as virtual-asset service providers before 30 December 2024 must now hold full CASP authorisation to continue offering crypto-asset services; unauthorised entities must cease, with reverse solicitation the only narrow exemption remaining. This is a high-confidence, Tier-1 development that materially narrows a channel that has historically been available to unauthorised digital-asset operators. Alongside it, Luxembourg's AML architecture is gaining clarity rather than changing in substance: the AML Regulation (AMLR, Reg (EU) 2024/1624) becomes directly applicable and the sixth AML Directive's national transposition deadline falls on the same date, 10 July 2027, giving industry a fixed horizon against which to plan CDD and EDD uplift. #### Other Developments CSSF enforcement against CDD deficiencies. The CSSF fined Stonehage Fleming Luxembourg S.A. EUR 56,000 and PingPong Europe S.A. EUR 12,000, both in March 2026, for customer-due-diligence and transaction-monitoring deficiencies. Confidence on both is Assessed, resting on a single Tier-4 source rather than direct retrieval of the CSSF sanction register. Beneficial-ownership register reform. Luxembourg's Business Registers announced, on 28 January 2026, reforms intended to improve RBE data quality and reliability, building on the post-CJEU restricted-access regime formalised by the Law of 27 January 2025, which limits RBE access to national authorities, AML-obliged professionals, and legitimate-interest claimants. Enabler-jurisdiction pressure in the Mekong region. Cambodia's National Bank has publicly acknowledged the risk of a third FATF grey-list placement tied to casino- and scam-linked laundering, a Tier-1-corroborated, high-confidence signal, while Laos's Golden Triangle Special Economic Zone continues to function as a structural enabler hub under 99-year land-lease legal exceptionalism. Conflict-finance and cartel-finance designations. OFAC designated Gasabo Gold Refinery Ltd and its network on 25 June 2026 for facilitating M23-linked conflict-mineral smuggling from eastern DRC, and separately paired a FinCEN Supplemental Alert with OFAC designations against a CJNG-linked fuel-smuggling and tax-evasion network on 30 June 2026. US model-risk recalibration. US banking agencies replaced SR 11-7 with SR 26-2 on 17 April 2026, adopting a risk-based, materiality-sensitive model-risk standard that explicitly excludes generative and agentic AI from formal scope, while FinCEN separately assessed an $80 million penalty against Canaccord Genuity LLC for approximately 160 unfiled SARs tied to a disproportionately static legacy monitoring design. #### Cross-Monitor Connections The OFAC refinery-chokepoint designation against Gasabo Gold Refinery sits at the intersection of conflict-finance and extractive-industry integrity, and is the kind of finding that should route to a commodity-flows or conflict-finance monitor tracking the DRC-Rwanda mineral corridor rather than be read in isolation as a sanctions event. The Mekong-region enabler-jurisdiction picture, particularly Laos's SEZ-based legal exceptionalism, is a structural finding of the kind that connects to state-capture and governance monitoring rather than to any single enforcement action. The CJNG fuel-theft and tax-evasion network designation touches correspondent-banking and cross-border payment-flow exposure that a payments-focused monitor would read as a de-risking and corridor-integrity signal rather than as a standalone AML event. #### Outlook The items to watch into the next cycle are concrete and dated. On the EU architecture side, Luxembourg's transposition of the sixth AML Directive and its practical alignment with the directly applicable AMLR both land on 10 July 2027, and AMLA's own work programme and supervisory methodology are expected around the fourth quarter of 2026 as its Frankfurt build-out continues toward a targeted headcount of roughly 430 staff by end-2027. A CSSF or Ministry of Justice primary circular on AMLR national-transition guidance was not located this cycle and remains a genuine evidence gap rather than a closed question. On the enabler-jurisdiction side, whether Cambodia avoids a third FATF grey-list placement is an open near-term question given the National Bank's own public acknowledgement of the risk. On the compliance-technology side, the exclusion of generative and agentic AI from SR 26-2's formal scope leaves an open supervisory question that the Canaccord Genuity penalty suggests firms cannot safely treat as settled. Domain intelligence (D1–D8) #### Sanctions Architecture and Evasion Luxembourg is not a transit or evasion corridor for Russian sanctions in the classic third-country sense. Its significance this cycle is structural: Clearstream Banking S.A., the Luxembourg-domiciled central securities depositary, is bound by Council Regulation 2025/2600 of 12 December 2025, which durably prohibits EU central securities depositories from transferring immobilised Central Bank of Russia assets back to Russia, formalising obligations first imposed in February 2024. That prohibition is the enabling mechanism behind the extraordinary-revenue mechanism through which a fourth windfall-profit tranche of EUR 1.4 billion was delivered to Ukraine in April 2026. Reading Luxembourg's role here through the architecture-over-incident lens, the relevant fact is not any single transaction but that a Luxembourg-domiciled institution now sits at the operational core of the EU's asset-freeze infrastructure. Continue reading That infrastructure is now being tested directly in Luxembourg's own courts. In March 2026 the Russian Central Bank filed a claim at the EU General Court, seated in Luxembourg, contesting Council Regulation 2025/2600, running in parallel to a separate suit filed by Moscow's Arbitration Court against Euroclear in December 2025. This is assessed rather than confirmed with high confidence, since the underlying reporting derives from a single tier-two source, but it is consistent with Russia's broader pattern of litigating against EU sanctions instruments. The EU General Court's Luxembourg seat means the jurisdiction now functions as the primary judicial venue where the legality of the EU sanctions-evasion architecture is being adjudicated, independent of any Luxembourg-specific enforcement action. Alongside the litigation and asset-freeze infrastructure, the EU's 20th Russia sanctions package, adopted 23 April 2026, added 120 listings, 33 individuals and 83 entities, spanning oligarchs, actors linked to the abduction of Ukrainian children, propagandists and persons responsible for cultural-heritage looting. These designations are directly enforceable within Luxembourg through its national Comite restreint pour les sanctions financieres, illustrating the domestic enforcement layer that sits beneath EU-level designation. Named entity and individual detail for this package was not available in public sourcing this cycle beyond the aggregate counts. Taken together, these three threads support a single structural judgment: Luxembourg is now central to the EU Russian-asset-freeze architecture not through evasion exposure but through hosting the financial-market infrastructure and judicial forum the regime depends upon. The pending EU General Court litigation is a genuine stress test of that architecture rather than a procedural footnote, and its outcome will bear directly on whether the immobilisation model underpinning windfall-profit transfers to Ukraine remains legally durable. #### Outlook The EU General Court's ruling on the Russian Central Bank's challenge is the primary near-term event to watch, given its direct bearing on the legal durability of the Clearstream-hosted asset-freeze mechanism. A secondary and more consequential structural question is whether the EU moves from immobilisation toward outright confiscation of Russian sovereign assets, a shift that would change Luxembourg's role from custodian-under-restriction to a jurisdiction executing a more contested legal act, with corresponding litigation risk for Clearstream and other Luxembourg-domiciled financial-market infrastructure. #### Beneficial Ownership and Corporate Transparency Globally, the EU AML Package sets the structural direction for beneficial-ownership and corporate-transparency policy across all Member States, Luxembourg included, and it is the correct standing backdrop against which this cycle's Luxembourg-specific finding should be read. The package comprises three distinct instruments: the AML Regulation, or AMLR (Regulation (EU) 2024/1624), which is directly applicable across the EU without national transposition; the sixth AML Directive, or 6AMLD, which each Member State must transpose into national law on its own timeline; and the AMLA Regulation (Regulation (EU) 2024/1620), which establishes the Anti-Money Laundering Authority and shifts supervision of high-risk cross-border obliged entities from purely national authorities toward a hybrid EU-level regime. For Luxembourg specifically, the AMLR becomes directly applicable from 10 July 2027, a date this cycle's sourcing corrected from month-level to day-level precision against the Official Journal text, while the Luxembourg-specific 6AMLD transposition vehicle has not yet been identified in public sourcing. Continue reading This cycle's substantive Luxembourg-specific development is a correction to the standing record on beneficial-ownership register access. Prior baseline material, sourced to OCCRP reporting, described the Luxembourg RBE as closed to public access since the 2022 CJEU Sovim ruling with no reform noted. Three independent tier-three legal-analysis sources corroborate that a Law of 23 January 2025, in force from 1 February 2025, in fact restored a restricted, legitimate-interest access regime, available to national authorities, AML-obliged professionals, and applicants, including journalists and civil-society researchers, demonstrating legitimate interest. This is a state-choice restriction rather than a capacity deficit: Luxembourg chose to reopen access on narrower terms than the 2019 to 2022 unrestricted public-access window, and the gatekeeping mechanism embedded in the legitimate-interest test can still be used to obstruct investigative access even where formal reform has occurred. The correction is held at assessed rather than high confidence because the corroborating sources are secondary legal commentary rather than a Luxembourg government primary text, and because the finding directly displaces prior sourcing rather than simply supplementing it. Luxembourg's clean FATF status, confirmed at the 19 June 2026 Plenary with no grey- or black-list placement, is a separate but related signal: the absence of enhanced monitoring means this transparency question will not receive FATF-driven external pressure in the near term, leaving the EU-level AMLR/6AMLD/BORIS interconnection framework as the primary lever for any future access reform. #### Outlook The near-term marker to watch is any further EU-level legislative fix restoring broader legitimate-interest access under the AMLR framework, alongside practical implementation experience under Luxembourg's 2025 access-restriction regime, which will show whether the legitimate-interest test operates as a genuine access route or a durable gatekeeping barrier for investigative and civil-society users. #### Enabler Jurisdictions and Professional Facilitators Luxembourg's enabler-jurisdiction profile this cycle is defined by capacity and prioritisation choices rather than deliberate permissiveness. The FATF 2023 Mutual Evaluation found domestic money-laundering investigation, prosecution and conviction numbers very low relative to Luxembourg's risk profile as a global financial centre, notwithstanding effective handling of foreign confiscation requests and good use of financial intelligence. This is a persistent detection-to-accountability gap rather than a single-incident finding, and it is precisely the kind of structural gap the architecture-over-incident lens is designed to surface ahead of any individual enforcement episode. Continue reading That gap is compounded by supervisory maturity issues on the professional-enabler side. The same Mutual Evaluation found risk-based supervision of trust and company service providers, notaries and real estate agents still early stage, with inspections of some high-risk DNFBP sectors, including professional directors supervised by the AED, not yet started. These are the gatekeeper professions most directly implicated in corporate-layering structures used to conceal beneficial ownership, making the supervisory lag structurally significant for the wider BO-opacity picture this cycle also addresses. A separate but related finding concerns terrorist financing: Luxembourg faces a moderate-to-low domestic TF threat, evidenced by 30 TF investigations recorded in the Mutual Evaluation review period with zero prosecutions or convictions, alongside a poorly understood NPO-sector TF-risk channel. FATF explicitly flags Luxembourg's international-financial-centre status as itself a TF-conduit risk factor independent of any specific case, an enablement-by-status finding rather than an enforcement gap. Against this backdrop, two forward-looking levers stand out. The EU high-risk third country list was updated via Delegated Regulations (EU) 2026/46 and 2026/83, adopted 3 to 4 December 2025, changing enhanced due diligence obligations for Luxembourg-domiciled obliged entities dealing with newly listed jurisdictions, and creating a noted divergence risk against the UK's separate high-risk third country advisory notice on timing and scope. And Luxembourg faces a binding EU Recovery and Resilience Facility milestone requiring a new AML-supervision law and fresh money-laundering and terrorist-financing risk assessments by August 2026, a genuine structural lever rather than an enforcement episode, though the specific legislative text has not yet appeared in public sourcing. Luxembourg's continuing ordinary, non-enhanced FATF follow-up status, last updated per methodology documentation in December 2025 though not independently confirmed as a Luxembourg-specific page update, completes the picture of a jurisdiction that enables through under-resourced follow-through rather than through deliberate design. #### Outlook The August 2026 Recovery and Resilience Facility deadline is the clearest near-term test of whether Luxembourg's technical AML framework will be matched by improved domestic enforcement and DNFBP supervisory capacity; whether the required new law and risk assessments are drafted, tabled or enacted by that date is not yet confirmed. Divergence between the EU and UK high-risk third country lists is a secondary item to monitor for cross-bloc obliged-entity compliance friction. #### Conflict Finance and Extractive-Industry Integrity No Luxembourg-specific conflict-finance or extractive-industry development was identified in this cycle's sourcing. Luxembourg's role in this domain is not comparable to jurisdictions with direct commodity-trading or armed-conflict financing exposure, and the interpreter output for this cycle explicitly records no items for D4. Consistent with the honesty-over-coverage principle governing thin-signal cycles, this sub-brief does not manufacture a narrative where the evidence base is empty; it records the absence as itself the accurate finding for this cycle. Continue reading This does not mean the domain is permanently inactive for Luxembourg. Luxembourg's role as a fund-domicile and financial-centre jurisdiction means indirect exposure to conflict-affected commodity flows, for example through investment-fund structures with extractive-industry exposure, remains analytically plausible in principle, but no such link was evidenced this cycle and none is asserted here. #### Outlook The primary watch item is whether any future cycle surfaces a direct Luxembourg nexus to conflict-affected commodity flows or extractive-industry finance, whether through fund-structure exposure, correspondent banking relationships, or trade-finance documentation; absent such evidence, this domain will remain correctly recorded as quiet for Luxembourg. #### Crypto / Digital Assets / Financial Innovation Luxembourgs digital-asset exposure this cycle is marked less by a financial-crime finding than by a supervisory formalisation step that will shape how such findings are made in future. On 2 October 2026 the CSSF published the first version of its FAQ on fund tokenisation, addressing how fund assets can be digitally represented on distributed ledger technology and what notification duties attach to a firm acting as a prospective control agent under the Dematerialised Securities Law. This is reported via a secondary source rather than a direct reading of the FAQ text, so the precise scope of the guidance, including whether it addresses anti-money-laundering identification duties for digital-asset intermediaries directly, is not yet confirmed on the evidence available this cycle. Continue reading The tokenisation FAQ should be read against the backdrop of the updated terrorist-financing National Risk Assessment published five days later, on 7 October 2026, which explicitly names crypto-assets and digital platforms as strategic monitoring priorities for the 2021-2024 observation period and beyond. The sequencing is notable: a market-facing clarification on tokenisation mechanics from the securities-markets supervisor, followed almost immediately by a financial-crime risk assessment that singles out the same asset class. This suggests Luxembourg authorities are treating the growth of regulated digital-asset infrastructure, in this instance the tokenisation of fund assets, as a parallel track requiring both product-level clarity and renewed anti-money-laundering and counter-terrorist-financing vigilance, rather than treating the two concerns as independent of one another. No enforcement action or supervisory finding specific to a digital-asset-related anti-money-laundering failure was located for Luxembourg this cycle. The CSSFs reprimand of CF Fund Services, the dominant enforcement signal of the period, concerned a fund-services firm and a politically-exposed-person-linked investor rather than a crypto-asset or tokenisation-related counterparty. The absence of a crypto-specific enforcement finding alongside a crypto-specific risk designation is itself informative: it indicates that Luxembourgs typology concern in this space is currently anticipatory, grounded in a risk assessment rather than in a realised case, which is consistent with a jurisdiction building out supervisory architecture (the tokenisation FAQ) ahead of, rather than in response to, an observed compliance failure. #### Outlook The near-term question for this domain is whether the CSSFs tokenisation FAQ will be followed by more detailed guidance addressing the anti-money-laundering and counter-terrorist-financing obligations of firms engaged in digital representation of fund assets, particularly given that the National Risk Assessment has now formally flagged the category as a strategic priority. Firms operating in or adjacent to Luxembourgs fund-tokenisation space should expect that any future supervisory guidance in this area will likely reference both the Dematerialised Securities Law and the control-agent notification regime already surfaced in the FAQ, and will likely draw on the risk priorities set out in the October 2026 National Risk Assessment. Given that the underlying RTS adopted by AMLA on 7 October 2026 includes a risk-assessment methodology applicable across the EU AML Package, obliged entities engaged in digital-asset activity in Luxembourg may also see that methodology informing how their own typology exposure in this space is assessed once the standards are finalised and published in full. #### Compliance Technology and Active Defence Luxembourg's D6 profile this cycle is defined by two developments that together represent the durable global shift toward harmonised, technology-enabled EU supervision, with Luxembourg serving as a useful bellwether given its concentration of large cross-border obliged entities. First, AMLA, the Anti-Money Laundering Authority, is confirmed to begin direct supervision of a first cohort of roughly 40 high-risk cross-border obliged entities from 1 January 2028, a date this cycle's sourcing corrected from year-level to day-level precision against AMLA's own communications. Luxembourg's concentration of large cross-border banks, investment funds and central securities depositories, including Clearstream, makes it a plausible source jurisdiction for that initial cohort, though no specific entity selection has been confirmed in public sourcing. Continue reading Second, the CSSF has been approved for participation in the European Commission's Supervisory Digital Finance Academy, a 2025 Commission reform-support project. The specific programmatic content and Luxembourg-facing output of this participation has not yet been detailed in public sourcing, which is why this finding is held at assessed rather than high confidence despite deriving from a tier-one source; the fact of participation is confirmed, but its practical supervisory impact is not yet demonstrable. Together, these developments should be read as capacity-building ahead of AMLA's 2027 entity-selection exercise rather than as evidence of any current supervisory-technology deployment specific to Luxembourg. The analytical value of tracking this domain for Luxembourg lies precisely in its bellwether status: as a jurisdiction disproportionately likely to host directly-supervised entities once AMLA's cohort is selected, how the harmonised EU-level supervisory methodology lands on Luxembourg's obliged-entity population will be informative for the wider EU AML Package rollout. #### Outlook The near-term markers to track are AMLA's 2027 selection of its first cohort of directly-supervised cross-border entities, which will indicate whether a Luxembourg-domiciled institution is included, and any further detail on the practical content of CSSF's Supervisory Digital Finance Academy participation, which would move that finding from assessed toward high confidence. #### AML/CTF Regime Luxembourgs AML/CTF regime this cycle is defined by two developments that together describe a regulator testing whether reporting discipline keeps pace with evolving risk typologies. The first is the CSSFs reprimand of CF Fund Services following an inspection spanning the second quarter of 2023 through the fourth quarter of 2024. The inspection found that the firm delayed filing one suspicious activity report by approximately nine months and failed entirely to file a second report concerning a prospective investor linked to a politically exposed person who was under investigation for fraud and corruption. The same inspection identified inadequate follow-up after a fund-share transfer was rejected, suggesting the reporting failures were not isolated but part of a broader pattern in how the firm responded to red flags once they arose in the course of an investor relationship. Continue reading The second development is the publication, on 7 October 2026, of an updated National Risk Assessment specific to terrorist financing, covering the 2021 to 2024 observation period. The assessment was produced under the Ministry of Justices National Prevention Committee and applies the FATF three-stage risk-assessment framework across banks, payment and e-money institutions, virtual-asset service providers and non-profit organisations. It flags digital platforms, crypto-assets and intra-EU cross-border flows as the strategic priorities going forward, while also stating plainly that Luxembourg has experienced no completed terrorist attack and has no established domestic terrorist group, a finding that frames the jurisdictions terrorist-financing risk as largely a function of its role as a cross-border financial centre rather than a function of domestic threat activity. A third, more structural development sits alongside these two: on 7 October 2026 AMLA adopted three draft Regulatory Technical Standards, including a risk-assessment methodology under Article 40(2) of the sixth Anti-Money Laundering Directive, and the CSSF relayed this adoption to Luxembourg obliged entities along with a note on AMLAs sectoral roundtables covering simplified due diligence. This is confirmed only via the CSSFs communiqué; the RTS text itself has not been independently retrieved this cycle, so the operational detail of the new risk-assessment methodology remains to be seen once the standards are published in full. Taken as a set, these developments show a regime moving on two fronts at once: individual-firm accountability for reporting lapses, evidenced by the CF Fund Services reprimand, and system-level recalibration of risk priorities and methodology, evidenced by the updated National Risk Assessment and the AMLA technical standards. The CF Fund Services case is the clearer of the two in substantive terms, since it rests on a primary CSSF sanction notice; the National Risk Assessment finding is likewise grounded in the Ministry of Justices own published document, while the AMLA RTS adoption currently rests on a regulator communiqué describing, rather than reproducing, the underlying standards. #### Outlook The reprimand against CF Fund Services is likely to reinforce the CSSFs existing emphasis on timely reporting where a politically exposed person is involved in fund-services relationships, and other fund administrators and investment firms with comparable client profiles may face increased supervisory attention to their own suspicious-activity-report timelines as a result. On the structural side, the convergence of the updated National Risk Assessments typology priorities, digital platforms, crypto-assets and intra-EU cross-border flows, with AMLAs newly adopted risk-assessment methodology suggests that Luxembourg obliged entities should expect more granular, typology-specific guidance over the period running up to the AML Regulations direct application and the sixth Directives transposition deadline, both falling on 10 July 2027. Whether that guidance materially changes supervisory expectations for a jurisdiction that itself assesses its domestic terrorist-financing threat as low will depend on how the finalised RTS text frames the balance between cross-border financial-centre risk and domestic threat activity once it is published. #### Commercial Activity The key commercial-activity milestone for Luxembourg this cycle is Banking Circle SA's achievement of a licence trio spanning banking, electronic-money-token issuance, and crypto-asset service provision. Banking Circle became the first Luxembourg institution to hold banking, EMT-issuer, and CASP licences simultaneously, with the CASP authorisation taking effect 15 April 2026. This is reported via trade press and should be read with Probable rather than Confirmed confidence, since the CSSF's own CASP register was not independently queried this cycle to corroborate the licensing action directly. Continue reading From a financial-integrity perspective, the significance of this licensing convergence lies less in the commercial event itself, which is primarily a World Payments Monitor matter, and more in what it implies for the supervisory perimeter a single institution now sits within. An entity holding banking, e-money-token, and crypto-asset licences simultaneously concentrates multiple distinct regulatory regimes, and their associated AML/CTF and sanctions obligations, within one supervised entity. This is architecturally notable: it suggests Luxembourg's CSSF licensing framework is structured to accommodate convergent business models spanning traditional banking and digital-asset services under a single supervisory relationship, rather than requiring separate entities or group structures for each licensed activity. No enforcement or sanctions findings specific to Banking Circle were present in this cycle's structured input; this entry is confined to the commercial/licensing milestone itself. Architecture-over-incident framing is appropriate here: the notable fact is the structural capability the licence trio represents, not any incident connected to it. #### Outlook Whether other Luxembourg-domiciled institutions pursue a similar convergent licensing strategy, combining banking, e-money-token issuance, and crypto-asset services under one CSSF-supervised entity, would be a useful indicator to track in coming cycles. Independently corroborating the CASP authorisation against CSSF's own public register would also strengthen confidence in this finding beyond the current trade-press sourcing. Regulatory horizon Consultation 2027-Q1 · ±half_year ### AMLA direct-supervision selection of high-risk cross-border entities A Luxembourg-domiciled financial entity could become AMLAs direct-supervision subject rather than the CSSFs. [Source](https://regreportingdesk.com/amla-direct-supervision-obliged-entities-cssf/) Adopted 2027-Q3 · ±quarter ### AMLR / AMLD6 application and transposition deadline The single EU AML rulebook (CDD, EDD, beneficial ownership, PEP treatment, cash-payment cap) becomes directly applicable in Luxembourg without national transposition; AMLD6 national transposition deadline falls the same date. [Source](https://regreportingdesk.com/amlr-what-changes-luxembourg/) 2 dated · 3 pending date · baseline fim-2026-07-05 Role action cards MLRO ### CSSF reprimanded a fund-services firm for a nine-month SAR filing delay and a wholly unfiled second report tied to a PEP-linked investor. The finding illustrates the specific reporting-timeliness and PEP-screening failure pattern the CSSF is willing to sanction, and firms with comparable investor profiles should expect their own SAR timelines to be read against this benchmark. 2 evidence refs Compliance ### AMLA adopted three draft technical standards, including a new risk-assessment methodology, which the CSSF has relayed to obliged entities. A new risk-assessment methodology under the sixth Directive is in train; the underlying standards text was not independently reviewed this cycle, so the operational detail of what changes for existing risk-assessment documentation remains open. 1 evidence refs Legal ### No material change for this persona this cycle. No material change for this persona this cycle Board ### Luxembourg's updated terrorist-financing risk assessment names digital platforms, crypto-assets and intra-EU cross-border flows as strategic priorities. The jurisdiction continues to assess its terrorist-financing risk as low in absolute domestic-threat terms but elevated in cross-border financial-centre terms, which has implications for how institutions headquartered or operating through Luxembourg frame their own risk appetite statements. 1 evidence refs CTO ### CSSF published its first tokenisation FAQ addressing digital representation of fund assets and control-agent notification duties. Technical architecture supporting fund tokenisation now has an initial supervisory reference point, though the FAQ's treatment of anti-money-laundering identification duties for digital-asset intermediaries has not been independently confirmed this cycle. 1 evidence refs Risk ### Crypto-assets and digital platforms have been formally flagged as strategic typology priorities in Luxembourg's updated terrorist-financing risk assessment. This elevates the analytical weight that should be given to digital-asset and platform-related exposure in Luxembourg-linked risk models, even absent an observed enforcement case in that category this cycle. 1 evidence refs Operations ### No material change for this persona this cycle. No material change for this persona this cycle Audit ### CSSF's CF Fund Services findings included inadequate follow-up on a rejected fund-share transfer, alongside the SAR filing failures. The case illustrates a control gap spanning both reporting and transaction follow-up, relevant to how audit scoping should treat the adequacy of post-rejection escalation processes in fund administration. 1 evidence refs Scenario sketches ### AMLA direct supervision reshaping the Luxembourg obliged-entity landscape Illustrative orientation only: as the EU AML Package moves from a purely national supervisory model toward AMLAs direct and indirect supervision of selected cross-border obliged entities under the AMLA Regulation, alongside the directly applicable AML Regulation and per-state transposition of the sixth Directive, a Luxembourg-domiciled entity currently supervised solely by the CSSF could in principle be redesignated as an AMLA direct-supervision subject. Such a shift could alter which authority issues guidance, conducts on-site inspections, and resolves findings like the one seen in the CF Fund Services reprimand, potentially changing both the pace and the forum of enforcement for affected entities. This is an illustrative structural sketch, not an observed development or a prediction of which entities will be selected. Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact. Standing trackers (T1–T6) Tracker Status Note T1 · Russian Sanctions-Evasion Architecture no_change T2 · EU AML Package / AMLA watch AMLA adopted 3 draft RTS (7 Oct 2026); CSSF relayed to obliged entities and flagged simplified-CDD roundtables. AMLR applies directly from 10 July 2027; AMLD6 transposition deadline also 10 July 2027. T3 · FATF Grey List no_change T4 · Beneficial-Ownership Register Status no_change T5 · Crypto & Digital-Asset Integrity watch CSSF's first tokenisation FAQ (2 Oct 2026) and the closed MiCA VASP-to-CASP transition continue to shape LU's digital-asset supervisory posture; 13 LU-home CASPs per ESMA data as of 6 Oct 2026. T6 · Sanctions Regime Divergence no_change Registers ### Enforcement actions - 1 Dec 2025 - 12 Dec 2025 - 3 Mar 2026 - 1 Mar 2026 - 1 Mar 2026 - 1 Mar 2026 - 8 Jan 2026 - 2 Mar 2026 - 1 Jan 2026 - 4 Sep 2026 - 9 Oct 2025 - 9 Jul 2026 - 3 Feb 2026 - 4 Sep 2026 - 17 Jul 2026 - FATF continued regular follow-up monitoring of Luxembourg's 2023 Mutual Evaluation Report, with the published assessment page updated as of December 2025, tracking Luxembourg's progress on flagged deficiencies in ML investigations, asset recovery and non-financial-sector supervision. 1 Dec 2025 - Council Regulation 2025/2600 (adopted 12 December 2025, using Article 122 TFEU) prohibits, on a durable basis, transfers of immobilised Central Bank of Russia assets held by EU central securities depositories back to Russia, formalising obligations first imposed in February 2024 on CSDs holding more than €1 million of such assets. 12 Dec 2025 - Russia's central bank filed a legal claim with the EU's General Court in Luxembourg contesting the Council's December 2025 regulation restricting transfers of immobilised Russian sovereign assets, following a related Moscow Arbitration Court suit against Euroclear over the same asset freeze. 3 Mar 2026 ### Sanctions changes - 23 Apr 2026 - 12 Dec 2025 - 4 Dec 2025 - 25 Jun 2026 - 30 Jun 2026 - The EU's 20th sanctions package against Russia (adopted 23 April 2026) added 120 additional listings (33 individuals, 83 entities), including oligarchs, persons involved in the abduction of Ukrainian children, propagandists and persons responsible for looting cultural heritage, all enforceable within Luxembourg as an EU member state. 23 Apr 2026 - Council Regulation 2025/2600 (12 December 2025) durably prohibits transfers of immobilised Central Bank of Russia assets held by EU CSDs (including Luxembourg-based entities) back to Russia, formalising the extraordinary-revenue mechanism that has already channelled four windfall-profit tranches (including a €1.4bn transfer in April 2026) to Ukraine. 12 Dec 2025 - The European Commission adopted Delegated Regulations (EU) 2026/46 and (EU) 2026/83 (3-4 December 2025), amending Delegated Regulation 2016/1675 to update the EU list of high-risk third countries with strategic AML/CFT deficiencies, directly changing the enhanced-due-diligence obligations of Luxembourg-domiciled obliged entities dealing with counterparties in newly listed jurisdictions. 4 Dec 2025 ### Regulatory horizon (register) - AMLR / 6AMLD application date - 6AMLD Articles 11-13 and 15 transposition (beneficial-ownership register provisions) - AMLR / 6AMLD application date - EU AML Package (AMLR/6AMLD/AMLA) full application - AMLD6 beneficial-ownership-register harmonisation transposition - AMLR full direct application and AMLA supervisory build-out - AMLR / AMLD6 application and transposition deadline - AMLA direct-supervision selection of high-risk cross-border entities - EU AML Regulation (AMLR) becomes directly applicable in Luxembourg - AMLA begins direct supervision of selected cross-border entities - 6th AML Directive transposition deadline for Luxembourg - Luxembourg Recovery and Resilience Plan AML supervision-reform milestone ### Active schemes - [HIGH] Post-CJEU status of the Luxembourg beneficial ownership register, corrected this cycle - [HIGH] Luxembourg financial-market infrastructure in the Russian asset-freeze architecture - VASP-sector DPRK and ransomware exposure via Luxembourg registration - International financial centre status as a latent terrorist-financing conduit Sources - [Press Releases | FinCEN.gov](https://www.fincen.gov/news/press-releases) - [https://blogs.duanemorris.com/europeansanctionsenforcement/2026/01/08/luxembourg-cssf-fines-bank-e185000-including-for-sanctions-compliance-failings/](https://blogs.duanemorris.com/europeansanctionsenforcement/2026/01/08/luxembourg-cssf-fines-bank-e185000-including-for-sanctions-compliance-failings/) - [https://www.cssf.lu/wp-content/uploads/S_3_EME_PingPong_Europe_S.A._020326_en.pdf](https://www.cssf.lu/wp-content/uploads/S_3_EME_PingPong_Europe_S.A._020326_en.pdf) - [https://globalsanctions.com/sanctioning-states/eu/eu-enforcement/](https://globalsanctions.com/sanctioning-states/eu/eu-enforcement/) - [https://www.charlesrussellspeechlys.com/en/insights/quick-reads/102mgwa-luxembourg-business-registers-reform-enhanced-compliance-controls-and-progressiv/](https://www.charlesrussellspeechlys.com/en/insights/quick-reads/102mgwa-luxembourg-business-registers-reform-enhanced-compliance-controls-and-progressiv/) - [https://www.ifcreview.com/news/2026/may/luxembourg-companies-to-be-checked-for-compliance-with-beneficial-owners-register/](https://www.ifcreview.com/news/2026/may/luxembourg-companies-to-be-checked-for-compliance-with-beneficial-owners-register/) - [https://www.cssf.lu/en/2026/07/mica-transition-period-for-virtual-asset-service-providers-ended-on-1-july-2026/](https://www.cssf.lu/en/2026/07/mica-transition-period-for-virtual-asset-service-providers-ended-on-1-july-2026/) - [https://www.fatf-gafi.org/en/publications/Mutualevaluations/MER-Luxembourg-2023.html](https://www.fatf-gafi.org/en/publications/Mutualevaluations/MER-Luxembourg-2023.html) - [https://www.cssf.lu/en/2026/07/evolving-opportunities-and-risks-in-artificial-intelligence-and-its-adoption/](https://www.cssf.lu/en/2026/07/evolving-opportunities-and-risks-in-artificial-intelligence-and-its-adoption/) - [https://www.moodys.com/web/en/us/kyc/resources/insights/changes-in-the-world-of-sanctions-compliance-and-evasion.html](https://www.moodys.com/web/en/us/kyc/resources/insights/changes-in-the-world-of-sanctions-compliance-and-evasion.html) - [https://amlwatcher.com/knowledgebase/cssf/](https://amlwatcher.com/knowledgebase/cssf/) - [https://www.fluxforce.ai/jurisdictions/luxembourg](https://www.fluxforce.ai/jurisdictions/luxembourg) - [https://zavia.ai/how-to-verify-a-ubo-in-luxembourg-2026-rbe-rcs-explained/](https://zavia.ai/how-to-verify-a-ubo-in-luxembourg-2026-rbe-rcs-explained/) - [https://www.o2k.tech/blog/update-mica-benelux](https://www.o2k.tech/blog/update-mica-benelux) - [https://mfin.gouvernement.lu/en/dossiers/2018/sanctions-financiaires-internationales.html](https://mfin.gouvernement.lu/en/dossiers/2018/sanctions-financiaires-internationales.html) - [https://cms.law/en/int/expert-guides/expert-guide-to-financial-sanctions-enforcement/luxembourg](https://cms.law/en/int/expert-guides/expert-guide-to-financial-sanctions-enforcement/luxembourg) - [https://www.euronews.com/my-europe/2026/09/18/eu-sanction-deadlock-deepens-as-luxembourg-complicates-the-picture](https://www.euronews.com/my-europe/2026/09/18/eu-sanction-deadlock-deepens-as-luxembourg-complicates-the-picture) - [https://kohenavocats.com/en/bank-russia-luxembourg-11ca-euroclear-award-france-defence-2026/](https://kohenavocats.com/en/bank-russia-luxembourg-11ca-euroclear-award-france-defence-2026/) - [https://www.fatf-gafi.org/en/countries/detail/Luxembourg.html](https://www.fatf-gafi.org/en/countries/detail/Luxembourg.html) - [https://blogs.duanemorris.com/europeansanctionsenforcement/2026/09/04/luxembourg-cssf-imposes-fine-for-aml-and-sanctions-compliance-violations/](https://blogs.duanemorris.com/europeansanctionsenforcement/2026/09/04/luxembourg-cssf-imposes-fine-for-aml-and-sanctions-compliance-violations/) - [https://complianceconcourse.willkie.com/articles/luxembourgs-financial-regulator-imposes-e185000-fine-for-alleged-aml-ctf-deficiencies/](https://complianceconcourse.willkie.com/articles/luxembourgs-financial-regulator-imposes-e185000-fine-for-alleged-aml-ctf-deficiencies/) - [https://zavia.ai/eu-beneficial-ownership-in-2026-amlr-amld6-amla-explained/](https://zavia.ai/eu-beneficial-ownership-in-2026-amlr-amld6-amla-explained/) - [https://www.cssf.lu/en/Document/administrative-sanction-of-9-july-2026/](https://www.cssf.lu/en/Document/administrative-sanction-of-9-july-2026/) - [https://www.cssf.lu/en/publication-data/](https://www.cssf.lu/en/publication-data/) - [https://www.cdm.lu/news/la-phase-sanction-est-annoncee-par-le-luxembourg-business-registers](https://www.cdm.lu/news/la-phase-sanction-est-annoncee-par-le-luxembourg-business-registers) - [https://www.cssf.lu/en/anti-money-laundering-and-countering-the-financing-of-terrorism/](https://www.cssf.lu/en/anti-money-laundering-and-countering-the-financing-of-terrorism/) - [CSSF](https://www.cssf.lu/wp-content/uploads/S_19_PSF_SP_CF_Fund_Services_170726_en.pdf) - [Fincrime Central](https://fincrimecentral.com/cssf-cf-fund-services-aml-reporting-reprimand/) - [CSSF / Ministry of Justice](https://www.cssf.lu/en/Document/luxembourg-updates-its-national-risk-assessment-of-terrorist-financing/) - [Luxembourg Ministry of Justice / National Prevention Committee](https://www.caa.lu/uploads/documents/files/2026-tf-nra.pdf) - [CSSF](https://www.cssf.lu/en/) - [National Law Review](https://natlawreview.com/article/luxembourg-financial-services-regulator-cssf-issues-first-faq-fund-tokenisation) - [Mutual Evaluation of Luxembourg](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Mutualevaluationofluxembourg.html) - [The FATF Recommendations](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Fatf-recommendations.html) - [Luxembourg](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/Luxembourg%20MER%202023.pdf.coredownload.inline.pdf) - [Luxembourg's measures to combat money laundering and terrorist financing](https://www.fatf-gafi.org/en/publications/Mutualevaluations/MER-Luxembourg-2023.html) - [Mutual Evaluations](https://www.fatf-gafi.org/en/topics/mutual-evaluations.html) - [Consolidated Processes and Procedures for Mutual Evaluations and Follow-Up Universal Procedures](https://www.fatf-gafi.org/en/publications/Fatfgeneral/Universal-procedures.html) - [Mutual Evaluation of Luxembourg: 6th Follow-up Report](https://www.fatf-gafi.org/en/publications/mutualevaluations/documents/fur-luxembourg-2014.html) - [Consolidated assessment ratings](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Assessment-ratings.html) - [Assessments](https://www.fatf-gafi.org/en/calendars/assessments.html) - [The 2022 and 2013 Methodologies for Assessing Technical Compliance with the FATF Recommendations and the Effectiveness of AML/CFT/CPF Systems](https://www.fatf-gafi.org/en/publications/Mutualevaluations/Fatf-methodology.html) - [Luxembourg](https://www.fatf-gafi.org/en/countries/detail/Luxembourg.html) - [Luxembourg - Commission de Surveillance du Secteur Financier-CSSF - Consumer Redress in the EU](https://consumer-redress.ec.europa.eu/dispute-resolution-bodies/luxembourg-commission-de-surveillance-du-secteur-financier-cssf_en) - [Luxembourg Country Guide | Elliptic](https://www.elliptic.co/country-guides/luxembourg) - [Mutual Evaluation of Luxembourg](https://www.fatf-gafi.org/en/countries/j-m/luxembourg/documents/mutualevaluationofluxembourg.html) - [Luxembourg - Reforms and Investments - European Commission](https://reforms-investments.ec.europa.eu/technical-support-instrument-0/our-projects/tsi-country-factsheets/luxembourg_en) - [Luxembourg falls further behind EU AML rules as companies fail to disclose ownership - ICIJ](https://www.icij.org/investigations/luxembourg-leaks/luxembourg-falls-further-behind-eu-aml-rules-as-companies-fail-to-disclose-ownership/) - [Luxembourg - Reform Support - European Commission](https://reform-support.ec.europa.eu/our-projects/country-factsheets/luxembourg_en) - [Civil Penalties and Enforcement Information | Office of Foreign Assets Control](https://ofac.treasury.gov/civil-penalties-and-enforcement-information) - [Special Measures | FinCEN.gov](https://www.fincen.gov/resources/statutes-and-regulations/special-measures) - [Commission de Surveillance du Secteur Financier | EU Digital Finance Platform](https://digital-finance-platform.ec.europa.eu/cross-border-services/cross-border-testing/participants/commission-de-surveillance-du-secteur) - [Luxembourg MER Executive Summary 2023](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/Luxembourg-MER-Executive-Summary-2023.pdf.coredownload.inline.pdf) - [Money Laundering National Risk Assessment Toolkit – Annexes A-C FATF TOOLKIT](https://www.fatf-gafi.org/content/dam/fatf-gafi/publications/Money%20Laundering%20National%20Risk%20Assessment%20Toolkit.pdf.coredownload.pdf) - [Luxembourg’s recovery and resilience plan - Reforms and Investments](https://reforms-investments.ec.europa.eu/recovery-and-resilience-facility-1/country-pages/luxembourgs-recovery-and-resilience-plan_en) - [FATF launches National Risk Assessment toolkit to help countries identify greatest money laundering risks](https://www.fatf-gafi.org/en/publications/Fatfgeneral/FATF-launches-National-Risk-Assessment-toolkit-to-help-countries-identify-greatest-money-laundering-risks.html) - [Money Laundering National Risk Assessment Guidance](https://www.fatf-gafi.org/en/publications/Methodsandtrends/Money-Laundering-National-Risk-Assessment-Guidance.html) - [FATF GUIDANCE Money Laundering National Risk Assessment Guidance](https://www.fatf-gafi.org/content/dam/fatf-gafi/publications/Money%20Laundering%20National%20Risk%20Assessment%20Guidance.pdf.coredownload.inline.pdf) - [Russia Says It’s Suing Euroclear in Moscow on Frozen Assets - Bloomberg](https://www.bloomberg.com/news/articles/2025-12-12/russia-says-it-s-sueing-euroclear-in-moscow-over-frozen-assets) - [Euroclear Eases Payment Rules for Holders of Russian Foreign Currency Bonds - Bloomberg](https://www.bloomberg.com/news/articles/2026-03-26/holders-of-russian-debt-gain-easier-path-to-payment-at-euroclear) - [Euroclear Bank Eases Ban on Settling Trades With Some Russian Bonds - Bloomberg](https://www.bloomberg.com/news/articles/2023-06-14/euroclear-eases-ban-on-settling-trades-with-some-russian-bonds) - [Belgium Blocked $270B Due To Russian Sanctions. Much of It Belongs to Unsanctioned Investors. | OCCRP](https://www.occrp.org/en/scoop/belgium-blocked-270b-due-to-russian-sanctions-much-of-it-belongs-to-unsanctioned-investors) - [Russian Central Bank Sues EU in Luxembourg on Frozen Assets - Bloomberg](https://www.bloomberg.com/news/articles/2026-03-03/russia-s-central-bank-sues-eu-in-luxembourg-over-frozen-assets) - [Clearinghouse Clearstream Blocks Russia’s Depository as Bond Payments Loom - Bloomberg](https://www.bloomberg.com/news/articles/2022-03-25/russia-s-national-depositary-says-clearstream-froze-its-account) - [IA-673090 SETTLEMENT AGREEMENT](https://ofac.treasury.gov/media/13466/download) - [Russia’s Central Bank Files Lawsuit Over Frozen Assets - Bloomberg](https://www.bloomberg.com/news/newsletters/2025-12-12/russia-s-central-bank-files-lawsuit-over-frozen-assets) - [Clearstream Europe AG - Company Profile and News - Bloomberg Markets](https://www.bloomberg.com/profile/company/2142180Z:GR) - [Seizing Russian Assets Risks Unintended Outcomes, Euroclear Says - Bloomberg](https://www.bloomberg.com/news/articles/2025-01-24/seizing-russian-assets-risks-unintended-outcomes-euroclear-says) - [Luxembourg - Commission de Surveillance du Secteur Financier-CSSF - Consumer Redress in the EU](https://consumer-redress.ec.europa.eu/list-alternative-dispute-resolution-adr-bodies/luxembourg-commission-de-surveillance-du-secteur-financier-cssf_en) - [Sanctions Programs and Country Information | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information) - [Fatf-gafi](https://fatf-gafi.org/media/fatf/documents/reports/mer/FUR-Luxembourg-2014.pdf) - [Anti-money laundering and countering the financing of terrorism at international level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-international-level_en) - [FAQ: The EU Ruling on Ownership Transparency and What It Means for Journalists | OCCRP](https://www.occrp.org/en/project/beneficial-ownership-data-is-critical-in-the-fight-against-corruption/faq-the-eu-ruling-on-ownership-transparency-and-what-it-means-for-journalists) - [Beneficial Ownership Registers Interconnection System](https://webgate.ec.europa.eu/e-justice/searchBoris.do) - [Frequently Asked Questions | OCCRP](https://www.occrp.org/en/project/openlux/frequently-asked-questions) - [Beneficial Ownership Data is Critical in the Fight Against Corruption | OCCRP](https://www.occrp.org/en/project/beneficial-ownership-data-is-critical-in-the-fight-against-corruption) - [This Luxembourg Businessman Got Europe's Corporate Registries Shut Down. But Whose Privacy Was He Protecting? | OCCRP](https://www.occrp.org/en/project/beneficial-ownership-data-is-critical-in-the-fight-against-corruption/this-luxembourg-businessman-got-europes-corporate-registries-shut-down-but-whose-privacy-was-he-protecting) - [European e-Justice Portal - Land registers in EU countries](https://webgate.ec.europa.eu/e-justice/contentPresentation?init=true&member=1&idCountry=lu&LUXEMBOURG=&idTaxonomy=109&isJSOffEnabled=1) - [How Europe’s Retreat From Corporate Transparency is Shielding the Corrupt | OCCRP](https://www.occrp.org/en/feature/how-europes-retreat-from-corporate-transparency-is-shielding-the-corrupt) - [Guidance on Beneficial Ownership of Legal Persons](https://www.fatf-gafi.org/en/publications/Fatfrecommendations/Guidance-Beneficial-Ownership-Legal-Persons.html) - [Register an overseas entity and its beneficial owners - GOV.UK](https://www.gov.uk/guidance/register-an-overseas-entity) - [Jurisdictions under Increased Monitoring - 19 June 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2026.html) - ["Black and grey" lists](https://www.fatf-gafi.org/en/countries/black-and-grey-lists.html) - [Outcomes FATF Plenary, 17-19 June 2026](https://www.fatf-gafi.org/en/publications/Fatfgeneral/outcomes-fatf-plenary-june-2026.html) - [High-risk and other monitored jurisdictions](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions.html) - [Money Laundering Advisory Notice: June 2026 - GOV.UK](https://www.gov.uk/government/publications/money-laundering-advisory-notice-high-risk-third-countries--2/money-laundering-advisory-notice-high-risk-third-countries--2) - [High-Risk Jurisdictions subject to a Call for Action - 19 June 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/call-for-action-june-2026.html) - [News](https://www.fatf-gafi.org/en/the-fatf/news.html) - [Jurisdictions under Increased Monitoring - 13 February 2026](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-february-2026.html) - [Countries / Jurisdictions](https://www.fatf-gafi.org/en/countries.html) - [Jurisdictions under Increased Monitoring - 24 October 2025](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-october-2025.html) - [About AMLA - Authority for Anti-Money Laundering and Countering the Financing of Terrorism](https://finance.ec.europa.eu/financial-crime/amla/about-amla_en) - [Timeline: EU action against money laundering and terrorist financing - Consilium](https://www.consilium.europa.eu/en/policies/fight-against-terrorist-financing/timeline/) - [FAQs - Authority for Anti-Money Laundering and Countering the Financing of Terrorism](https://finance.ec.europa.eu/financial-crime/amla/frequently-asked-questions_en) - [Frankfurt to host the EU’s new anti-money laundering authority (AMLA) - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2024/02/22/frankfurt-to-host-the-eus-new-anti-money-laundering-authority-amla/) - [Anti-money laundering and countering the financing of terrorism overview - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-overview_en) - [Anti-money laundering: Council and Parliament agree to create new authority - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2023/12/13/anti-money-laundering-council-and-parliament-agree-to-create-new-authority/) - [Questions and Answers: The new EU Anti-Money Laundering Authority (AMLA)](https://finance.ec.europa.eu/document/download/61cf5a0d-0e5d-43e2-876a-8e68e45c7f1f_en?filename=240424-anti-money-laundering-faqs_en_0.pdf) - [Council of the EU PRESS EN PRESS RELEASE 468/24 30/05/2024](https://www.consilium.europa.eu/en/press/press-releases/2024/05/30/anti-money-laundering-council-adopts-package-of-rules/pdf) - [Anti-money laundering and countering the financing of terrorism at EU level - Finance](https://finance.ec.europa.eu/financial-crime/anti-money-laundering-and-countering-financing-terrorism-eu-level_en) - [Conflict, Stability and Security Fund: Serious and Organised Crime programme summaries 2023 to 2024 - GOV.UK](https://www.gov.uk/government/publications/conflict-stability-and-security-fund-serious-and-organised-crime-programme-summaries-2023-to-2024) - [1224 | Office of Foreign Assets Control](https://ofac.treasury.gov/faqs/1224) - [Enforcing sanctions against listed Russian and Belarussian oligarchs: Commission\'s “Freeze and Seize” Task Force steps up work with international partners](https://ec.europa.eu/commission/presscorner/detail/sv/ip_22_1828) - [US sanctions financial network and luxury planes linked to Russian oligarch Suleiman Kerimov - ICIJ](https://www.icij.org/investigations/pandora-papers/us-sanctions-financial-network-and-luxury-planes-linked-to-russian-oligarch-suleiman-kerimov/) - [Frequently Asked Questions - Newly Added | Office of Foreign Assets Control](https://ofac.treasury.gov/faqs/added) - [EU adopts 20th package of sanctions against Russia - Finance](https://finance.ec.europa.eu/news/eu-adopts-20th-package-sanctions-against-russia-2026-04-23_en) - [‘Freeze and Seize Task Force': Almost €30 billion of assets of Russian and Belarussian oligarchs and entities frozen by the EU so far - Enlargement and Eastern Neighbourhood](https://ec.europa.eu/neighbourhood-enlargement/news/freeze-and-seize-task-force-almost-eu30-billion-assets-russian-and-belarussian-oligarchs-and-2022-04-08_pl) - [Enforcing sanctions against listed Russian and Belarussian oligarchs: Commission's “Freeze and Seize” Task Force steps up work with international partners - Enlargement and Eastern Neighbourhood](https://enlargement.ec.europa.eu/news/enforcing-sanctions-against-listed-russian-and-belarussian-oligarchs-commissions-freeze-and-seize-2022-03-17_en) - [Le "Digital Services Act" : mode d’emploi - Représentation en France](https://france.representation.ec.europa.eu/informations-et-evenements/informations/le-digital-services-act-mode-demploi-2025-02-27_fr) - [Sanctions List Materials | Security Council](https://main.un.org/securitycouncil/en/sanctions/2653/sanctions-list-materials) - [Matériaux relatifs à la liste de sanctions | Conseil de sécurité](https://main.un.org/securitycouncil/en/sanctions/2653/materials) - [Sanctions List Service | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-list-service) - [Syria Sanctions - Inactive and Archived | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-programs-and-country-information/syria-sanctions-inactive-and-archived) - [Sanctions List Search Tool | Office of Foreign Assets Control](https://ofac.treasury.gov/sanctions-list-search-tool) - [Syrie : une transition sous perfusion | ONU Info](https://news.un.org/fr/story/2025/11/1157914) - [La Commission propose des mesures de simplification pour réduire les coûts administratifs des entreprises - Représentation en France](https://france.representation.ec.europa.eu/informations-et-evenements/informations/la-commission-propose-des-mesures-de-simplification-pour-reduire-les-couts-administratifs-des-2025-05-21_fr) - [EU to deliver €1.4 billion in revenue from immobilised Russian assets to be used for support to Ukraine - Représentation au Luxembourg](https://luxembourg.representation.ec.europa.eu/actualites-et-evenements/actualites/eu-deliver-eu14-billion-revenue-immobilised-russian-assets-be-used-support-ukraine-2026-04-01_en) - [First transfer of €1.5 billion of proceeds from immobilised Russian assets made available in support of Ukraine today - Enlargement and Eastern Neighbourhood](https://enlargement.ec.europa.eu/news/first-transfer-eu15-billion-proceeds-immobilised-russian-assets-made-available-support-ukraine-today-2024-07-26_en) - [Daily News 11 / 08 / 2025 - European Commission](https://ec.europa.eu/commission/presscorner/detail/en/mex_25_1953) - [EU sanctions against Russia: questions and answers - Consilium](https://www.consilium.europa.eu/en/policies/sanctions-against-russia-explained/) - [First transfer of €1.5 billion of proceeds from immobilised Russian assets made available in support of Ukraine today - Représentation au Luxembourg](https://luxembourg.representation.ec.europa.eu/actualites-et-evenements/actualites/first-transfer-eu15-billion-proceeds-immobilised-russian-assets-made-available-support-ukraine-today-2024-07-26_en) - [Immobilised Russian assets: Council decides to set aside extraordinary revenues - Consilium](https://www.consilium.europa.eu/en/press/press-releases/2024/02/12/immobilised-russian-assets-council-decides-to-set-aside-extraordinary-revenues/) - [Russian Harmful Foreign Activities Sanctions](https://ofac.treasury.gov/faqs/topic/6626) - [FIN-NET members in Luxembourg - Finance - European Commission](https://finance.ec.europa.eu/consumer-finance-and-payments/retail-financial-services/financial-dispute-resolution-network-fin-net/members-fin-net-country/fin-net-members-luxembourg_en) - [Global Crypto Policy Review Outlook 2025/26 Report | TRM Labs](https://www.trmlabs.com/reports-and-whitepapers/global-crypto-policy-review-outlook-2025-26?scLang=en) - [Crypto-assets - Finance - European Commission](https://finance.ec.europa.eu/digital-finance/crypto-assets_en) - [Virtual Assets](https://www.fatf-gafi.org/en/publications/virtualassets/documents/virtual-assets.html) - [Antitrust: Commission fines UBS, Barclays, RBS, HSBC and Credit Suisse € 344 million for participating in a Foreign Exchange spot trading cartel](https://ec.europa.eu/commission/presscorner/detail/cs/ip_21_6548) - [Press corner | European Commission](https://ec.europa.eu/commission/presscorner/detail/en/inf_26_720) - [Press Releases | FinCEN.gov](https://www.fincen.gov/news/press-releases) - [FATF (multilateral first-party assessment of Luxembourg)](https://www.fatf-gafi.org/content/dam/fatf-gafi/mer/Luxembourg%20MER%202023.pdf.coredownload.inline.pdf) - [FATF](https://www.fatf-gafi.org/en/publications/Mutualevaluations/MER-Luxembourg-2023.html) - [FATF](https://www.fatf-gafi.org/en/publications/High-risk-and-other-monitored-jurisdictions/increased-monitoring-june-2026.html) - [Ministry of Justice, Grand Duchy of Luxembourg](https://gouvernement.lu/dam-assets/images-documents/actualites/2025/05/26-evaluation-risque-blanchiment/2025-nra-vsite-internet.pdf) - [Council of the European Union](https://www.consilium.europa.eu/en/press/press-releases/2024/05/30/anti-money-laundering-council-adopts-package-of-rules/pdf) - [European Commission](https://finance.ec.europa.eu/financial-crime/amla/frequently-asked-questions_en) - [European Commission Representation in Luxembourg](https://luxembourg.representation.ec.europa.eu/actualites-et-evenements/actualites/eu-deliver-eu14-billion-revenue-immobilised-russian-assets-be-used-support-ukraine-2026-04-01_en) - [Bloomberg](https://www.bloomberg.com/news/articles/2026-03-03/russia-s-central-bank-sues-eu-in-luxembourg-over-frozen-assets) - [OCCRP](https://www.occrp.org/en/feature/how-europes-retreat-from-corporate-transparency-is-shielding-the-corrupt) - [European Commission](https://reforms-investments.ec.europa.eu/recovery-and-resilience-facility-1/country-pages/luxembourgs-recovery-and-resilience-plan_en) - [Elliptic (vendor analytics)](https://www.elliptic.co/country-guides/luxembourg) - [European Commission](https://finance.ec.europa.eu/news/eu-adopts-20th-package-sanctions-against-russia-2026-04-23_en) Coverage gaps fim-int-2026-07-07-G001: A Luxembourg government or Luxembou… fim-int-2026-07-07-G001: A Luxembourg government or Luxembourg Business Registers primary source directly confirming the current RBE access-restriction framework under the Law of 23 January 2025 would resolve the conflict between OCCRP-sourced 2022-closure framing and law-firm secondary reporting of the 2025 reform. [resolved] fim-int-2026-07-07-G002: A CSSF-published, named-entity admi… fim-int-2026-07-07-G002: A CSSF-published, named-entity administrative-sanctions register comparable in detail to OFAC civil-penalties disclosures would allow external verification of proportionate exercise of Luxembourg AML/CFT supervisory sanctioning powers. [resolved] fim-int-2026-07-07-G003: Identification of Luxembourg specif… fim-int-2026-07-07-G003: Identification of Luxembourg specific national 6AMLD transposition vehicle, draft bill or law reference, has not yet appeared in public sourcing this cycle. [resolved] fim-int-2026-07-07-G004: Direct confirmation that the FATF L… fim-int-2026-07-07-G004: Direct confirmation that the FATF Luxembourg-specific Mutual Evaluation follow-up status page, as distinct from FATF general methodology documents, was substantively updated in December 2025. [resolved] fim-int-2026-07-07-G005: Public confirmation of whether the … fim-int-2026-07-07-G005: Public confirmation of whether the Luxembourg new AML-supervision law required under the August 2026 Recovery and Resilience Facility milestone has been drafted, tabled or enacted. [resolved] fim-int-2026-08-05-G001: No CSSF primary circular located on… fim-int-2026-08-05-G001: No CSSF primary circular located on AMLR national-transition guidance beyond secondary vendor commentary. [resolved] fim-int-2026-08-05-G002: No CSSF sanction-register primary e… fim-int-2026-08-05-G002: No CSSF sanction-register primary entry retrieved for the Stonehage Fleming/PingPong Europe fines. [resolved] fim-int-2026-08-05-G003: Colombia-specific narco-finance evi… fim-int-2026-08-05-G003: Colombia-specific narco-finance evidence was thin this cycle; relied on the 2023 FATF follow-up report only. [resolved] fim-int-2026-08-05-G004: No Federal Reserve/OCC primary SR 2… fim-int-2026-08-05-G004: No Federal Reserve/OCC primary SR 26-2 text or FinCEN Canaccord consent order retrieved. [resolved] fim-int-2026-08-21-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-08-21-G001 ({'scheme': 'financial_integrity', 'value': 'D4'}): No LU-specific conflict-finance (D4) instrument or flow was identified this cycle despite active search; only an adjacent 2023 FATF MER NPO-sector observation exists. [resolved] fim-int-2026-08-21-G002 ({'scheme': 'financial_integrity', '… fim-int-2026-08-21-G002 ({'scheme': 'financial_integrity', 'value': 'D1'}): No T1/OFAC/OFSI Yemen-Houthi LU-specific sanctions channel was identified this cycle. [resolved] fim-int-2026-08-21-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-08-21-G003 ({'scheme': 'financial_integrity', 'value': 'D2'}): 6AMLD transposition status for Luxembourg as of this cycle is not established with certainty; only a T4 secondary source discusses the deadline. [resolved] fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G001 ({'scheme': 'financial_integrity', 'value': 'D2'}): No Luxembourg-specific 6AMLD transposition bill was located this cycle; whether Luxembourg is among the 11 Member States subject to Commission infringement proceedings was not confirmed. [resolved] fim-int-2026-09-28-G002: Tier D jurisdictions (Cambodia, Lao… fim-int-2026-09-28-G002: Tier D jurisdictions (Cambodia, Laos, Mexico, Colombia) were not actively researched this cycle given the pooled union budget's LU-bound scope. [resolved] fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', '… fim-int-2026-09-28-G003 ({'scheme': 'financial_integrity', 'value': 'D3'}): D3, D4 and D6 had no LU-specific findings surface this cycle; thin coverage rather than confirmed absence of activity. [resolved] fim-int-2026-10-11-G001: LU's full AMLD6 Article 11-13/15 tr… fim-int-2026-10-11-G001: LU's full AMLD6 Article 11-13/15 transposition status (deadline 10 July 2026, now passed) could not be independently confirmed against a Mémorial publication this cycle. [open] fim-int-2026-10-11-G002: No D4 Conflict Finance substantive … fim-int-2026-10-11-G002: No D4 Conflict Finance substantive finding surfaced for Luxembourg this cycle. [open] fim-int-2026-10-11-G003: Tier D jurisdictions (KH/LA/MX/CO) … fim-int-2026-10-11-G003: Tier D jurisdictions (KH/LA/MX/CO) were not separately swept this cycle for an LU nexus. [open] fim-int-2026-10-25-G001: No LU-specific sanctions-architectu… fim-int-2026-10-25-G001: No LU-specific sanctions-architecture (D1) finding was located this window. [open] fim-int-2026-10-25-G002: No LU-specific enabler-jurisdiction… fim-int-2026-10-25-G002: No LU-specific enabler-jurisdiction (D3) finding was located this window. [open] fim-int-2026-10-25-G003: RTS adopted by AMLA on 7 October 20… fim-int-2026-10-25-G003: RTS adopted by AMLA on 7 October 2026 was reported via CSSF communiqué only; the primary RTS text itself was not independently retrieved this cycle. [open] FIM-GAP-001 (D2): FATF's 2023 MER found Luxembourg needs to … FIM-GAP-001 (D2): FATF's 2023 MER found Luxembourg needs to focus considerably more on domestic money-laundering investigations, prosecutions and asset recovery, despite good use of financial intelligence and strong international cooperation on foreign confiscation requests. FIM-GAP-002 (D2): Since the 2022 CJEU Sovim ruling, Luxembou… FIM-GAP-002 (D2): Since the 2022 CJEU Sovim ruling, Luxembourg's beneficial-ownership register (RBE) requires journalists and civil-society researchers to submit national ID, press credentials, proof of residence and a body of work before access is granted, a restriction still in force per 2025 civil-society tracking. FIM-GAP-003 (D3): FATF's 2023 MER found risk-based supervisi… FIM-GAP-003 (D3): FATF's 2023 MER found risk-based supervision of TCSPs, real estate agents and notaries to be in early stages, with inspections of some high-risk DNFBP sectors — including professional directors supervised by the AED — not having started at the time of assessment. FIM-GAP-004 (D3): This baseline could not locate a granular,… FIM-GAP-004 (D3): This baseline could not locate a granular, named-entity CSSF administrative-sanctions register comparable in public detail to OFAC's civil-penalties disclosures for the 18-month window, despite the FATF MER noting historically 'diverging application of sanctions' among Luxembourg's AML/CFT supervisors. ## Evidence #### Confidence-tiered claims CSSF administrative sanction decided 9 July 2026, published anonymously 5 October 2026 under Article 63-3 of the Law of 5 April 1993. [[Source 1]](#sec-sources) Probable · 1 source CSSF administrative sanction decided 3 February 2026, published on CSSF's index 7 October 2026. [[Source 1]](#sec-sources) Probable · 1 source A progressive sanctions regime for RBE beneficial-ownership data-quality anomalies applies from September 2026 under the Law of 23 January 2025, ending the prior information/prevention phase; paired with a nationwide Grand Ducal police verification campaign announced 19 May 2026 by the Public Prosecutors' Offices of Luxembourg and Diekirch. [[Source 1]](#sec-sources) Probable · 1 source First vertical risk assessment on proliferation-financing and terrorist-financing targeted financial sanctions, dated 21 September 2026, press release 24 September 2026. [[Source 1]](#sec-sources) Probable · 1 source First Luxembourg institution to hold banking, EMT-issuer and CASP licences simultaneously; CASP authorisation effective 15 April 2026. [[Source 1]](#sec-sources) Probable · 1 source CSSF reprimanded CF Fund Services for a roughly nine-month delay filing one SAR and failure to file a second SAR concerning a prospective investor linked to a PEP under fraud/corruption investigation, found on an inspection covering Q2 2023-Q4 2024. [[Source 1]](#sec-sources) Probable · 1 source Luxembourg published an updated, TF-specific National Risk Assessment on 7 October 2026 covering the 2021-2024 observation period, flagging digital platforms, crypto-assets and intra-EU cross-border flows as strategic priorities. [[Source 1]](#sec-sources) Probable · 1 source AMLA adopted three draft Regulatory Technical Standards on 7 October 2026, including risk-assessment methodology under AMLD6 Art 40(2); CSSF relayed this to Luxembourg obliged entities. [[Source 1]](#sec-sources) Probable · 1 source On 2 October 2026 the CSSF published its first tokenisation FAQ addressing digital representation of fund assets on DLT and control-agent notification duties under the Dematerialised Securities Law. [[Source 1]](#sec-sources) Probable · 1 source CSSF also found inadequate follow-up on a rejected fund-share transfer in the same inspection. [[Source 1]](#sec-sources) Probable · 1 source