Luxembourg AML for Investment Funds: CSSF Rules Explained
A practical guide for Luxembourg fund managers, administrators and transfer agents: which texts apply, what the CSSF expects on investors and on investments, who must hold the AML/CFT roles, what has to be reported, and what changes when the EU AML Regulation applies in July 2027.
Luxembourg is a large fund domicile, and its AML/CFT rules reach both sides of a fund: the investors who come in and the assets the fund buys. The CSSF supervises the funds and managers in scope and has said it applies a risk-based approach to that supervision. This guide follows the path a compliance or operations lead takes, from scope to reporting.
It is written for fund managers, administrators and transfer agents with Luxembourg vehicles. For a comparison with Singapore and Hong Kong, see our white paper on cross-border AML for fund administrators. It cites the texts as read on 8 November 2026 and is general information, not legal advice.
The Texts That Apply
The framework has three layers: the law, the CSSF's regulation, and CSSF circulars and FAQs that set out how the CSSF applies them. The table lists the ones a fund team uses most.
| Text | What it does for a fund or IFM |
|---|---|
| Law of 12 November 2004 on the fight against money laundering and terrorist financing (the AML/CFT Law) | Sets the scope (Article 2), risk assessment (2-2), customer due diligence (3 to 3-3), internal organisation (4), cooperation and suspicious transaction reporting (5) and sanctions (8-4). The CSSF lists its consolidated version as updated on 8 August 2026 |
| Grand-ducal Regulation of 1 February 2010 | Gives details on certain provisions of the AML/CFT Law |
| CSSF Regulation No 12-02 of 14 December 2012, as amended by CSSF Regulation No 20-05 | The CSSF's detailed rules: risk of intermediaries (Article 3), due diligence on investments (34(2)), review frequency (35), outsourcing to transfer agents (37(4)), the compliance roles (40 to 43) and the external report (49) |
| Circular CSSF 18/698, Sub-chapter 5.4 | AML/CFT organisation of investment fund managers (IFMs): due diligence on initiators, delegate portfolio managers and assets, the two compliance roles and the annual summary report |
| Circular CSSF 17/650, as amended by Circular CSSF 20/744 | Indicators of laundering of tax offences, including a list specific to collective investment activities |
| Circular CSSF 21/788 | Guidance on the CSSF AML/CFT external report prepared by the approved statutory auditor (réviseur d'entreprises agréé) |
| CSSF FAQs | Practical answers, including on the two persons in charge of AML/CFT for a Luxembourg fund or IFM |
| Regulation (EU) 2024/1624 (AMLR) | The EU single rulebook. The CSSF says it applies from 10 July 2027 |
Funds and managers in scope must also apply targeted financial sanctions. Circular 18/698 (point 305) expects IFMs to apply the Luxembourg law on restrictive measures in financial matters and the EU regulations that apply directly, and to follow FATF publications on financial sanctions.
Who Is in Scope
Article 2(1) of the AML/CFT Law lists the professionals it covers. For the fund sector the main entries are:
- Point 4: undertakings for collective investment and investment companies in risk capital (SICARs) which market their units, securities or partnership interests and to which the 2010 UCI Law, the 2007 SIF Law or the 2004 SICAR Law applies.
- Point 5: management companies under the 2010 UCI Law and alternative investment fund managers under the Law of 12 July 2013.
- Point 6a: managers and advisers of UCIs, SICARs and pension funds.
For investment funds, CSSF Regulation 12-02 says the notion of customer "encompasses the notion of investor registered in the investment fund register" (Article 1). In practice, much of the investor work is done by the registrar and transfer agent, but CSSF Regulation 12-02 (Article 37(4)) and Circular 18/698 (point 312) make clear that the fund's board (or equivalent) and/or the IFM that delegates the tasks remain responsible.
Investor Due Diligence
Customer due diligence is required when establishing a business relationship, for occasional transactions of EUR 15,000 or more, when there is a suspicion of ML/TF, and when there are doubts about identification data already held (Article 3(1)). The measures are set out in Article 3(2):
- Identify and verify the investor using documents, data or information from reliable and independent sources, including electronic identification means where available.
- Identify the beneficial owner and take reasonable measures to verify their identity, including understanding the ownership and control structure. For legal entities the Law looks first at controlling ownership interests, then at control through other means, then at senior managing officials.
- Understand the purpose and intended nature of the relationship.
- Conduct ongoing due diligence, including scrutiny of transactions and keeping data up to date.
Timing. Verification takes place before the relationship is established or the transaction carried out (Article 3(4)). It may be completed during establishment only where that is necessary not to interrupt the normal conduct of business and the ML/TF risk is low, and then as soon as practicable. If you cannot complete CDD, you may not establish the relationship or carry out the transaction, must end any existing relationship, and must consider reporting to the FIU.
Registers. You may not rely exclusively on central beneficial ownership registers (Article 3(2a)), and for a new relationship with an entity that must register its beneficial owners you collect proof of registration or an excerpt and compare it with your own information (Article 3(4)).
Intermediaries. Where units are subscribed through an intermediary acting for others, CSSF Regulation 12-02 requires enhanced due diligence on the intermediary at two levels: identifying the intermediary, those acting for it and its beneficial owners, and enhanced measures on a relationship the CSSF treats as similar to a correspondent relationship, aimed at assessing the robustness of the intermediary's AML/CFT controls (Article 3(1) and (2)). For the look-through question, see our guide to KYC for fund of funds and nominee investors.
Reviews. Set review frequency by risk, with high-risk relationships reviewed at least annually (12-02, Article 35(1)). Check at least once a year whether the conditions that allowed simplified due diligence are still met (35(2)).
Due Diligence on the Fund's Investments
This is where Luxembourg stands out for many managers who come from investor-only programmes. Circular 18/698 (point 309) requires the IFM to apply due diligence measures on the assets of the UCIs it manages, and point 308 extends due diligence to initiators of UCIs, delegate portfolio managers and investment advisers. CSSF Regulation 12-02 (Article 34(2)) requires a formal ML/TF risk analysis of investments, reviewed annually and when particular events require it.
| What to cover | Source | What it means in practice (our view) |
|---|---|---|
| Due diligence on the assets of the UCIs | Circular 18/698, point 309 (citing Articles 3(7) and 4(1) of the AML/CFT Law) | Know who you are buying from and selling to, and who sits behind portfolio companies, loans or property |
| A formal ML/TF risk analysis of each investment | CSSF Regulation 12-02, Article 34(2) | A documented risk score per asset or per bucket of similar assets, reviewed annually and when events require it |
| Risk scoring at asset level and verification on higher-risk deals | CSSF thematic review of unregulated AIFs (published July 2021) | The CSSF found missing asset-level scoring and missing verification of identity documents at some IFMs |
| Sanctions name screening on investments | Same thematic review | Screen all relationships linked to investments at least upon publication of the official lists and, in any event, on acquisition and sale |
| Oversight of delegated portfolio managers | Same thematic review; CSSF Regulation 12-02, Article 37(2) and (2a) | If a delegate runs screening or monitoring on investments, the IFM must monitor and control that work |
The CSSF's 2020 thematic review of unregulated AIFs managed by five Luxembourg IFMs found that indirect supervision through the IFM worked in practice, and that the shortcomings were similar to those found at IFMs of regulated funds. At some IFMs in the sample it found incomplete risk assessments, weak oversight of delegated portfolio managers, missing asset-level risk scoring, and gaps in sanctions screening on investments.
The Two Persons in Charge of AML/CFT
Article 4(1) of the AML/CFT Law requires a person responsible for compliance, appointed where appropriate from the management body, and a compliance officer at appropriate hierarchical level. The CSSF's FAQ uses the French acronyms RR and RC, and says that every Luxembourg investment fund and IFM subject to its AML/CFT supervision must appoint both, given the national risk assessment of the collective investment sector.
| Person responsible for compliance (RR) | Compliance officer (RC) | |
|---|---|---|
| Legal basis | AML/CFT Law, Article 4(1): appointed, where appropriate, among the management body or effective direction | AML/CFT Law, Article 4(1)(a): a compliance officer at appropriate hierarchical level; CSSF Regulation 12-02, Article 40(1) |
| Investment fund (CSSF FAQ) | The board acting collectively, or one board member. Must be reachable by the Luxembourg authorities | Mandated by name (intuitu personae) by the board. Can be a board member or a third party, for example staff of the fund's IFM. The fund may contract with the RC personally or with the RC's employer; in the latter case the contract must name the RC, any replacement needs the fund's approval, and the RC must acknowledge the appointment in writing. As a principle available in Luxembourg, with a limited exception |
| Investment fund manager (CSSF FAQ; Circular 18/698, points 313-314) | The whole board or one of its members. Circular 18/698 calls this the AML/CFT compliance officer at senior management level | The compliance officer in charge of AML/CFT. Both persons must be permanently located in Luxembourg and employed by the IFM (point 314) |
| CSSF notification | Names communicated to the CSSF, with information before any change (CSSF Regulation 12-02, Article 40(2)) | Same. For IFMs, Circular 18/698 lists the documents: signed CV, ID copy, declaration of honour and a criminal record extract if available (point 315) |
| Reporting | Submits the annual summary report to the CSSF within five months after the financial year end (12-02, Article 42(7)). Not required for a fund whose Luxembourg management company submits it | Prepares the summary report at least once a year (12-02, Article 42(6)) and reports regularly in writing (42(5)) |
Both must have the experience and knowledge of the Luxembourg AML/CFT framework, the authority (including timely access to customer data) and the availability needed to do the job (12-02, Article 40(3)). For the IFM, the annual summary report must cover at least twelve items (Circular 18/698, point 318), including the risk assessment results and the IFM's risk tolerance, due diligence on clients, initiators, delegates and advisers, enhanced due diligence on intermediaries and on PEPs, due diligence on assets, positions blocked for AML/CFT reasons, periodic reviews, oversight of third parties, statistics on suspicious transaction reports and on financial sanctions, the breaches identified, and the corrective actions with their deadlines.
External report. CSSF Regulation 12-02 (Article 49) and Circular 21/788 require an AML/CFT external report from the approved statutory auditor (réviseur d'entreprises agréé). Circular 21/788 says entities that appoint an auditor for their annual accounts must use the same auditor, and those not required to appoint one must mandate an auditor for this report. The circular says the external report is not required from Luxembourg funds that have appointed an IFM, established in Luxembourg or abroad.
Delegation to Transfer Agents and Administrators
Delegation is allowed, but responsibility stays put. Where the service provider is a registrar and transfer agent acting for the fund, the fund's board (or equivalent) and/or the IFM that outsources the tasks remain liable (12-02, Article 37(4)). They must make sure the contract specifies each party's roles and responsibilities, gives them access to the information they need, and allows ongoing, formalised supervision of the provider. Being treated as part of the fund under the contract does not exempt the transfer agent from its own AML/CFT obligations.
For a wider view of who does what, see fund administrator AML responsibilities.
Reporting Suspicions and Keeping Records
- Suspicious transaction reports. Professionals, their directors and employees must inform the FIU promptly, on their own initiative, when they know, suspect or have reasonable grounds to suspect that money laundering, an associated predicate offence or terrorist financing is being committed or has been committed or attempted (Article 5(1)(a)). All suspicious transactions, including attempted ones, are reported regardless of amount, and whether or not the predicate offence can be determined.
- Requests from the FIU. Provide any information without delay when the FIU asks (Article 5(1)(b)).
- Tax offences. Aggravated tax fraud and tax evasion are predicate offences. Circular 17/650, as amended by Circular 20/744, lists indicators, including a list specific to collective investment activities. The CSSF says a single indicator, or even several, is not necessarily enough to raise a suspicion, but where doubts remain after closer examination the professional reports to the FIU.
- Records. Keep CDD documents, data and analysis, and the records needed to reconstruct individual transactions, for five years after the end of the business relationship or the date of an occasional transaction (Article 3(6)).
For the investor-side red flags, see AML red flags in fund subscriptions and redemptions.
Sanctions for Breaches
Under Article 8-4 of the AML/CFT Law, the CSSF can issue warnings and reprimands, publish a statement identifying the person and the breach, start withdrawal or suspension of an authorisation, impose a temporary ban of up to five years on exercising activities or managerial functions, and impose fines. The general maximum fine is twice the benefit derived from the breach, where that can be determined, or EUR 1,000,000. Where the professional is a credit or financial institution, the maximum rises to EUR 5,000,000 or 10% of total annual turnover for legal persons, and EUR 5,000,000 for natural persons (Article 8-4(3)). The CSSF says its sanctions will generally be made public. For recent themes, see our news item on CSSF enforcement and supervisory priorities.
A Six-Part Programme, Step by Step
The steps below put the rules above in the order a fund team usually applies them.
Map who is in scope and who supervises
Check which of your vehicles and managers are listed in Article 2(1) of the AML/CFT Law. Points 4, 5 and 6a cover UCIs and SICARs that market their units, securities or partnership interests under the 2010, 2007 and 2004 fund laws, management companies under the 2010 UCI Law and AIFMs, and managers and advisers of UCIs, SICARs and pension funds. The CSSF supervises the professionals it supervises, authorises or registers (Article 2-1(1)). Professionals not covered by paragraphs 1 to 7 of Article 2-1 fall to the AED, the registration duties and estates authority (Article 2-1(8)).
Write the risk assessment for each fund and the IFM
Article 2-2 of the AML/CFT Law requires a risk assessment. Circular 18/698 (point 306) asks the IFM to identify and assess ML/TF risks by customers, countries or geographical areas, products, services, transactions or delivery channels. In its 2020 thematic review the CSSF found risk analyses that did not describe the mitigation measures, so include them.
Run investor CDD, including the beneficial owners
Identify and verify each investor and take reasonable measures to verify its beneficial owners (Article 3(2)). For legal entities, the Law treats a shareholding of 25% plus one share, or an ownership interest of more than 25%, as an indication of direct ownership (Article 1(7)). For a new relationship with an entity that must register its beneficial owners, collect proof of registration or a register excerpt and compare it with your own data (Article 3(4)).
Apply enhanced measures to intermediaries that subscribe for others
Where units are subscribed through an intermediary acting for others, CSSF Regulation 12-02 (Article 3) requires enhanced measures on that intermediary, treating the relationship as similar to a correspondent relationship. You identify the intermediary, the persons acting for it and its beneficial owners, and assess the robustness of its AML/CFT controls.
Screen and score the investments
Apply the asset-side checks in the table above, and record the result for each deal.
Monitor, review and report
Review high-risk relationships at least annually (12-02, Article 35(1)), and check every year that the conditions for any simplified due diligence still apply (35(2)). Report suspicions to the Financial Intelligence Unit (FIU) promptly. Keep CDD and transaction records for five years after the relationship ends (Article 3(6)).
Worked Example: A Nominee Subscription and a Cross-Border Deal
Illustrative scenario. A Luxembourg AIFM manages a Part II UCI. A bank in another country asks to subscribe for its private banking clients through a nominee account. Separately, the fund plans to buy a minority stake in an unlisted company through a holding vehicle in a third country.
- Investor side. The bank is an intermediary acting for others, so CSSF Regulation 12-02 Article 3 applies. The transfer agent identifies the bank, the persons acting for it and its beneficial owners, then assesses the bank's AML/CFT framework through a due diligence questionnaire, its policies and the supervision it is under. The file records why the relationship was accepted and who approved it.
- Asset side. The deal team identifies the seller, the holding vehicle and the target's beneficial owners, screens them against the official sanctions lists, and gives the investment a risk score under Article 34(2). Because the structure has an entity in a third country between the fund and the target, the compliance officer also checks it against the collective investment indicators in Circular 17/650 (as amended by 20/744), which mention interposed entities in jurisdictions that do not comply with international transparency standards.
- Delegation. The transfer agent runs the investor checks under a contract that sets out each party's role and gives the AIFM access to the information. The AIFM, which outsourced the tasks, remains liable and supervises the transfer agent's work (12-02, Article 37(4)).
- Reporting. The results feed the AIFM's annual summary report, which covers due diligence on intermediaries and on assets as separate items (Circular 18/698, point 318).
What Changes With the EU AML Regulation and AMLA
The CSSF's June 2024 communiqué sets out the main changes. Regulation (EU) 2024/1624 (AMLR) applies from 10 July 2027 and sets EU-wide, directly applicable rules (a "single rulebook") on customer due diligence, beneficial ownership, reporting and record retention. Among the points the CSSF highlights:
- Beneficial ownership is set at 25% or more of shares, voting rights or other ownership interests, considered at every level of ownership. Member States may propose a lower threshold for higher-risk categories, but not below 15%.
- Targeted financial sanctions checks extend to the customer, the beneficial owners and the persons who control a legal entity or hold more than 50% of its proprietary rights or majority interest.
- Register discrepancies must be reported without undue delay and within 14 calendar days of detection.
- Wealthy clients. Credit and financial institutions must apply enhanced measures to relationships with individuals whose total wealth exceeds EUR 50,000,000 where assets under management exceed EUR 5,000,000.
- AMLA, the new EU authority, starts direct supervision of selected obliged entities in 2028. In 2026 the CSSF asked relevant entities, including investment fund managers, to prepare for AMLA's data collection for identifying eligible entities.
See our guide to the EU AML Regulation and our news item on CSSF's adoption of AMLA templates.
Checklist for Luxembourg Fund Compliance Teams
- Fund-by-fund and IFM risk assessment, with mitigation measures described
- RR and RC named for every fund and the IFM, notified to the CSSF, with documented knowledge and availability
- Investor CDD procedure covering beneficial owners, register comparison and the 25% indication
- A separate procedure for intermediaries that subscribe for others
- Asset-side risk analysis per investment, reviewed annually, and sanctions screening on acquisition, sale and list updates
- Written contract with the transfer agent that sets roles and gives access to information, plus documented oversight
- Review cycle: at least annual for high-risk investors, plus a yearly check of any simplified due diligence
- Suspicion escalation to the FIU, including the tax-offence indicators in Circular 17/650
- Record retention of five years after the relationship ends
- Annual summary report filed within five months of the financial year end, and the external AML/CFT report from the auditor (for IFMs and for funds without an IFM)
How One Constellation Supports Luxembourg Funds
One Constellation is a SaaS AML/KYC platform for fund managers, administrators and transfer agents. Its investor onboarding portal brings together identity verification, KYB and beneficial-owner records, and sanctions, PEP and adverse-media screening, with transaction monitoring and case management with STR workflows. It can support the investor-side and screening work described above, while the policies, risk assessments and sign-offs remain yours. To see how it would work on your fund structures, book a demo.
Frequently Asked Questions
Who supervises AML for Luxembourg investment funds?
The CSSF supervises compliance with the AML/CFT Law by the professionals it supervises, authorises or registers, which include UCIs, SICARs, management companies under the 2010 UCI Law and AIFMs in scope (Articles 2 and 2-1 of the Law of 12 November 2004). Professionals not covered by the other supervisors listed in Article 2-1 fall to the AED.
What is CSSF Regulation 12-02?
It is the CSSF's regulation of 14 December 2012 on the fight against money laundering and terrorist financing, amended by CSSF Regulation 20-05 of 14 August 2020. It sets detailed rules on risk assessment, due diligence, intermediaries, investments, reviews, outsourcing, the persons in charge of AML/CFT and the external report.
Do Luxembourg funds have to do due diligence on their investments?
Yes. Circular CSSF 18/698 requires IFMs to apply due diligence to the assets of the UCIs they manage, and CSSF Regulation 12-02 (Article 34(2)) requires professionals to carry out a formalised ML/TF risk analysis of investments, reviewed annually and when particular events require it. The CSSF also expects sanctions screening on investments at least when the official lists are published and on acquisition and sale.
What are the RR and RC?
They are the two persons in charge of AML/CFT required by Article 4(1) of the AML/CFT Law: the person responsible for compliance (RR, usually at board or management level) and the compliance officer (RC). The CSSF says every Luxembourg investment fund and IFM subject to its AML/CFT supervision must appoint both, and their names must be notified to the CSSF.
Can a transfer agent take over the fund's AML obligations?
It can perform tasks, but it cannot take over responsibility. CSSF Regulation 12-02 says the fund's board (or equivalent) and/or the IFM that outsources the tasks remain liable, must set out roles in a detailed contract, and must supervise the transfer agent. The transfer agent also keeps its own AML/CFT obligations.
How long must Luxembourg funds keep KYC records?
Five years after the end of the business relationship or the date of an occasional transaction, for both CDD documents and transaction records (Article 3(6) of the AML/CFT Law).
When does the EU AML Regulation apply in Luxembourg?
The CSSF says Regulation (EU) 2024/1624 applies from 10 July 2027. It applies directly in every Member State and sets EU-wide rules on customer due diligence, beneficial ownership, reporting and record retention, while the related Directive (EU) 2024/1640 is transposed into national law.
Sources
- CSSF: Law of 12 November 2004 on the fight against money laundering and terrorist financing, English consolidated version (updated 8 August 2026, PDF)
- CSSF: CSSF Regulation No 12-02 of 14 December 2012, as amended by CSSF Regulation No 20-05 (PDF)
- CSSF: Grand-ducal Regulation of 1 February 2010 (PDF)
- CSSF: Circular CSSF 18/698, Sub-chapter 5.4 (PDF)
- CSSF: Circular CSSF 21/788 on the AML/CFT external report (PDF)
- CSSF: Circular CSSF 17/650 (PDF)
- CSSF: Circular CSSF 20/744 amending Annex 1 of Circular CSSF 17/650 (PDF)
- CSSF: FAQ on persons involved in AML/CFT for a Luxembourg investment fund or investment fund manager (PDF)
- CSSF: AML/CFT controls applied to unregulated AIFs by the IFM (thematic review)
- CSSF: The new AML/CFT Regulation, the sixth AML/CFT Directive and the future EU AML/CFT supervisor (June 2024)
- CSSF: Identification of obliged entities eligible for direct supervision by AMLA (update, June 2026)
- CSSF: Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) topic page
This article is general information, not legal advice. Requirements change — check the current text with the regulator before relying on it.
Run Investor Checks the CSSF Expects
See how One Constellation supports investor onboarding, beneficial-owner records and screening for Luxembourg funds and their transfer agents.
