The CSSF publishes Luxembourg’s first ML/TF risk analysis on specialis

Published on 20 July 2020 Email this Share this on LinkedIn Share this on Facebook Communiqué The CSSF publishes Luxembourg’s first ML/TF risk analysis on specialised professionals of the financial sector providing corporate services (trust and company service provider activities) CSSF Luxembourg’s first National Risk Assessment of money laundering and terrorist financing (NRA), published in December 2018, has concluded that the Specialised Professionals of the Financial Sector (Specialised PFS) providing corporate services carried a high inherent money laundering and financing of terrorism (ML/FT) risk. This finding is not unusual as this category of professionals falls into a larger category called the Trust and Company Service Providers (“TCSP”) therefore this result is in line with conclusions of the Financial Action Task Force (FATF) and the European Commission in its own Supranational Risk Assessment. In order to link the NRA to the Specialised PFS entity-level ML/FT risk assessments that the CSSF performs annually, and to develop a more granular and systematic perspective on the risks faced by TCSP (more particularly Specialised PFS), the CSSF began in 2019 an analysis of ML/FT risks related to the TCSP activities carried out by Specialised PFS. It is to be noted that TCSP activities are also carried out by other professionals and, whilst they are not the focus of this assessment, they may also find this assessment useful. Building on the findings from the NRA, this sub-sector risk assessment takes a closer look not only at ML/FT inherent risks, but also at risk-mitigating factors applied by Specialised PFS and the CSSF, as well as their impact on inherent risk and the resulting residual risk level. The CSSF expects Specialised PFS to reflect the findings and conclusions from this sub-sector risk assessment into their frameworks to ensure they remain appropriate to effectively mitigate ML/FT risks. Other CSSF supervised entities should also consider and use the findings and conclusions from this sub-sector risk assessment as appropriate in case they provide TCSP services. 20 July 2020 - Updated on 20 January 2026 ML/TF Sub-Sector Risk Assessment on Specialised Professionals of the Financial Sector providing corporate services (trust and company service provider activities) – 2026 update CSSF Studies and reports PDF (1.05Mb) Main topic: Financial crime Relevant for Central Securities Depositories (CSDs) Credit institutions Investment companies in risk capital (SICARs) Investment firms Investment fund managers Specialised investment funds (SIFs) Specialised PFS Support PFS Undertakings for collective investment in transferable securities (UCITS) Undertakings for collective investment subject to Part II of the Law of 17 December 2010 (Part II UCIs) ML/TF SUB-SECTOR RISK ASSESSMENT Specialised Professionals of the Financial Sector providing corporate services (Trust and Company Service Providers) January 2026 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 1 ML/TF SUB-SECTOR RISK ASSESSMENT Specialised Professionals of the Financial Sector providing corporate services (Trust and Company Service Providers) TABLE OF CONTENTS Foreword ........................................................................................................................... 4

Purpose and scope of the document .............................................................................. 5
Introduction ............................................................................................................... 7 2.
Sub-sector overview................................................................................................. 7 2.1.
Specialised PFS acting as Trust and Company Service Provider (TCSP)...................... 8 2.1.
Business relationships (Clients) ........................................................................... 12 2.1.2.
Vehicle type ................................................................................................ 13 2.1.2.
Legal forms ................................................................................................. 13 2.1.
Beneficial owners (BOs) ..................................................................................... 15 2.1.
Third parties ..................................................................................................... 17 2.
Sub-sector ML/TF context ........................................................................................ 17
Process .................................................................................................................... 22
Methodology ............................................................................................................. 23 4.
Methodology of the assessment and scope ................................................................. 23 4.
ML/TF risk scoring ................................................................................................... 23 4.
Data sources .......................................................................................................... 24
Inherent risk – threat assessment ................................................................................ 25 5.
ML/TF threat overview ............................................................................................. 25 5.
ML/TF threats for Specialised PFS ............................................................................. 25 5.2.
General ML threats ............................................................................................ 25 5.2.
Specific ML threats significant for Specialised PFS.................................................. 27 5.2.
TF threats for Specialised PFS ............................................................................. 33 5.2.
PF threats for Specialised PFS ............................................................................. 35
Inherent risk – vulnerability assessment ....................................................................... 38 6.
Client risk .............................................................................................................. 39 6.1.
Result of inherent client risk ............................................................................... 41 6.
Country/Geographic risk .......................................................................................... 41 6.2.
Result of inherent country/geographic risk............................................................ 44 6.
Product, service and transaction risk ......................................................................... 44 6.3.
Product and services .......................................................................................... 45 6.3.1.
Incorporation of companies ........................................................................... 45 6.3.1.
Domiciliation of companies............................................................................ 46 6.3.1.
Provision of directorship and secretarial services.............................................. 48 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 2 6.3.
Transactions ..................................................................................................... 49 6.3.
Result of inherent products, services or transactions risks ...................................... 50 6.
Distribution/Delivery channel risk ............................................................................. 50 6.4.
6.4.
Result of inherent distribution/delivery channel risk...................................... 52 6.
Overall inherent risk ................................................................................................ 52
Mitigating factors and residual risk assessment ............................................................. 53 7.
Risk mitigation by Specialised PFS ............................................................................ 53 7.1.
ML/TF risk appetite, risk self-assessment and risk-based approach .......................... 53 7.1.
Customer due diligence and ongoing monitoring ................................................... 54 7.1.
Procedures and trainings .................................................................................... 55 7.1.
Internal controls and governance ........................................................................ 56 7.
Risk mitigation by the CSSF ..................................................................................... 56 7.2.
Understanding of ML/TF risks .............................................................................. 56 7.2.
Market entry process ......................................................................................... 57 7.2.
Off- and on-site supervision ................................................................................ 57 7.2.
Enforcement rules ............................................................................................. 58 7.
Overall residual risk assessment ............................................................................... 59
Most frequent off- and on-site findings ......................................................................... 60
Areas for further IMPROVEMENT .................................................................................. 62 9.
CSSF recommendations to the private sector ............................................................. 62 9.
CSSF initiatives ...................................................................................................... 65 APPENDIX A – Thematic review on depositaries of bearer shares .............................................. 66 APPENDIX B – Thematic review on the use of shelf companies ................................................. 68 APPENDIX C – Thematic review on Terrorist Financing ............................................................ 71 APPENDIX D - High level summary on Banks performing TCSP activities ................................... 73 APPENDIX E - High level summary on Investment Firms performing TCSP activities ................... 74 APPENDIX F - RED FLAG INDICATORS .................................................................................. 75 APPENDIX G - ACRONYMS ................................................................................................... 78 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 3 Foreword Since the initial publication in 2020 of the sub-sector risk assessment of specialised professionals of the financial sector (“Specialised PFS”) providing corporate services (referred to as trust and company service provider or “TCSP”), the understanding by the Commission de Surveillance du Secteur Financier (“CSSF”) and Specialised PFS of money laundering and terrorist financing risks in this specific area has been further developed. This has been favoured by the public private partnership put in place with the Association of Luxembourg Compliance Officers (ALCO), the Luxembourg Alternative Administrators Association (L3A), the Luxembourg Association of Family Offices (LAFO), the Luxembourg Private Equity Association (LPEA), the Association Luxembourgeoise du Risk Management (ALRiM) and the Luxembourg FIU. Such a public-private dialogue helps providing clarity on risks related to specialised PFS activities, defining regulatory explanations and aims at identifying specific areas or issues where more regulatory guidance is needed. The growth of the financial sector has increased the TCSP sector’s exposure to the evolving threat of money laundering and terrorism financing. Specialised PFS providing corporate services act as gatekeepers of the financial sector through notably domiciliation agent services and directorship services. This risk assessment is a valuable tool for all stakeholders to better understand the ML/TF risks associated with TCSP activities and the measures necessary to combat them. Specialised PFS providing corporate services are expected to use this sub-sector risk assessment to review and strengthen their understanding of ML/TF threats and vulnerabilities and further contribute towards the development of proportionate and effective controls. To this end, the assessment details observed best practices, common findings from supervision, and targeted recommendations that the private sector should adopt. CSSF will monitor professionals’ adherence to these recommendations as part of its supervisory activities. Following the adoption of the 4th Mutual Evaluation Report of Luxembourg by the Financial Action Task Force (“FATF”), I would like to thank everyone who contributed to this effort. This updated sub-sector risk assessment aims to equip financial stakeholders with the tools to adapt their AML/CFT initiatives, thereby ensuring Luxembourg's continued status as a secure and resilient financial hub. Marco Zwick Director, CSSF ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 4
Purpose and scope of the document The AML/CFT supervision of the Commission de Surveillance du Secteur Financier (“CSSF”) aims to maintain a comprehensive and deep understanding of the ML/TF threats, vulnerabilities and risks to which the Luxembourg financial sector is exposed to and to continue to promote the understanding of ML/TF risks and AML/CFT obligations and the implementation of risk mitigating measures. In 2020, Luxembourg published an updated National Risk Assessment (“2020 NRA”) to identify, understand and assess the country’s ML/TF risks and support the definition of the national AML/CFT strategy. The 2020 NRA included an assessment of the inherent risks and mitigating factors associated with trust and company service providers (“TCSPs”) and mentioned that these could be misused or abused for ML/TF purposes. The 2020 NRA concluded that for Specialised PFS providing corporate services there was a High inherent risk. The quality of the implemented mitigation measures allowed to reduce the residual risk to Medium. In 2025, Luxembourg published its latest update of the national risk assessment on money laundering (“2025 NRA”). The inherent ML risk level of Specialised PFS providing corporate services remains High. Overall key risk drivers continue to be fragmentation/complexity, international nature of business followed by product/activity and client risk. Table 1: Specialised PFS providing corporate services ML risk assessment outcome Sub-sectors Inherent risk Residual risk Specialised PFS providing corporate services High Medium In May 2022 the Luxembourg Committee on the Prevention of Money Laundering and Terrorist Financing adopted the Vertical Risk Assessment on Terrorist Financing 1 (the “VRA TF”). The VRA TF does not consider the sub-sector of the Specialised PFS providing corporate services as a vulnerable sector. Table 2: Specialised PFS providing corporate services TF risk assessment outcome Sub-sectors Inherent risk Residual risk Specialised PFS providing corporate services Medium Low In 2020, the CSSF published its first sub-sector risk assessment dedicated to Specialised PFS providing corporate services (TCSP activities). The present updated sub-sector risk assessment (“SSRA”) provides for the link between the 2025 NRA, the VRA TF and entity-level risk assessments performed by the CSSF. It fulfils multiple objectives, in particular: 1 • Reflect the CSSF’s own understanding of specific ML/TF risks in the sub-sector. • Further improve the CSSF supervisory activities and sub-sector specific supervisory strategy, where relevant. • Act as an input into CSSF’s entity-level risk assessments. • Serve as a source for the industry in performing their own ML/TF risk assessments. • Promote the understanding of ML/TF risks and AML/CFT obligations in the industry. Ministry of Justice, Terrorist Financing – Vertical Risk Assessment, May
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 5 • Support public-private interaction. The scope of this assessment focuses on TCSP activities carried out by Specialised PFS. This sub-sector risk assessment covers also the risk of proliferation financing to which Specialised PFS may be exposed (cf. chapter 5.2.4.). Non-TCSP activities such as registrar agent, professional depositaries of financial instruments, professional depositaries of assets other than financial instruments, operators of a regulated market authorised in Luxembourg, currency exchange dealers, debt recovery professionals, professionals performing lending operations, professionals performing securities lending, family offices and mutual savings fund administrators, do not fall under the scope of this assessment. High level summaries on Banks and Investment Firms performing TCSP activities are provided in appendix D and appendix E. NOTE: While this assessment does not cover other professionals carrying out TCSP activities such as asset management companies or other professionals whose supervision falls outside the remit of the CSSF (that may perform TCSP activities as ancillary services), these professionals might, however, find the information contained in this assessment helpful to reflect upon and strengthen their AML/CFT framework. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 6
Introduction This section introduces TCSP activities performed by Specialised PFS. A detailed understanding of TCSP activities is key to identify, understand and assess ML/TF risks to which professionals are exposed. FATF defines TCSPs as providers of the following services to third parties 2:
Acting as a formation agent of legal persons.
Acting as (or arranging for another person to act as) a director or secretary of a company, a partner of a partnership, or a similar position in relation to other legal persons.
Providing a registered office, business address or accommodation correspondence or administrative address for a company, a partnership, or any other legal persons.
Acting as (or arranging for another person to act as) a trustee of an express trust or performing the equivalent function for another form of legal arrangement.
Acting as (or arranging for a person to act as) a nominee shareholder for another person. 2.
Sub-sector overview Several factors have contributed to the development of the financial sector. Indeed, Luxembourg enjoys a high degree of political stability, and an advanced legal and regulatory framework. As a leading international financial centre, it also benefits from high quality professionals, good infrastructure and connections to other European and international markets, making it attractive to investors and corporations. In addition, the country is also a major centre of activity for international investment asset managers. TCSPs play an important role in the global economy. Luxembourg counted 82 Specialised PFS and 2 Support PFS providing TCSP services. The Specialised PFS represent over 6 500 employees as at 31 December 2024, with balance sheet assets of EUR 1.2 billion and profit of EUR 118 million. TCSPs are often involved in the formation, management and administration of legal entities and arrangements, fulfilling as such a gatekeeper role to the wider financial community. The TCSP activity involves four main types of stakeholders:
TCSPs conduct on behalf of their clients the services of incorporation, provision of directorships and corporate secretarial services, domiciliation of companies and trustee of an express trust. To be noted that other services can also be provided by TCSPs.
Business relationships (clients) employ TCSP services to effectively administer and structure their assets and businesses. They can be natural, legal persons or legal arrangements and they can take multiple legal forms. In general, the structures serviced by Specialised PFS are legal persons/legal arrangements.
Beneficial owners (BOs) of clients are any natural person(s) who ultimately own or control the client or on whose behalf a transaction or activity is being conducted
2 FATF, Guidance for a Risk-Based Approach, TCSP sector,
3 The AML/CFT Law, Article 1

(7). ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 7

Third parties support TCSPs and clients with specialised services. They can act either as business providers, or advisors, or service providers (e.g. lawyers, accountants, etc.). Each stakeholder is described in detail in the sub-sections that follow. 2.1.
Specialised PFS acting as Trust and Company Service Provider (TCSP) In Luxembourg, TCSPs are not authorised under the laws as a separate business sector. In fact, different types of professionals can carry out the activities identified in the FATF definition of TCSPs, including Specialised PFS if they are licensed to do so. TCSPs have to be registered either with one of the supervisory authorities or one of the competent self-regulatory bodies as per Article 7-2 of the law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the “AML/CFT Law”). In Luxembourg, the AML/CFT Law defines five types of TCSP activities 4:
Incorporation: Forming companies or other legal persons.
Directorship and secretarial services: Acting as or arranging for another person to act as a director, manager, member of the board of directors, member of the executive board or secretary of a company, a partner of a partnership, or a similar position in relation to other types of legal persons.
Domiciliation: Providing a registered office, business address, correspondence or administrative address or business premises and, where applicable, other related services for a company, a partnership or any other legal person or arrangement.
Fiducie/trust: Acting as, or arranging for another person to act as, a fiduciaire in a fiducie (as defined the 2003 Fiducies and Trust Law), a trustee of an express trust or an equivalent function in a similar legal arrangement
Nominee shareholder: Acting as, or arranging for another person to act as, a nominee shareholder for another person
This sub-sector risk assessment reviews the TCSP activities conducted by Specialised PFS and Support PFS supervised for AML purposes by the Specialised PFS department. 4 The AML/CFT Law, Article 1

(8). 5 Specialised PFS cannot act as fiducie under the Law of 27 July 2003 on Fiducies and Trusts. 6 The Anglo-Saxon concept of “nominee shareholder” does not exist in Luxembourg civil and commercial law. The closest concept used with regard to Luxembourg legal persons is that of “proxy”. Under Luxembourg law the proxy must identify the principal and disclose the existence of the proxy relationship to any relevant stakeholder. TCSPs that offer proxy arrangement services to shareholders are all subject to the AML/CFT Law and must implement customer due diligence requirements in relation to their customers, including identifying and verifying the identity of the beneficial owner and obtaining information on the purpose and intended nature of their business relationship. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 8 Specialised PFS performing TCSP activities hold the licenses defined in the following table: Table 3: Mapping of Specialised PFS providing TCSP activities TCSP Activities Specialised PFS licences Corporate domiciliation agents Professionals providing company incorporation and management services Incorporation of companies ✔ ✔ Provision of directorship and secretarial services Domiciliation of companies Fiducie/trust ✔ ✔ ✔7 ✔ x ✔8 To be noted that, in 2024, 82 out of 96 of the Specialised PFS and 2 Support PFS held at least one license allowing it to provide TCSP activities. A majority of Specialised PFS hold however both licences. Table 4: Number of Specialised PFS (including Support PFS) acting as TCSP per year (2021-2024) The Specialised PFS sector has a relative degree of fragmentation 9. Indeed, Specialised PFS can have various licenses, each enabling the provision of different services. Many of the Specialised PFS also offer other services not falling in the TCSP definition. For instance, in Luxembourg, the prominence of funds has led many Specialised PFS to request other licenses such as Registrar Agent and Professional Depositary of Assets other than Financial Instruments. In addition, Specialised PFS can supplement their services to clients with ancillary services such as accounting services and filing of tax related documents. 7 Specialised PFS are authorised to provide trust services but cannot act as fiducie under the Law of 27 July 2003 on Fiducies and Trusts, Article 4. Specialised PFS are authorised to provide trust services but cannot act as fiducie under the Law of 27 July 2003 on Fiducies and Trusts, Article 4. 8 9 2025 NRA. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 9 For the purposes of this risk assessment, TCSP activities conducted by Specialised PFS are grouped into three categories: 1. incorporation of companies, 2. provision of directorship and secretarial services, and 3. domiciliation of companies. Table 5: Percentage of Specialised PFS which reported income from TCSP activities in 2024 10 As at 31 December 2024, 54% of the Specialised PFS reported income in all three categories of TCSP activities, 32% reported income in two categories of activities, and 14% reported income in just one category of TCSP activity. 10 CSSF internal data as at 31.12.2024. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 10 The next table shows the generated income for the three categories of activities. Table 6: Percentage of Specialised PFS performing TCSP activities and their income 11 generated from TCSP activities in 2021, 2022, 2023 and 2024 12 % of Specialised PFS 2021 Income Income 2021 % of Specialised PFS 2022 Incorporation of companies 61% 8,8m Provision of directorship and secretarial services 81% Domiciliation of companies 86% TCSP activities Income 2022 % of Specialised PFS 2023 Income 2023 % of Specialised PFS 2024 58% 7,7m 46% 7,5m 52% 7,1m 64,2m 80% 69,1m 76% 76,5m 77% 79,2m 24,8m 84% 28,7m 83% 32,5m 84% 33m 2024 There is a significant difference of the generated income between the different categories of TCSP services. This is because incorporation services are invoiced as a one-off fee and domiciliation activities are invoiced as a standard annual fixed fee, while directorship and secretarial services are invoiced predominantly on a time spent basis. To be noted in this context that, based on information available to the CSSF, in general, Specialised PFS do not wish to provide directorship and secretarial services on a standalone basis, but rather insist on providing domiciliation services in addition. This allows Specialised PFS to have a more holistic view of their clients which in return allows them to define i.a. tailormade due diligence measures for the ongoing monitoring. The 2025 NRA defines six dimensions to determine the sectorial vulnerabilities ((

i)structure, (
ii)ownership/legal structure, (iii) products/activities, (
iv)geography, (
v)clients/transactions, and (
vi)channels). Based on these six dimensions, the 2025 NRA concludes as follows: (
i)Luxembourg counted 85 specialised PFSs (out of a total of 100 entities) providing corporate services with over 6 400 employees as of December 2023, with balance sheet assets of EUR 1,02 billion and profits reaching EUR 90 million. The sector remained quite fragmentated with top-five entities accounting for 40% of the market’s revenues in 2023. (
ii)Vulnerabilities stemming from foreign ownership are assessed to be moderate, as 55% of specialized PFSs providing corporate services were under Luxembourg ownership, 19% under EU ownership (excluding Luxembourg) and 26% under non-EU ownership. (iii) In Luxembourg, the ML risk remains driven by the fact that these Specialised PFSs offer TCSP activities. They are often involved in the establishment and administration of legal persons and arrangements, playing a key role as gatekeepers of the financial sector. (
iv)Specialised PFSs providing corporate services’ clientele were almost entirely made up of legal persons (99%). More than half (61%) of the client companies’ BOs resided in non-EU countries and 1,46% resided in a high-risk country. Exposure to a non-EU clientele remains a significant vulnerability to ML for this sub-sector. 11 In Euros. 12 CSSF internal data as at 31 December. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 11 (
v)With the overall number of clients of specialised PFS providing corporate services being rather limited (with over 30 000 client companies in 2023 and 20 000 in 2020), exposure to ML risks is considered to be moderate. Nevertheless, specialised PFSs providing corporate services have identified one in five client companies as high risk and around 4% of client relationships involve PEPs (e.g. a PEP being the BO, legal representative, etc.). Although this share has decreased over the observation period, this figure remains high, driving ML client risk. (
vi)Channels used by the sub-sector pose moderate ML risks. Most players have direct relationships with clients and intermediaries are business providers (accountants, ...) including the group to which the PFS belongs. 2.1.2. Business relationships (Clients) Specialised PFS provide services 13 to Luxembourg and foreign funds (regulated and non regulated) for which it is often required to set up one or more related vehicles (such as special purpose vehicles, wholy owned subisdiaries, general partners, etc.). As a result many vehicles are related to investment funds. Another category of business relationships (clients) are international legal persons or legal arrangements (such as multi-nationals, small and medium sized commercial companies) and to a lesser extent wealthy individuals. Clients employ TCSP services in order to effectively administer and structure their assets and businesses. They often request the incorporation of a vehicle, and it is not uncommon for one client to set up several vehicles (see hereafter). In general, these vehicles are domiciled with the Specialised PFS and clients often request in addition directorship services. To complement the TCSP services, some clients request accounting and tax services or other ancillary services. Clients use different types of vehicles “through which a wide variety of commercial activities are conducted and assets are held” 14. TCSPs interact with these vehicles when setting them up and managing and/or administrating them. They can be categorised based on the vehicle type or legal form. 13 Not only limited to TCSP activities. 14 OECD, Behind the Corporate Veil, 2001. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 12 2.1.2.1. Vehicle type Vehicles are used for the pooling and transfer of ownership of assets for different purposes. There are three vehicle types: 1. Regulated investment vehicles are undertakings pooling assets from investors with the intention of generating positive returns for investors. They are governed and supervised pursuant to sectoral laws of the financial sector. 2. Unregulated investment vehicles serve the same purpose as regulated vehicles. 3. Other vehicles are those used for the mere purpose of holding assets. They may be regulated or unregulated. These vehicles can be further categorised based on their functions and characteristics. Table 7: Vehicles categorisation 15,16 These categories are comprised of additional sub-categories, which are governed by sectoral laws such as for example the law of 22 March 2004 on securitisation (as amended), the law of 15 June 2004 relating to the investment company in risk capital (as amended), the law of 13 February 2007 relating to specialised investment funds (as amended), the law 17 December 2010 relating to undertakings for collective investment (as amended), and the law of 23 July 2016 on reserved alternative investment funds (as amended). 2.1.2.2. Legal forms The vehicles identified above can be set up under different legal forms: • Corporate legal forms are those where the legal entity has a standalone legal personality. These entities are considered independent from their partners or shareholders and will have rights and obligations such as the capacity to enter into contracts, suing and being sued. They fall under the FATF definition of legal persons. • Contractual legal forms are those based on a contractual agreement and thus have no separate legal personality from the parties involved in the agreement. They fall under the FATF definition of legal arrangements. 15 Regulated AIF include regulated non-AIF SIF and SICAR. 16 Unregulated AIF include any entity not regulated by the Law of 17 December 2010 – Part I (“UCITS Law”), Law of 15 June 2004 (“SICAR Law”), or Law of 13 February 2007 (“SIF Law”) but meeting the criteria of the AIFM Law. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 13 Table 8: Legal form categorization Legal form Corporate Contractual Category Sociétés commerciales Sub category Société Limited en Société liability comman cooperative companies dite Legal entity SA, SAS, SCA, SCS, Sàrl, SàrlS 17 SCSp 18 SC 19, SCoSA 20 Non-profit organisations Foundations Sociétés civiles Société Société Société universelle universelle particulière tous biens 23 de gains 22 présents 21 Société civile immobilière Inlt. NPOs Fondation d'utilité publique 24 Other ASBL ASBL 25 Fonds Intl. commun de trust placement FCP 26 Intl. Fiducie 28 trust 27 Each of these legal forms will have a series of characteristics and requirements based on which they can be segmented. These characteristics and requirements will help clients decide which legal form is the most appropriate for their business and asset planning purposes. In February 2022, Luxembourg published the ML/TF Vertical Risk Assessment – Legal persons and legal arrangements 29 (“VRA LP/LA”). The VRA LP/LA assessed (
i)the risk of misuse of the country’s corporate sector for ML/FT purposes, (
ii)the specific ML/TF risk of each type of legal person and each type of legal arrangement created in Luxembourg, and (
iv)how these vehicles could be misused or abused for ML/TF purposes. The VRA LP/LA concluded that Société anonyme and Société à responsabilité limitée were rated as “high” inherent risk. The quality of the implemented mitigation measures allowed to reduce the residual risk to “medium”. Other legal forms such as Société cooperative (“SC/SCoSA”), Société par actions simplifiée (“SAS”), Société à responsabilité limitée simplifiée (“SARL-S”), Société en commandite par actions (“SCA”), Société en commandite simple Sociéte anonyme as defined by the Law of 10 August 1915, as amended (“Companies Law”), Article 410-1, Sociéte par actions simplifiée as defined by the Companies Law, Article 500-1, Société à responsabilité limitée as defined by the Companies Law, Article 710-1, Société à responsabilité limitée simplifiée as defined by the Companies Law, Article 720-1. 17 18 Société en commandite par actions as defined by the Companies Law, Article 600-1, Société en commandite Simple as defined by the Companies Law, Article 301-1

(1), Société en commandite spéciale as defined by the Companies Law, Article 320-

19 Société cooperative as defined by the Companies Law, Article 811-
20 Société cooperative organisée comme une société anonyme as defined by the Companies Law, Article 820-
21 As defined by Luxembourg Civil Code, Article
22 As defined by Luxembourg Civil Code, Article
23 As defined by Luxembourg Civil Code, Article
24 Fondation d' utilité publique as defined by Law of 21 April 1928 (“NPOs Law”), Article
25 Association sans but lucratif as defined by Law of 21 April 1928 (“NPOs Law”), Article
26 Fonds commun de placement defined as “any undivided collection after performance of filing and registration with the Trade and Companies' Register requirements of assets made up and managed according to the principle of risk spreading on behalf of joint owners who are liable only up the amount contributed by them […]” in 2016 RAIF Law, the 2007 SIF Law and the 2010 UCI Law. As defined by the Den Hague Convention of 1st July 1985 and ratified by the Law of 27 July 2003 (“Fiducies and Trust Law”). 27 28 For definition see Law of 27 July 2003 (“Fiducies and Trust Law”), Articles 4 and
29 Ministry of Justice, ML/TF Vertical Risk Assessment – Legal Persons and Legal Arrangements,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 Fiducies 14 (“SCS”) and Société en commandite spéciale (“SCSp”) have been assessed as having a “medium” or “low / very low” inherent risk and a residual risk of “low” and “very low”. Table 9: Entity type risk assessment Entity type Inherent risk Residual risk Société anonyme High Medium Société à responsabilité limitée High Medium Sociétés commerciales As of 31 December 2024, Specialised PFS reported that 12% of their clients to which they provide TCSP activities had the legal form of a Société anonyme and 73% had the legal form of a Société à responsabilité limitée. 15% have other legal forms (e.g. SC/SCoSA, SAS, SARL-S, SE, SCA, SCS, SCSp and SNC). Table 10: Percentage of clients which are Société Anonyme, Société à Responsabilité Limitée or having another legal form for 2024 30 2.1.
Beneficial owners (BOs) The BO(s) of the vehicles set up, managed and administrated by TCSPs is (are) the natural person(s) who ultimately own(s) the vehicle, on whose behalf the vehicle’s transaction is being carried out, and/or who control(s) the vehicle. The determination of the BO of a vehicle depends on its legal form since it depends on the ownership structure and control structure
Article 1

(7)of the AML/CFT Law defines the “beneficial owner” as “any natural person(

s)who ultimately owns or controls the customer or any natural person(
s)on whose behalf a transaction or activity is being conducted”. 30 CSSF internal data as at 31 December 2024. See Circular CSSF 19/732 as amended by Circular 24/861 for further details on clarifications on the identification and verification of the identity of BOs. 31 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 15 For the identification of the BO of companies, the AML/CFT Law provides the below threefold cascading process. As such are defined as BO, any natural person who: (
i)“[…] ultimately owns or controls a legal entity through direct or indirect ownership of a sufficient percentage of the shares or voting rights or ownership interest in that entity, including through bearer shareholdings, or through control via other means, other than a company listed on a regulated market that is subject to disclosure requirements consistent with European Union law or subject to equivalent international standards […]. A shareholding of 25% plus one share or an ownership interest of more than 25% in the customer held by a natural person shall be an indication of direct ownership. A shareholding of 25% plus one share or an ownership interest of more than 25% in the customer held by a corporate entity, which is under the control of a natural person(s), or by multiple corporate entities, which are under the control of the same natural person(s), shall be an indication of indirect ownership”. 32 (
ii)“[…] controls through control via other means”. 33 (iii) “[…] holds the position of senior managing official”. For the identification of the BO of fiducies, trusts, foundations and similar legal arrangements, the AML/CFT Law defines all following persons: (
i)the settlor(s), (
ii)the fiduciaire(
s)or trustee(s), (iii) the protector(s), if any, (
iv)the beneficiaries, or where the individuals benefiting from the legal arrangement or entity have yet to be determined, the class of persons in whose main interest the legal arrangement or entity is set up or operates, (
v)any other natural person exercising ultimate control over the fiducie or trust by means of direct or indirect ownership or by other means. Luxembourg has set up in 2019 a Register of Beneficial Owners (“RBE”) 34 which is managed by the Luxembourg Business Registers (“LBR”). Legal persons registered with the Registre de Commerce et des Sociétés (“RCS”) are required to register their BO(
s)at the RBE. BOs have a legal duty to provide the relevant BO information to the registered legal person 35. In addition, this BO information must be held by the registered legal person at its registered office in Luxembourg, together with all relevant supporting documents 36. Any person, having access to the RBE, has the obligation to report to the RBE any discrepancies they identify between the data in the RBE and the information in their own records within 30 days of that discovery 37. To be noted that a percentage of more than 25% is only an indicative threshold to meet this criterion. Professionals may implement a lower threshold following a risk-based approach. 32 33 See Article 1

(7)(

a)(aa), (bb), (
cc)and (
dd)of the AML/CFT Law for “control through other means”. 34 Law of 13 January 2019 establishing the Beneficial Owner Register, as amended (the “RBE Law”). 35 The RBE Law, Article 17

(1). 36 The RBE Law, Article 17

(2). 37 The RBE Law, Article

ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 16 In addition, Luxembourg has set up in 2020 a Register of Fiducies and Trusts (“RFT”) 38 which is maintained by the Administration de l'Enregistrement, des Domaines et de la TVA (“AED”). Trustees and fiduciaires are required to obtain and keep at the place of administration of the trust or fiducie, information on the BOs of any trust administered in Luxembourg and of any fiducie for which they act as trustee or fiduciaire
Every fiducie or express trust of which a trustee or fiduciaire is established or resides in Luxembourg is required to submit detailed information on all BOs to the RFT
Any person, having access to the RFT, is required to promptly report to the AED any discrepancies found between the data in the RFT and the information in their own records
2.1.
Third parties Third parties act in the TCSP industry as either advisors, service providers or business providers. Advisors typically advise clients. For example, they provide advice relating to the incorporation of structures and planning of assets. Advisory services may be provided by a range of professions such as for example accountants, tax advisors, lawyers and wealth advisors. Service providers typically provide services (such as bank accounts, accounting and tax services) to clients, vehicles and the TCSPs. Service providers may be for example banks, accountants and other TCSPs. Business providers are professionals that facilitate the first contact between the TCSP and the client. Once this first introduction has taken place, they may not be involved in any ongoing transaction between the TCSP and the client. These introductions are common in the industry. It is not uncommon that foreign TCSPs refer business relationships to local TCSPs to conduct the requested services. For example, as Specialised PFS are in many cases part of international groups, a group company of the Specialised PFS may refer a client. It is also very common that the above-mentioned advisors introduce new clients to TCSPs. Based on the above, the network of clients, third parties and TCSPs can span across multiple jurisdictions, and be comprised of multiple layers
2.
Sub-sector ML/TF context The CSSF continues to apply a risk-based approach to AML/CFT supervision, in line with i.a. FATF guidelines and recommendations and Luxembourg and European requirements. This implies identifying, assessing and understanding ML/TF risks faced by the TCSP sector, its specific products and services, the customers and jurisdictions, the channels of delivery involved, and taking AML/CFT measures commensurate to those risks to mitigate them effectively. 38 Law of 10 July 2020 establishing a Register of Fiducies and Trusts, as amended (the “RFT Law”). 39 The RFT Law, Article
40 The RFT Law, Article
41 The RFT Law, Article
42 Lord et al. Other People’s Dirty Money,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 17 FATF has identified the TCSP sector as particularly exposed to ML/TF, “Criminals may seek the opportunity to retain control over criminally derived assets while frustrating the ability of law enforcement to trace the origin and ownership of the assets. Companies and often trusts and other similar legal arrangements are seen by criminals as potentially useful vehicles to achieve this outcome. While shell companies 43, which do not have any ongoing business activities or assets, may be used for legitimate purposes such as serving as a transaction vehicle, they may also be used to conceal beneficial ownership, or enhance the perception of legitimacy. Criminals may also seek to misuse shelf companies formed by TCSPs by seeking access to companies that have been ‘sitting on the shelf’ for a long time. This may be in an attempt to create the impression that the company is reputable and trading in the ordinary course because it has been in existence for many years. Shelf companies can also add to the overall complexity of entity structures, further concealing the underlying beneficial ownership information”
According to a thematic review performed by the CSSF in 2024 on the use of shelf companies by Specialised PFS providing corporate services, only 5% of Specialised PFS set up shelf companies. This service remains limited and is typically available only to existing business relationships. The Specialised PFS continue to provide services to the shelf companies after their sale, e.g. domiciliation- or directorship services. In the context of this thematic review, the CSSF has not identified a misuse of shelf companies. Please see appendix B for further details. According to FATF, “the services provided by TCSPs are vulnerable to exploitation by criminals and other professional intermediaries involved in these schemes”
Indeed, TCSPs are involved in the establishment and management of legal persons and legal arrangements (corporate vehicles) which “are an attractive way to disguise their identity and conceal the origin and/or destination or ultimate purpose of funds through manipulation of the financial system”
To identify, understand and assess the risk of TCSPs, it is also important to identify the financial risks and ML/TF typologies relevant to the legal persons and legal arrangements. Similarly to the previous sub-sector risk assessment, the CSSF has used amongst other sources the “FATF Guidance for a Risk-Based Approach for Trust and Company Service Providers (June 2019)”, the “FATF Terrorist Financing Risk Assessment Guidance (July 2019)”, the Luxembourg 2025 NRA and the Vertical Risk Assessments to update this sub-sector risk assessment. Furthermore, since the last sub-sector risk assessment, FATF has published several reports on financial crimes to assist firms and supervisors in understanding and mitigating the risks associated with their activities. Several reports contain information on the ML/TF risk exposure of the TCSP sector or the legal persons/legal arrangement to which TCSPs provide services. The most relevant include: • Money Laundering and the Illegal Wildlife Trade

(2020): This report includes a section on common techniques used to launder proceeds from the illegal trade and the use of shell companies. 43 To be noted that shell companies are prohibited in Luxembourg. 44 FATF, Guidance for a Risk-Based Approach, TCSP sector,

45 FATF and Egmont Group, Concealment of Beneficial Ownership,
46 FATF, Guidance on Beneficial Ownership of Legal Persons,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 18 • FATF/Egmont Trade-based Money Laundering: Trends and Developments

(2020): “The report aims to help public and private sector with the challenges of detecting tradebased money laundering” and explains that “there is often a significant intersection between TBML/TF schemes and the exploitation of shell or front companies”. • Trade-Based Money Laundering: Risk Indicators

(2021): This report provides risk indicators for this typology of ML including some indicators related to corporate structures. • Guidance on Proliferation Financing Risk Assessment and Mitigation

(2021): This report contains a section on “How are DNFBPs misused for the purposes of the potential breach, non-implementation, or evasion of PF-TFS?”. • Money Laundering from Fentanyl and Synthetic Opioids

(2022): This report contains information on traffickers using shell and front companies to launder drug proceeds, but also to procure drugs, precursor chemicals and production equipment with the proceeds. • Risk-based Approach Guidance for the Real Estate Sector

(2022): “A previous FATF report identified and summarised several activities that may be indicative, although not conclusive, of money laundering via the real estate sector. This Guidance adds to these typologies to include […] the use of non-financial professionals and the use of corporate vehicles or complex structures […]”. • Money Laundering and Terrorist Financing in the Art and Antiquities Market

(2023): This report contains a section on the role of intermediaries and legal persons, fictitious sales and false auctions, and under- or over-pricing in the domain of Art and antiquities market. The report states that “According to a recent article by the International Consortium of Investigative Journalists (ICIJ), more than 1,600 works of art appeared to have been traded using shell companies and trusts in offshore financial centres […]. This suggests that the misuse of corporate structures may be a common technique to disguise ownership of items and conceal funds laundered in the cultural objects market”. • Guidance on Beneficial Ownership of Legal Persons

(2023): This report helps understanding the vulnerabilities associated with legal persons and explains why different mechanisms for collection of beneficial ownership information of legal persons is important for the competent authorities in their ML/TF investigations/work. • Crowdfunding for Terrorism Financing

(2023): This report covers “formal crowdfunding platforms and crowdfunding activities on social media, messaging applications or other dedicated websites. It also considers hybrid means of crowdfunding that combine digital and physical fundraising. The variety in possible crowdfunding methods means that multiple funding sources and financial intermediaries can be involved, wittingly or unwittingly, to crowdfund support for TF”. • Beneficial ownership and transparency of legal arrangements

(2024): This report focuses on transparency requirements applicable to legal arrangements which refers to express trusts or other similar legal arrangements. It addresses the trust-specific features and related AML/CFT transparency obligations. • Horizontal Review of Gatekeepers’ Technical Compliance Related to Corruption

(2024): This report assesses the current state of play and identifies areas that FATF members must prioritise for further improvement. It is a deep dive into the actions that FATF members have taken to apply important aspects of the FATF Recommendations to gatekeepers. • Complex Proliferation Financing and sanctions evasion schemes

(2025): The report provides a detailed analysis of the evolving methods and techniques used to evade PF- ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 19 related sanctions, including those imposed under Recommendation 7 of the FATF Standards, as well as other national and supranational regimes beyond the FATF Standards, to inform the reader on how those seeking to evade PF-related sanctions could be doing so. It outlines how proliferation networks are sourcing dual-use goods, technologies, and knowledge (often through procurement networks and front companies) and using various financial channels to access the global financial system. • Comprehensive update on Terrorist Financing risk

(2025): The report reveals terrorists’ persistent ability to exploit the international financial system to support their activities and carry out attacks. With the TF methods varying depending on several factors and contexts, the report highlights terrorists’ adaptability, underscoring the need for riskbased counter-terrorist financing measures. In addition, the following reports and documents provide useful sources of information: • Circular CSSF 21/782

(2021)and complementing circulars: Adoption of the revised guidelines, by EBA, on money laundering and terrorist financing risk factors. • Europol European Union Terrorism situation and trend report

(2023): The report does not provide any information enabling to link TF and TCSP activities or their clients (legal persons/legal arrangements), however, the report indicates that there was one arrest for right wing terrorist offenses in Luxembourg in 2020. • Europol European Financial and economic crime threat assessment 2023: “The European Financial and Economic Crime Threat Assessment describes the complexities of financial and economic crimes, and the criminal ecosystem that virtually sustains and links all other criminal activities. The report analyses all financial and economic crimes affecting the EU, such as money laundering, corruption, fraud, intellectual property crime, and commodity and currency counterfeiting.” More particularly, the report describes money laundering methods and typologies on “the misuse of legal business structures: from restaurants to banks”. • The 2022 Supranational Report of the European Commission on the assessment of the risk of money laundering and terrorist financing: This assessment highlights that the “threats and vulnerabilities previously detected in the non-financial area are still largely applicable”. More specifically, “as per the FATF reports, it notes how TCSPs can be abused/misused to set up complex structures to obscure financial audit trails, often including the use of shell and front companies. A lack of cooperation and informationsharing between authorities in different jurisdictions creates areas of weaknesses that are easily exploitable by criminals seeking out jurisdictions where AML controls are less effective.” • Luxembourg ML/TF vertical risk assessment legal persons and legal arrangements

(2022): The report found that:

Regarding corporate risk, “legal arrangements and sociétés commerciales present the highest corporate inherent risk (“Very High”)”. Considering the impact of mitigating factors, their residual risk is “medium”. Sociétés civiles, “other legal persons” and foundations have a “high” corporate inherent risk and a “low” residual risk.
Regarding the entity-type specific risk, “with respect to the inherent entity-type risk, fiducies are the riskiest type of legal persons and legal arrangements (“Very High”), followed by SAs and SARLs (“High”). SASs, SEs, SCAs and NPOs (ASBLs and fondations) present a “Medium” inherent entity-type risk level. The inherent risk level ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 20 of the remaining entity types is “Low” or “Very Low”; and regarding residual risk, fiducies remain “Very High” despite of existing mitigating measures. The residual risk of SA and SARL is “Medium” once mitigating measures are considered. Except for sociétés civiles, SAS, SCA, SCSp and ASBLs (which its residual risk is considered “Low”), the residual risk of the remaining entity types is “Very Low”.”. • Luxembourg Terrorist Financing Vertical risk assessment

(2022): The report did not provide specific risks in relation to TCSPs, but it found that the residual risk of NPOs (a subtype of legal person) carrying out development and humanitarian projects abroad was “high”. • Opinion of the European Banking Authority on money laundering and terrorist financing risks affecting the EU’s financial sector

(2023): Although the opinion relates to the financial sector excluding therefore the TCSP sector, the report highlights risks which could be relevant to the TCSP sector because of its exposure to the same clients and common risks. The opinion highlights new and continuing risks in relation to politically exposed persons, implementation of restrictive measures, identification of ultimate beneficial owners in case of “complex structures with stacking of companies and front persons”, fight against laundering of proceeds of environmental crime as well as tax crimes, de-risking. • Opinion of the European Banking Authority on money laundering and terrorist financing risks affecting the EU’s financial sector

(2025): Although the opinion relates to the financial sector excluding therefore the TCSP sector, the report highlights risks which the financial sector faces due to the rapid evolution of financial technologies and new financial products such as crypto assets, and the growing interconnection of financial products and services across sectors, have introduced new vulnerabilities. • Luxembourg’s ML NRA

(2025): The NRA considers that TCSPs are a cross-cutting vulnerability. Specialised PFS providing corporate services still have a high inherent and medium residual risk although the mitigation measures have improved. This is driven by several factors, including:

(1)fragmentation and complexity of service providers which include several licenses; and

(2)number of non-EU beneficial owners of structures including some in an EU-listed high-risk country. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 21

Process This sub-sector risk assessment follows the general CSSF risk assessment approach defined in its ML/TF Risk Assessment Policy. Sub-sector risk assessments and typologies are conducted at the level of the TCSP sub-sector operated by Specialised PFS. The CSSF collects information by performing desk-based research (international sources, CSSF-specific data and other domestic sources) and gathering input from a panel of experts through bilateral or multilateral meetings and/or workshops. Sources typically include, but are not limited to, reports from FATF and other standard-setting bodies (e.g. typologies, guidance, mutual evaluations), publicly available risk assessments (e.g. EU SNRA), reports published by other competent authorities (e.g. supervisors, FIUs, law enforcement agencies) and information from industry bodies and public-private partnerships. CSSF-specific information reviewed includes entity- and sector-level risk assessments as well as the results from the entity-level data collection questionnaires. The CSSF creates a risk assessment report based on information collected, which articulates the risk level for the sub-sector (in line with the CSSF risk scoring methodology), the nature of the risk as well as typologies and trends. Based on this methodology, the Specialised PFS department of the CSSF led this sub-sector risk assessment, incorporating feedback and insights from the below parties: • CSSF: internal AML/CFT teams and sub-sector experts. • The Private-public partnership dedicated to Specialised PFS
• Cellule de Renseignement Financier (CRF). The Private-public partnership was created in October
The members are the Commission de Surveillance du Secteur Financier (CSSF), the Cellule de Renseignement Financier (CRF), the Association of Luxembourg Compliance Officers (ALCO), the Luxembourg Alternative Administrators Association (L3A), the Luxembourg Association of Family Offices (LAFO), the Luxembourg Private Equity Association (LPEA), and the Association Luxembourgeoise du Risk Management (ALRiM), see Expert Working Groups under the following link: Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) – CSSF. 47 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 22
Methodology 4.
Methodology of the assessment and scope The assessment covers the ML/TF threats in chapter 5, the vulnerabilities (inherent risk) in chapter 6, and the mitigation measures put in place by both the CSSF and the private sector in chapter
The methodology is based on the CSSF AML/CFT risk assessment policy and closely aligned to that used in Luxembourg’s NRA
It is also aligned to the FATF’s Guidance for a Risk-Based Approach
A clustering aims to group together activities with similar characteristics and risk profiles into a manageable number of classes, to assess their ML/TF risk. This report groups TCSP activities in three taxonomies (activity classes) which are subject to a detailed risk assessment: • incorporation of companies, • provision of directorship and secretarial services, and • domiciliation of companies. 4.
ML/TF risk scoring ML/TF risk is assessed using a scorecard approach, both before and after considering mitigating measures in place. This is centred on three components: • Inherent risk is the risk of ML/TF occurring through a particular class of the taxonomy before accounting for mitigating measures (including both ML/TF threats and vulnerabilities). • Mitigating factors are the supervisory measures and controls in place to reduce ML/TF risks for a particular class of the taxonomy. • Residual risk is the risk of ML/TF occurring through a particular class of the taxonomy after considering mitigating measures in place. Note, the NRA ranks risks on a five-point scale (Very High, High, Medium, Low, Very Low) – the CSSF risk assessment policy uses a four-point scale (High, Medium-High, Medium-Low, Low). 48 49 FATF, Guidance for a Risk-Based Approach, TCSP sector,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 23 Table 11: Overview of inherent and residual risk calculation 4.
Data sources This assessment uses both quantitative and qualitative data. This includes international sources (e.g. from international organisations, foreign competent authorities, industry bodies, academia), other domestic competent authorities (e.g. CRF), CSSF internal data collected as part of its supervisory measures, CSSF expert input, information provided by the private sector (e.g. via annual questionnaire on Financial Crime, interviews and expert working groups) and other domestic sources. Moreover, the CSSF has sent in 2023 and 2024 a dedicated questionnaire for the review exercise of the SSRA to the members of the private-public partnership. This questionnaire covered amongst others the following topics: • Additional/new ML/TF risks (threats and/or vulnerabilities) to be covered by/removed from the updated SSRA on TCSP activities. • Specific TF risks of TCSPs and mitigation measures applied. • Specific Targeted Financial Sanction risks of TCSPs and mitigation measures applied. • Specific Proliferation of weapons of mass destruction risks of TCSPs and mitigation measures applied. • Specific Corruption risks of TCSPs and mitigation measures applied. • Recommendations/guidance to the private sector. In addition, the Specialised PFS department of the CSSF performed in 2024 thematic reviews on the use of shelf companies by Specialised PFS performing TCSP activities and in 2025 on the assessment of the risk of terrorist financing (“TF”) by Specialised PFS. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 24
Inherent risk – threat assessment The objective of this chapter is to understand the environment in which predicate offences are committed to identify their nature and to assess the exposure of Specialised PFS to them (i.e. predicate offences not necessarily directly related to TCSPs but for which illicit proceeds could be channelled through the TCSP sector and therefore possibly the Specialised PFS sub-sector). Threats are analysed within the inherent risk assessment in chapter 5, that is the risk in the absence of mitigating factors and controls which are analysed in detail in chapter 7 of the present assessment. 5.
ML/TF threat overview The 2025 NRA identifies predicate offences which may occur in Luxembourg, as well as the criminals perpetrating these offences (i.e., the perpetrators). Starting from the FATF list of designated categories of predicate offences and using a weighted average of external and domestic exposure, it concluded for external threats that Fraud and forgery, Tax crimes and Corruption and bribery were “very high” threats. On the domestic threat level, the 2025 NRA concludes that fraud and forgery, robbery and theft and drug trafficking are “high” threats. This report considers both domestic and external threats. The NRA noted that the threat of ML proceeds from domestic crimes is smaller, due to Luxembourg’s relatively low crime rate and limited presence of organised crime. The threat of ML proceeds from international crime is, however, higher, given the international exposure of Luxembourg’s TCSP industry. To be noted that since July 2022, the violation of restrictive measures in financial matters has become a predicate offence of ML. 5.
ML/TF threats for Specialised PFS 5.2.
General ML threats This section covers predicate offences generating illicit proceeds which could expose the financial sector to ML threats. The objective of the threat assessment is to understand the environment in which predicate offences are committed, to identify their nature and to assess the exposure of Specialised PFS providing TCSP services to them. This sub-sector risk assessment examines the most relevant threats for these Specialised PFS, considering “very high” and “high” threats highlighted in the NRA. The NRA threats are themselves based on the FATF list of designated categories of predicate offence
This sub-sector risk assessment outlines why Specialised PFS may be at risk of being abused or misused for ML. 50 FATF, Glossary ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 25 TF threats are presented separately. Indeed, the assessment highlights the low prevalence of TF via Specialised PFS and provides the reasons behind this observation. Specialised PFS can be abused or misused to launder the proceeds from threats identified in the NRA. This can occur across the three stages of the ML process – placement, layering, and integration. Typically, such misuse or abuse evolves around concealing the identity of the BO of structures and the origin of funds, as well as channelling illicit funds through the financial system 51,52,
In Luxembourg, TCSPs may be exposed for multiple reasons: The sector is large and diverse, with a variety of licensed professionals and activities that can be conducted. Detection of ML threats may prove challenging in a market where diverse TCSPs and products exist. The international nature of the business, foreign client base and foreign ownership of assets, may increase the likelihood of dealing with illicit proceeds. To a lesser extent, TCSPs may also be requested to provide services subject to laws from other jurisdictions (for example for assistance in the incorporation of foreign companies and the provision of directorship services), which can make them more vulnerable from a ML perspective. With regards to TCSPs, most BOs/clients are indeed coming from foreign countries, with some being based in higher risk jurisdictions. However, the number of offshore structures serviced by TCSPs has significantly been reduced over the past years. Challenges in BO identification and origin of funds/wealth as a result of the diverse nature of clients which includes legal entities and arrangements in the shareholding structure which may enable the beneficial owner to hide his identity, particularly in instances where the primary relationship is with an intermediary advising the client
The verification of the origin of wealth for these BOs is also particularly challenging because it could be from multinational corporate groups, family fortune or unexplained gains realised in the past, etc. Intermediation of the relationships between a TCSP and client because of the presence of intermediaries (e.g. lawyers, accountants, business providers, advisors). This can reduce transparency around client identity. Services offered by TCSPs may be abused or misused to conceal the identity of the beneficial owner or their source of funds and facilitate the laundering of illegal proceeds
Regarding the vehicles serviced, these are mainly legal entities and a limited number of legal arrangements. Table 12: Percentage of clients being legal entities % Legal entities 2020 2021 2022 2023 2024 97% 95% 99% 97% 95% 51 FATF, Money Laundering using TCSPs,
52 FATF and Egmont Group, Report on Concealment of Beneficial Ownership,
53 FATF, The Misuses of Corporate Vehicles, including TCSPs,
54 FATF, Guidance for a Risk-Based Approach, TCSP sector,
55 FATF, Money Laundering using TCSPs,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 26 The number of legal arrangements serviced is significantly lower due to the facts that

(1)Specialised PFS are not allowed to provide fiduciary services under the 2003 Fiducie and Trust Law, and

(2)their use is not common practice in Luxembourg. Table 13: Percentage of clients being legal arrangements % Legal arrangements 2020 2021 2022 2023 2024 1% 3% 1% 2% 4% The remaining minor percentages are relating to clients being natural persons. 5.2.2. Specific ML threats significant for Specialised PFS There are three specific predicate offences that are most relevant for Specialised PFS performing TCSP activities, which are: fraud and forgery, tax crimes, corruption and bribery (see Table 14 below). The figures of SARs/STRs provide an overview of predicate offences suspected by Specialised PFS. However, it should be noted that it is possible that predicate offences are being perpetrated, or attempted, without SARs/STRs being filed. Nevertheless, these figures reflect the trends in terms of predicate offences. The following sub-sections explain each threat, present global typologies, and then focus on specific risks for Luxembourg 56. Table 14: Overview of predicate offences perpetrated within Specialised PFS Predicate offence Number of SARs/STRs filed in 2020 2021 2022 2023 Fraud and forgery 54 85 99 143 Tax crimes 38 34 31 37 Corruption and bribery 28 21 23 23 In 2024, 15 SARs/STRs were made relating to the circumvention of international financial sanctions 57. 56 Red flags indicators are available in appendix F. 57 CSSF internal data. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 27 Fraud and forgery As per the 2025 NRA, “fraud and forgery” refers to a broad set of deceptive practices as defined in Luxembourg’s Penal Code 58 and law of 10 August 1915 on commercial companies, as amended 59. TCSPs could be abused or misused to launder the proceeds of these offences, or to facilitate the predicate offence itself. According to the FATF, the international nature of the TCSP sector, combined with the lack of transparency in specific jurisdictions regarding the BO of structures can facilitate the integration of these illicit funds into the economy. Additionally, the TCSP industry is exposed to the risk of fraudulent abuse or misuse given its role as gatekeeper in the financial sector 60. Luxembourg’s position as an international payments and investment hub, together with its stable regulatory framework, and its central European location contribute to the number of TCSPs operating from Luxembourg. The concentration of TCSPs in the country increases the likelihood that national and international criminals may attempt to commit fraud by abusing or misusing the services provided by a TCSP. Exposure is increased by the fact that TCSPs may facilitate the financial flows through the economy and the management of structures used in international transactions. Tax crimes Tax crimes involve the intentional breach of law to evade tax payments. Tax evasion (“escroquerie fiscale") and aggravated tax fraud (“fraude fiscale aggravée”) are predicate offences in Luxembourg 61,62. Globally, TCSPs are vulnerable to tax crimes due to the international nature of their activities and their local expertise of regulatory and fiscal requirements. As a result, criminals can abuse or misuse TCSPs’ technical expertise to devise tax evasion schemes. These schemes may leverage structures in offshore jurisdictions to conceal their assets. TCSPs such as Specialised PFS can set up and manage these offshore structures. However, it is to be noted that this service has been considerably decreasing since 2016. Tax fraud can also be committed via TCSPs using third-party loan-backed schemes. These schemes involve money being sent to companies owned or controlled by, or on behalf of, the same individual and returned as a private third-party loan. They tend to operate following two steps 63: 1. Payment of business invoices: An individual directly or through a company A pays an invoice or a series of invoices to Company B, which will often be located offshore, and the individual is also the beneficial owner of Company B. The purpose is to reduce the taxable 58 Code Pénal Articles 175, 179 to 182, 184, 186, 187, 187-1, 194 to 197, 208, 211, 212, 215, 216, 221, 223 and 489 to 496-4. 59 Law of 10 August 1915 on commercial companies (as amended), Articles 1500-8 and 1500-11. 60 FATF, Money laundering using TCSPs, 2010. 61 Law of 23 December 2016 and Circular CSSF 17/650, 2017 (as amended). Aggravated tax fraud is defined according to the tax thresholds evaded or the level of reimbursement obtained. For tax evasion, increased gravity is related both to the amounts involved and the fact that means have been employed with a view to deceiving the tax authorities. Both offences relate both to direct (e.g. income/inheritance tax) and indirect taxes (VAT). 62 63 FATF and Egmont Group, Report on Concealment of Beneficial Ownership, 2018. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 28 income of the individual or company A by apparently increasing their business expenses paid to Company B. 2. Third-party loan: Once the funds have been pooled into the accounts of Company B, they are returned to the original individual or company A. Fake loan agreements can be produced between the Company B as lender and Company A as borrower. In this way, the money is returned to the beneficial owner in a manner that assisted him in evading income taxation. Luxembourg’s TCSP sector is vulnerable to tax crimes due the international nature of wealth managed and of its operations. In particular, the diverse geographic origin of TCSP clients expose Luxembourg to the risk that foreign individuals may misuse/abuse TCSPs for tax crimes. In contrast, misuse/abuse related to domestic tax crimes is much lower. This is due to Luxembourg’s tax system and small shadow economy (domestic tax evasion is estimated to be lower in Luxembourg than most other OECD countries, ~0.9% of GDP) 64. Luxembourg has put in place a legal and regulatory framework to combat international tax evasion. For example, Luxembourg has introduced legislation to implement the Organisation for Economic Co-operation and Development (OECD) Common Reporting Standard (CRS) for the automatic exchange of financial information. Luxembourg is also actively involved in the OECD Base Erosion and Profit Shifting (BEPS) initiative and has enacted legislation to address BEPS Action 13, on country-by-country reporting. As noted above, the legislator has added in December 2016 aggravated tax fraud (“fraude fiscale aggravée”) and tax evasion (“escroquerie fiscale") to the list of predicate offences for ML, decreasing the likelihood of such crimes by extending AML/CFT measures to these offences (e.g. KYC and Suspicious Activity Reporting (SAR) obligations). Moreover, the CSSF has adopted Circular CSSF 17/650 65, as amended by Circular 20/744, drafted jointly with the Parquet/CRF, which aims at (

i)providing further details by both authorities concerning the practical application of these new provisions by the professionals of the financial sector supervised by the CSSF, and (
ii)providing a list of indicators to assist the professionals. After the law of 21 December 2018 implementing Directive (EU) 2016/1164 (“ATAD 1”), the Luxembourg Parliament adopted on 19 December 2019 the law transposing the Council Directive (EU) 2017/952 of 29 May 2017 (“ATAD 2”). The Chamber of Deputies adopted in March 2020 the law on reportable cross-border arrangements transposing the Directive (EU) 2018/822 and in May 2023 the law introducing obligations on reporting platform operators transposing Directive (EU) 2021/514, commonly known as “DAC6” and “DAC7” respectively. In October 2023 the European Union adopted the Directive introducing tax transparency rules for crypto assets (“DAC8”) which will enter into force on 1 January 2026. According to the 2025 NRA, the level of tax and banking transparency has significantly increased in recent years. Nonetheless, there remains a risk that Luxembourg non-residents continue trying to 64 CESifo Group, Size and Development of Tax Evasion in 38 OECD Countries, 2012. The shadow economy includes “all market-based legal productions of goods and services that are deliberately concealed from public authorities for the following reasons: avoid payment of taxes, avoid payment of social security contributions, avoid certain legal labour market standards and avoid complying with certain administrative procedures” (CESifo, F. Schneider, Estimating the size of the shadow economies, December 2016). 65 Circular CSSF 17/650, February 2017. While aggravated tax evasion was added as a new predicate offence, tax evasion was already criminalised prior to 2017. With the 2017 tax reform the legislation has been strengthened, and both offences are now also a predicate offence for ML. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 29 abuse or misuse Luxembourg Financial Institutions (FIs) and Designated Non-Financial Businesses and Professions (e.g., lawyers and accountants) to avoid paying taxes in their residence country66. Corruption and bribery Corruption and bribery include the relevant offences defined in Luxembourg’s Penal Code, specifically: domestic bribery (private to public) as defined in Articles 240 et seq.; domestic bribery (private to private) as defined in Articles 310 et seq.; and corruption of foreign public officials as defined in Article 252. These crimes have a significant impact on the development and health of economies worldwide 67, undermining the rule of law and the principle of fair competition and often contributing to political instability and abuse of human rights 68. Globally, TCSPs may be exposed to wealthy individuals and Politically Exposed Persons (PEPs). This makes them vulnerable to misuse/abuse for corruption and/or bribery. TCSPs and the structures they set up and manage can be abused or misused by criminals in order to channel funds for bribery and corruption purposes, and to distance themselves from the origin of these funds. Globally, corruption and bribery are estimated to account for 2% of total proceeds of crime 69. According to the 2025 NRA, in Luxembourg, the external threat exposure from corruption and bribery may be impacted by several factors: - Affluent and wealthy bribers or bribed individuals could invest/place proceeds generated from corruption and bribery in Luxembourg or use the generated returns for this type of illicit activities.Considering this, sophisticated sectors collecting and investing funds for wealth and asset management purposes may be targeted by those persons. - Legal and financial professionals (from Luxembourg or abroad) could provide advice, set up holding companies or facilitate the takeover of legitimate companies in Luxembourg for the purpose of laundering the proceeds of corruption. - Luxembourg legal persons could be used as companies for ML of proceeds of corruption in a wider scheme, i.e. complicit (or abused) legal and financial professionals setting up the structure of holding companies. - Considering the limited size of the domestic market, Luxembourg is an internationally oriented economy. Luxembourg businesses could, therefore, be misused to (wittingly or unwittingly) launder proceeds generated from corrupt activities, corruption-related proceeds or act themselves as bribers or bribed persons 70. ML is composed of three stages (as illustrated in the following three tables): 1. Placement: This first stage involves introducing illegally obtained money into the financial system. The objective is to distance the physical funds from their criminal origin, typically by depositing them into financial institutions or using them to acquire assets. 66 2025 NRA. 67 UNODC, Annual report, 2017. 68 Transparency International, Why corruption matters, 2019. 69 UNODC, Annual report, 2017. 70 2025 NRA. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 30 2. Layering: During this stage, the funds are moved through a series of complex financial transactions to disguise their illicit source. This process may include multiple transfers, currency exchanges, or purchases, making the money trail difficult to follow. 3. Integration: In the final phase, the cleaned money is reintroduced into the legitimate economy. At this point, the funds appear to be lawful and can be used without raising suspicion. Table 15: Illustration of ML scheme using TCSPs 71 Table 16: Illustration of placement of illicit funds using a soparfi 72 71 Inspired by case studies presented in FATF, Money Laundering using TCSPs, 2010. Description has been adapted to Luxembourg context. Inspired by case studies presented in FATF, Money Laundering using TCSPs, 2010 and FATF and Egmont Group, Report on Concealment of Beneficial Ownership, 2018. Description has been adapted to Luxembourg context. 72 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 31 Table 17: Illustration of layering of illicit funds using directorship services 73 Table 18: Illustration of integration of illicit funds using third-party loans 74 73 Inspired by case studies presented in FATF, Money Laundering using TCSPs, 2010 and case study presented in van der Does de Willebois et al., The Puppet Master, 2011. Description has been adapted to Luxembourg context. 74 Inspired by case studies presented in FATF, Money Laundering using TCSPs, 2010. Description has been adapted to the Luxembourg context. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 32 5.2.3. TF threats for Specialised PFS Terrorism Financing (“TF”) refers to the financing of terrorist acts and of terrorists and terrorist organisations 75. TF encompasses raising, movement, and use of funds by terrorist actors and is an important threat to global security 76. TF has the following three main stages: 1. Raising funds: This initial phase focuses on acquiring money to finance terrorist operations. The funds may originate from lawful sources, such as donations or legitimate businesses, or from unlawful activities, including various forms of crime (as for money laundering). 2. Moving funds: After the money is obtained, it is moved or transferred in order to hide its origin and ensure it reaches terrorist organisations. This process may utilise banks, money transfer services, or informal financial networks. 3. Using funds: In the final phase, the money is spent to facilitate terrorist acts, which can include buying weapons, covering logistical expenses, or funding other operational requirements. There has been a significant change in how terrorists and terrorist organisations finance their operations. While they initially relied heavily on donations from sympathizers, they now increasingly turn to illegal activities as their primary sources of funding. These activities include extortion, drug trafficking, and kidnapping, which are primary offences of money laundering. TF risk and risk of terrorism are not the same risks, but these can be interlinked. For example, a country having active operating terrorist organisations (thus having a terrorism risk) will probably also face an increased risk of TF. However, it does not mean that a country with no or few terrorist attacks, i.e. low risk of terrorism, does not face a risk of TF. TF has a cross-border nature because funds can be raised in one jurisdiction and used in another jurisdiction 77. Luxembourg is a significant international financial centre and has significant cross-border activities, therefore, Luxembourg may potentially be abused for TF. TF risk is not limited to the risk of financing a terrorist act. Terrorists have additional financing needs such as funds for propaganda, recruitment, training, travel, daily living expenses and other operational needs of an individual terrorist or terrorist group 78. The 2020 NRA concluded that the threats of terrorism and terrorist financing (TF) are moderate overall 79. In May 2022 the Luxembourg Committee on the Prevention of Money Laundering and Terrorist Financing adopted the Vertical Risk Assessment on Terrorist Financing 80 (the “VRA TF”). 75 Luxembourg Criminal Code, Chapitre III-1. - Du terrorisme, Section I. - Des infractions à but terroriste, Article 135-5. FATF, International standards on combating money laundering and the financing of terrorism and proliferation – the FATF recommendations, 2012. 76 77 FATF, Terrorist Financing Risk Assessment Guidance, 2019. 78 Ministry of Justice, National Risk Assessment of Money Laundering and Terrorist Financing, 2020. 79 The 2025 NRA on Money Laundering states that a dedicated risk assessment will cover risks relating to TF. 80 Ministry of Justice, Terrorist Financing – Vertical Risk Assessment, May 2022. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 33 The VRA TF states that “the main TF risks for Luxembourg emanate from the threat that terrorists, terrorist organisations and their financiers might exploit the vulnerabilities of certain sectors essentially for moving funds” and therefore assesses the terrorist financing vulnerable sectors. The VRA TF does not consider the sub-sector of the Specialised PFS providing corporate services as a prima facie vulnerable sector. Also, there are no known cases where Specialised PFS have been abused or misused for the purpose of TF. Indeed in 2022, one SAR was made by a Specialised PFS relating to TF, in 2023 three SARs, and in 2024 two SARs were made. The SARs were all made based on adverse media on the beneficial owners but were not related to transactions performed by the client entities in Luxembourg. The assessment that the threat of TF via TCSPs in Luxembourg is relatively lower than the threat of ML stems from several factors, which include: Short-term requirements to move cash from one party to another (especially uncommon • and unrelated parties). This is less compatible with the TCSP industry where the process of set-up, management and administration of companies typically involves longer time periods. Low value transactions involved in TF are unsuited to an industry which generally deals • with higher value transactions. Preference by terrorists and terrorist organisations for alternative remittance • channels (e.g. Hawala, Hundi, cash couriers), and lack of reliance on formal banking and payment channels that are used by the TCSPs. Knowledge requirements as the products and services offered by TCSPs are often complex • and require financial knowledge. Multiple stakeholders: notaries, lawyers, banks. • Despite the threat being relatively lower than for ML, TF via the TCSP sector cannot be ruled out, particularly those cases involving the abuse or misuse of structures such as corporate and statesponsored terrorism 81. Indeed, the ML/TF Vertical Risk Assessment on Legal Persons and Legal Arrangements (the “VRA LP/LA”) points out that “the corporate sector may be misused for TF purposes, by channelling legitimate funds to support terrorist activities or groups” 82. According to the VRA LP/LA, the relevance of TF to legal persons and legal arrangements consists in following issues: - “Potentially associated with NPOs; - Donations to genuine causes may be diverted to terrorist activities or organisations under the guise of aid payment; - NPOs may be misused to raise funds and to support terrorist activities”. However, there is limited evidence that Specialised PFS providing corporate services are misused for TF purposes, as reflected by the very low number of Terrorist Financing Suspicious Activity Reports and Terrorist Financing Suspicious Transaction Reports submitted to the CRF. For definitions see RUSI, From Lone Actors to Daesh: Rethinking the response to the diverse threats of terrorist financing, 2018. 81 82 Ministry of Justice, ML/TF Vertical Risk Assessment – Legal Persons and Legal Arrangements, 2022. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 34 Moreover, it is important to highlight that only one Specialised PFS providing corporate activities reported having two Luxembourg NPOs as direct clients. These NPOs are linked to the Luxembourg government and invested in Luxembourg and neighbouring countries. As a result, the CSSF considers the risk to be very low 83. 5.2.4. PF threats for Specialised PFS 84 The FATF defines “proliferation of weapons of mass destruction (WMD)” as the transfer and export of nuclear, chemical, or biological weapons, their means of delivery, and related materials. This encompasses the movement and distribution of these weapons and their components, which pose a significant threat to international peace and security 85. The working definition by FATF of proliferation financing (“PF”) is given as “the act of providing funds or financial services which are used, in whole or in part, for the manufacture, acquisition, possession, development, export, trans-shipment, brokering, transport, transfer, stockpiling or use of nuclear, chemical or biological weapons and their means of delivery and related materials (including both technologies and dual use goods used for non-legitimate purposes), in contravention of national laws or, where applicable, international obligations” 86. PF has the following three main stages: 1. Raising funds: the origin of the funds can be from illegal activities (as for money laundering and terrorist financing) or from legal activities (as for terrorist financing). 2. Obscuring funds: integration of funds into the financial system by using opaque and complex ownership structures, intermediaries, false documentation, etc., with the aim to conceal the true purpose and destination of the funds. This is particularly relevant for Specialised PFS performing TCSP activities. 3. Procurement of proliferation sensitive goods, material and technology: using the obscured funds to procure and ship goods, technology, or materials necessary for WMD programmes. This may involve the acquisition of dual-use goods (items that have both civilian and military applications) and the organisation of complex logistics to deliver these materials to their final destination. According to the law of 19 December 2020 regarding restrictive measures in financial matters (“2020 Law”), professionals under the supervision of the CSSF, including Specialised PFS, shall apply the restrictive measures in financial matters to the States, natural and legal persons, entities or groups as appearing on a list annexed to an act of the European Union or of the United Nations or as identified by a Grand-ducal Regulation. These acts include i.a. to comply with the United Nations Security Council Resolutions (“UNSCRs”) relating to the prevention, suppression and disruption of proliferation of WMD and its financing. Designation/listing criteria for UNSCRs are: 83 See appendix C for more information on the thematic review performed in 2025 on Terrorist Financing. See also the CSSF website regarding the fight against proliferation financing: International financial sanctions – CSSF 84 85 FATF, Guidance on counter proliferation financing, 2018. 86 FATF, Combatting proliferation finance: A status report, 2010 (link). ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 35 (
a)persons or entities engaging in or providing support for, including through illicit means, proliferation-sensitive activities and programmes; (
b)acting on behalf of or at the direction of designated persons or entities; (
c)owned or controlled by designated persons or entities; and (
d)persons or entities assisting designated persons or entities in evading sanctions or violating resolution provisions 87. In the context of this chapter, “proliferation financing risk” refers only to the potential breach, nonimplementation or circumvention of relevant restrictive measures in financial matters. Unlike ML and TF threats, PF threats can be posed in/directly by persons and entities designated pursuant to relevant resolutions of the UNSCR or the European Union (e.g. Council regulation (EU) 2018/1542 of 15 October 2018 concerning restrictive measures against the proliferation and use of chemical weapons, as amended) and the international networks they have created to disguise their activities. As a result, the financing needs and methods of designated persons and entities may not necessarily be the same as those of money launderers and terrorists 88. In the context of potential breach, non-implementation or evasion of PF related restrictive measures in financial matters, Specialised PFS should note that the financing can be sourced from both legitimate and illegitimate activities for raising funds or for obtaining foreign exchange and may not necessarily involve laundering of proceeds. Possible examples of exploitation of legitimate activities may include procuring or trading of dual-use goods or goods subject to export control or the trade in natural resources in contravention of relevant UNSCRs. As for illegitimate activities, possible examples may include smuggling of cash, gold, and other high-value goods, cyberattacks, drugs trafficking, export of arms and natural resources such as sand, etc. These activities can occur across multiple jurisdictions. Frequently, designated persons and entities use front and shell companies to conduct such businesses. Doing so is a deliberate strategy to obscure the fact that economic resources, assets, and funds are being ultimately made available to designated persons or entities. The source of proliferation financing risks would depend upon (
i)the risk of a potential breach or non-implementation of financial restrictive measures, and (
ii)the risk of evasion of financial restrictive measures 89. Specialised PFS may, within the framework of their existing restrictive measures in financial matters and/or AML/CFT compliance programmes, identify, assess, monitor, manage and mitigate proliferation financing risks and are not expected to establish duplicative processes for proliferation financing risk assessment or mitigation. The primary driver of these risks for Specialised PFS providing corporate services is that these services are deemed high risk in international guidance given they could be misused to obfuscate links between transactions and designated persons/entities. The United Nations Security Council indicated that designated persons and entities, and those persons and entities acting on their behalf have quickly adapted to financial restrictive measures and developed complex schemes to make it difficult to detect their illicit activities. 87 FATF, Guidance on counter proliferation financing, 2018. 88 FATF, Guidance on proliferation financing risk assessment and mitigation, 2021. 89 FATF, Guidance on proliferation financing risk assessment and mitigation, 2021. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 36 In Luxembourg, the Specialised PFS sector has an overall high inherent risk of breach, nonimplementation or evasion of financial restrictive measures driven by its sector’s large size, services and client types. The large number of smaller players increases the inherent risk. There are, however, no known cases where Specialised PFS have been abused or misused for the purpose of PF. In terms of direct client relationships as at 31 December 2024, 12 Specialised PFS reported having a total of 31 clients dealing in dual-use goods. It can be stressed here, with respect to dual-use goods, that the implementation of restrictive measures on commercial matters relating to these goods, laid down by the European Union, the Office du contrôle des exportations, importations et du transit (OCEIT) in the Ministry of the Economy is the competent authority. It also controls the export, transfer, transit and import of goods of a strictly civil nature, defence-related products and dual use goods, brokering and technical assistance, intangible transfers of technology of these items. While not being a competent authority for restrictive measure on financial matters, it may be necessary in case of questions relating to prohibitions linked to dual-use goods 90. There is only a low distribution risk associated with Specialised PFS. Over recent years, contact with some new clients was established through remote communication channels (telephone, email, online, video conference) which increases the potential risk for ultimate BOs to be hidden. Some Specialised PFS use third parties to enter in contact with potential clients, although KYC is still rarely outsourced other than for Specialised PFS that are part of larger groups (in which case KYC may be done centrally by those groups and regulated under their home jurisdictions, and Luxembourg AML/CFT Law, the CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing (the “CSSF Regulation 12-02”) and the Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the “AML/CFT Grand-ducal Regulation”) require KYC to be in any case reviewed and accepted locally by Luxembourg-based Specialised PFS). Specialised PFS providing corporate services can be exploited by individuals or entities seeking to conceal the origins and destinations of funds, making it difficult to track transactions associated with PF. However, they act as gatekeepers, providing an additional level of on-going monitoring and scrutiny concerning the activities of the companies they administer. This acts as a mitigating factor when it comes to PF threat exposure. 90 Ministry of Economy – Office du contrôle des exportations, importations et du transit (OCEIT) (previously Office des Licences), 19-21 Boulevard Royal L-2449 Luxembourg, email: oceit@eco.etat.lu ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 37 6. Inherent risk – vulnerability assessment Vulnerabilities are the intrinsic properties in a system or structure (including weaknesses in systems, controls, or measures) which make it open to abuse or exploitation by criminals for ML, TF or PF. The existence of vulnerabilities in a system makes the use of that system attractive for money launderers and terrorist financers 91. Indeed, criminals may seek the opportunity to retain control over criminally derived assets while frustrating the ability of law enforcement to trace the origin and ownership of the assets. Companies and often trusts and other similar legal arrangements are seen by criminals as potentially useful vehicles to achieve this outcome. While shell companies 92 which do not have any ongoing business activities or assets, may be used for legitimate purposes such as serving as a transaction vehicle, they may also be used to conceal beneficial ownership, or enhance the perception of legitimacy. Criminals may also seek to misuse shelf companies 93 formed by TCSPs by seeking access to companies that have been ‘sitting on the shelf’ for a long time. This may be in an attempt to create the impression that the company is reputable and trading in the ordinary course because it has been in existence for many years. Shelf companies can also add to the overall complexity of entity structures, further concealing the underlying beneficial ownership information 94. Vulnerability is driven by multiple risk factors which are relevant in the TCSP industry. This section assesses the common vulnerabilities of the Specialised PFS before focusing on the relative exposure of each service relating to a TCSP activity. The vulnerability assessment Country/Geographic risk, considers

(3)four Product, main service risk and factors:

(1)transaction Client risk,

(2)risk, and

(4)Distribution/Delivery channel risk. For each main risk factor there are several underlying key risk factors (red flag indicators). The summary of the vulnerability assessment (cf. Table 19) outlines the three TCSP activity classes and their respective inherent risk. It is important to note that Specialised PFS are authorised to perform one or more of these activities, as per their license. In general, Specialised PFS, when providing TCSP services, provide incorporation services, domiciliation services, directorship services and corporate secretarial services. Table 19: Summary of vulnerability assessment Activity class Inherent Risk (IR) Incorporation of companies High Provision of directorships and corporate secretarial services High Domiciliation of companies High 91 Definition of the FATF, Global Money Laundering & Terrorist Financing threat Assessment, July

92 A shell company is an incorporated company with no independent operations, significant assets, ongoing business activities, or employees. A shelf company is an incorporated company with inactive shareholders, directors, and secretary, which has been left dormant for a longer period even if a customer relationship has already been established. 93 94 FATF, Guidance for a Risk-Based Approach, TCSP sector,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 38 In the context of this sub-sector risk assessment, the vulnerability assessment was conducted at the level of each activity class. Vulnerability arises from TCSP activities offered to clients which may potentially abuse or misuse the TCSPs for ML/TF purposes. The objective of the present sub-sector risk assessment is to determine the level of ML/TF risk to which is exposed each activity class. The vulnerability of the sector or sub-sector is mitigated by factors, which are all the elements in place that contribute to combat ML/TF. This includes all the controls and supervisory measures in place at TCSP level (e.g. supervisory and internal AML/CFT framework) to reduce ML/TF risks. The assessment of mitigating factors is conducted in this sub-sector risk assessment at the level of each taxonomy (activity class). Mitigating factors may be distinguished with the following dimensions:

(1)ML/TF risk appetite, ML/TF risk assessment and risk based approach,

(2)AML/CFT supervision,

(3)ongoing monitoring, and

(4)procedures and trainings. The mitigating factor assessment is used to determine specific actions and recommendations where gaps are identified. For the three activity classes the four main risk factors are common. Moreover, the underlying key factors (red flag indicators) for each main risk factor also remain more or less the same. Consequently, the below assessment covers the three activity classes (specificities in relation to an activity class are highlighted separately, as the case may be). 6.

Client risk The client of TCSPs may be an individual who is a settlor or beneficiary of a trust, or beneficial owner of a company, or other legal entity that is, for example, trying to obscure the real beneficial owner or natural person exercising effective control of the trust, company or other legal entity. The client may also be a representative of a company’s or other legal entity’s senior management who are, for example, trying to obscure the ownership structure
Specialised PFS providing corporate services should consider amongst others the following risk factors 96: • The client is active in a high risk industry (e.g. pharmaceutical, healthcare, emerging technologies, oil and gas, arms, luxury goods, dual-use goods, etc.). • The relationship includes PEPs or persons closely associated with or related to PEPs (e.g. beneficial owner, director). • The services are requested in unusual circumstances (e.g. pressure from client or intermediary, tight deadlines, etc.). • Structure of the relationship makes it difficult to identify the beneficial owner and to understand the ownership structure (e.g. use of shell and/or shelf companies, bearer shares, informal arrangements such as family or close associates acting as nominee shareholders, use of trust structures to obscure ownership, etc.). 95 FATF, Guidance for a Risk-Based Approach, TCSP sector,
96 Non-exhaustive list - risk factors mentioned in FATF, Guidance for a Risk-Based Approach, TCSP sector, 2019 and EBA, Guidelines on customer due diligence and the factors that credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions, as adopted in 2021 by Circular CSSF 21/782 and complementing circulars. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 39 • Nature of the relationship makes it difficult to understand the business of the relationship or of the nature of their transactions (e.g. vehicles splitting company incorporation and asset administration over different countries, all without any apparent legal or legitimate tax, business, economic or other reason, use of trust structures for tax evasion, etc.). • Unusual complexity in control or ownership structures without a clear explanation, with certain transactions, structures, geographical location, international activities or other factors which are not consistent with the Specialised PFS’s understanding of the client’s business or economic purpose behind the client. • Clients reluctant to provide customer due diligence documents. • Inexplicable changes in ownership (e.g. special attention for cases of evasion of financial restrictive measures). • Unusually high levels of assets or unusually large transactions compared to what might reasonably be expected of clients with a similar profile (e.g. clients with low or modest income buying high value assets such as for example luxury cars, etc.). • Payments received from unknown third parties (e.g. payments from an entity which is not a party to the transaction and/or has no relation with the client). • Clients who have funds that are obviously and inexplicably disproportionate given the circumstances (e.g. age, income, occupation or wealth). • Clients who avoid face-to-face meetings. • The legal structure has been altered frequently and/or without adequate explanation (e.g. name changes, transfer of ownership, change of beneficiaries, change of trustee or protector, change of partners, change of directors or officers, etc.). • Choice of Specialised PFS without adequate justification by the client given the size, location or specialisation of the Specialised PFS. • Clients who request that transactions be completed in unusually tight or accelerated timeframes without a reasonable explanation for accelerating the transaction, which would make it difficult or impossible for the Specialised PFS to perform a proper risk assessment or to review the transaction documents. Additional risk indicators in relation to PF 97: • During on-boarding, a customer provides vague or incomplete information about their proposed trading activities. Customer is reluctant to provide additional information about their activities when queried. • During subsequent stages of due diligence, a customer, particularly a trade entity, its owners or senior managers, appear in financial restrictive measures lists or negative news, e.g. past ML schemes, fraud, other criminal activities, or ongoing or past investigations or convictions, including appearing on a list of denied persons for the purposes of export control regimes. • The customer is a person connected with a country of proliferation or diversion concern, e.g. through business or trade relations. • The customer is a person dealing with dual-use goods or goods subject to export control goods or complex equipment for which he/she lacks technical background, or which is incongruent with their stated line of activity. 97 FATF, Guidance on proliferation financing risk assessment and mitigation,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 40 • A customer engages in complex trade deals involving numerous third-party intermediaries in lines of business that do not accord with their stated business profile established at onboarding. • A customer affiliated with a university or research institution is involved in the trading of dual-use goods or goods subject to export control. The findings from the CSSF’s off-site and on-site supervision, combined with the suspicious transaction reports submitted by Specialised PFS to the CRF, demonstrate that the above-mentioned client risk factors are relevant and appropriate and have therefore to be considered by Specialised PFS. As at 31 December 2024, 436 beneficial owners were tax resident in a country that does not comply with international tax transparency standards. Specialised PFS reported in addition, that 3.4% of their clients have PEPs as beneficial owners and/or legal representatives. In total there were 479 beneficial owners classified as PEP. 6.1.
Result of inherent client risk Based on the above, the inherent ML, TF and PF risks of the client factor are assessed to be high. 6.
Country/Geographic risk The provision of services by Specialised PFS may be of higher risk when characteristics of such services are connected to a higher risk country. Therefore, Specialised PFS providing corporate services should consider amongst others the following risk factors 98: • The origin, or current location of the source of funds in the trust, company or other legal entity. • The country of incorporation or establishment of the company or the trusts. • The location of the major operations or assets of the trust, company or other legal entity. • The country in which any of the following is a citizen or tax resident: a settlor, beneficiary, protector or other natural person exercising effective control over the trust or any beneficial owner or natural person exercising effective control over the company or other legal entity. While there is no universally accepted definition of what constitutes a higher risk country or geographic area, Specialised PFS should exercise heightened vigilance and due diligence when dealing with certain regions. They should therefore consider the following factors 99: Non-exhaustive list - risk factors mentioned in FATF, Guidance for a Risk-Based Approach, TCSP sector, 2019 and EBA, Guidelines on customer due diligence and the factors that credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions, as adopted in 2021 by Circular CSSF 21/782 and complementing circulars. 98 99 FATF, Guidance for a Risk-Based Approach, TCSP sector,
ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 41 • Countries/areas identified by credible sources 100 as providing funding or support for terrorist activities or that have designated terrorist organisations operating within them. • Countries identified by credible sources as having significant levels of organised crime, corruption, or other criminal activity, including being a major source or a major transit country for illegal drugs, human trafficking, smuggling and illegal gambling. • Countries subject to sanctions/restrictive measures, embargoes or similar measures issued by international organisations such as the United Nations, European Union, Luxembourg. • Countries identified by credible sources as having weak governance, law enforcement, and regulatory regimes, including countries identified by FATF statements as having weak AML/CFT regimes. • Countries identified by credible sources to be uncooperative in providing beneficial ownership information to competent authorities, a determination of which may be established from reviewing FATF mutual evaluation reports or reports by organisations that also consider various co-operation levels such as the OECD Global Forum reports on compliance with international tax transparency standards. Clients from Specialised PFS reside predominantly within the European Union (around 93%). Less than 1% of the clients reside in a high-risk jurisdiction according to the risk ratings as made by the Specialised PFS
Clients’ BO are predominantly residing outside the European Union (around 64%), of which 4% in high-risk jurisdictions and 0,01% in jurisdictions having active terrorist groups. 36% of the clients’ BO reside within the European Union. The next table indicates that most BOs reside in Anglo-Saxon countries, with the United Kingdom and the United States consistently occupying the top spots in the top 10 countries list over the past four years. These are followed by Luxembourg, Switzerland, Germany, France, Italy, Belgium, Spain, and Jersey. While there have been slight year-to-year fluctuations in the percentages of BOs, which occasionally affect the rankings, the overall distribution has remained largely unchanged. 100 “Credible sources” refers to information that is produced by reputable and universally recognised international organisations and other bodies that make such information publicly and widely available. In addition to the FATF and FATF-style regional bodies, such sources may include, but are not limited to, supra-national or international bodies such as the International Monetary Fund, the World Bank and the Egmont Group of Financial Intelligence Units. 101 CSSF internal data. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 42 Table 20: Top 10 countries of residence of BOs in 2021, 2022, 2023 and 2024 102 2021 2022 2023 2024 United Kingdom (17%) United Kingdom (17%) United Kingdom (18%) United Kingdom (16%) USA (15%) USA (13%) USA (11%) USA (14%) Switzerland (7%) Luxembourg (12%) Switzerland (10%) Luxembourg (7%) Switzerland (8%) Luxembourg (10%) Switzerland (10%) Germany (6%) Germany (6%) Germany (6%) France (5%) France (5%) France (6%) France (5%) Luxembourg (5%) Italy (3%) Italy (3%) Italy (4%) Italy (4%) Belgium (3%) Belgium (3%) Jersey (3%) Jersey (3%) Spain (2%) Spain (2%) Belgium (3%) Belgium (2%) Jersey (2%) Jersey (2%) Spain 2%) Spain (2%) Germany (7%) Country risk should also be considered regarding the country of residence of the business providers. In this context, it can be noted that in 2024 a vast majority of the business providers were established in Luxembourg followed by far by the USA, Germany, United Kingdom and Switzerland. Table 21: Top 5 countries of residence/establishment of business providers 2024 103 Country Percentage of business providers Luxembourg 66% USA 8% Germany 5% United Kingdom 5% Switzerland 4% Exposure to an international clientele remains a significant vulnerability to ML 104 and TF. However, it is to be noted that Specialised PFS exposure to jurisdictions linked to TF is low
According to the annual AML/CFT questionnaires of the past years, no Specialised PFS had or has a client or a beneficial owner resident in DPRK or Iran. 102 Data on BOs as per Article 1

(7)(a)(i) of the AML/CFT Law (senior managing officials are excluded). 103 CSSF internal data. 104 2025 NRA. 105 Based on CSSF internal data. ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 43 6.2.

Result of inherent country/geographic risk Based on the above, the ML inherent risk of the country/geographic factor is considered to be medium, while the inherent TF and PF risks are low. 6.
Product, service and transaction risk Specialised PFS providing corporate services should consider the following risk factors associated with their products, services or transactions 106: • Level of transparency, or opaqueness of the product, service or transaction. • Complexity of the product, service or transaction. • Value or size of the product, service or transaction. • How complex is the transaction, and does it involve multiple parties or multiple jurisdictions? Are transactions straightforward? • To what extent do products or services allow payments from third parties or accept overpayments where this would not normally be expected? Where third-party payments are expected, does the Specialised PFS know the third-party’s identity? Or are products and services funded exclusively by fund transfers from the customer’s own account at another financial institution that is subject to AML/CFT standards and oversight that are comparable to those required in Luxembourg? • Does the Specialised PFS understand the risks associated with new or innovative products or services, in particular where these involve the use of new technologies? • Use of virtual assets and other anonymous means of payment and wealth transfer within the transaction without apparent legal, tax, business, economic or other legitimate reason. • Transactions using unusual means of payment. • The postponement of a payment for an asset or service delivered immediately to a date far from the moment at which payment would normally be expected to occur, without appropriate assurances that the payment will be made. • Successive capital or other contributions in a short period of time to the same company with no apparent legal, tax, business, economic or other legitimate reason. • Acquisitions of businesses in liquidation with no apparent legal, tax, business, economic or other legitimate reason. • Repayment of debts during bankruptcy proceedings using forged documents, which may indicate an attempt to conceal illicit funds or manipulate the insolvency process. • Transactions involve possible companies with opaque ownership structures, front companies, or shell companies, e.g. companies do not have a high level of capitalisation or display other shell company indicators. • Companies remaining dormant for long periods of followed by a surge of activity. • Companies conducting financial transactions in a circuitous manner. Non-exhaustive list - risk factors mentioned in EBA, Guidelines on customer due diligence and the factors that credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions under Articles 17 and 18

(4)of Directive (EU) 2015/849, as adopted in 2021 by Circular CSSF 21/782 and complementing circulars, FATF, Guidance for a Risk-Based Approach, TCSP sector, 2019, and FATF, Guidance on proliferation financing risk assessment and mitigation, 2021. 106 ML/TF SUB-SECTOR RISK ASSESSMENT January 2026 44 • Transactions where the originator or beneficiary of associated financial institutions is domiciled in a country with weak implementation of relevant UNSCR obligations and FATF Standards or a weak export control regime. Maritime risk indicators: • A trade entity is registered at an address that is likely to be a mass registration address, e.g. high-density residential buildings, post-box addresses, commercial buildings or industrial complexes, especially when there is no reference to a specific unit. • The destination of a shipment is different from the importer’s location. • Inconsistencies are identified across contracts, invoices, or other trade documents, e.g. contradictions between the name of the exporting entity and the name of the recipient of the payment; differing prices on invoices and underlying contracts; or discrepancies between the quantity, quality, volume, or value of the actual commodities and their descriptions. • Shipment of goods have a low declared value vis-à-vis the shipping co

🔗 Vers la source officielle

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.