Looking back on the 2024 CSSF AML/CFT Conference for Specialised PFS

(2)of the CSSF Regulation N° 12-02)  Screen daily or at least at publication of TFS lists (Articles 33

(1)and 39

(1)of the CSSF Regulation N° 12-02) Ensure Out Best practices  Apply 4-eyes principle on encoding in database and treatment of hits (false and true)  Formalise/document analysis (Article 39

(3)of the CSSF Regulation N° 12-02)  Perform regular controls on the correct functioning of the screening tool  In case of outsourcing: include treatment of false hits in oversight !! Name screening is an obligation of results not an obligation of means 7 Transaction monitoring Insufficient understanding Insufficient awareness Insufficient formalisation  Absence of transaction monitoring  No clear understanding of the purpose and rationale of transactions performed by clients (e.g. intragroup loans, fake consultancy agreements)  Insufficient special attention to complex and unusually large transactions as required by Article 3

(7)of the AML/CFT Law and Article 32 of the CSSF Regulation N° 12-02  Staff not performing coherence checks or recognising red flags  Absence of 4-eyes principle  Absence or insufficient formalisation/documentation of analysis 8 Transaction monitoring Best practices  Perform transaction monitoring (Articles 3

(2)(d) of the AML/CFT Law) Coherence control Transaction monitoring Tailormade training 4-eyes control  Develop critical thinking and perform coherence controls  Provide AML/CFT training to the staff and Management tailored to activities, typologies, raise awareness, red flags, case studies (Article 4

(2)of the AML/CFT Law and Article 46 of the CSSF Regulation N° 12-02)  Apply 4-eyes principle on transaction monitoring Document analysis  Formalise/document analysis (Article 39

(3)of the CSSF Regulation N° 12-02) !! Transaction monitoring properly trained fails if staff is not 9 Client risk assessment Inadequate risk scoring Insufficient formalisation  Not all risk factors mentioned in Article 3

(2a)of the AML/CFT Law are covered (customers, geography, products, services, transactions, delivery channel)  Wrong risk classification of clients leading to inadequate due diligence measures and a wrong file review frequency  Absence analysis or insufficient formalisation of 10 Client risk assessment Best practices  Consider at least all risk factors provided by the AML/CFT Law; type of customer, countries and geographical areas, products, services, transactions and delivery channels  Ensure risk rating is appropriate Risk factors Document analysis Adequate risk rating  Ensure due diligence measures and file review frequency are in line with client risk rating  Focus resources to High Risk clients  Formalise/document the analysis !! CSSF Circular 21/782 Adoption of the revised guidelines, by EBA, on money laundering and terrorist financing risk factors provides useful information and explanations on risk factors 11 RC report  No or insufficient description of RC’s activities and operations as required by Article 42

(6)CSSF Regulations N° 12-02: Insufficient detailed  Missing information     controls performed by the RC results of controls and findings proposed corrective measures follow-up on previous years’ findings content of AML/CFT trainings provided Reminder roles RR & RC RR: sets out the AML/CFT framework of the entity (e.g. defines the risk appetite, sets the AML/CFT policies, …), supervises the activities performed by the RC and reviews the reportings prepared by the RC. RC: implementation of AML/CFT framework and application by entity (e.g. implementation of procedures, carrying out controls, ...). 12 RC report Best practices The RC report describes the work performed by the RC and his/her recommendations (Article 42

(5)of the CSSF Regulation N° 12-02):  the controls performed  the results of the controls  proposal of corrective measures  status and follow up on findings identified in Controls Results Proposals Corrective measures Status Follow up   Follow up   !! previous report(s): open and closed. If not closed, reason to be provided statistical data on cooperation with authorities AML/CFT trainings provided (content) amended and newly adopted procedures etc. EBA guidelines on the role and responsibility of the AML/CFT Compliance Officer point 50 provides useful information on content of RC report 13 Best practices in relation to cooperation with the authorities 1) Financial Intelligence Unit 2) Ministry of Finance Legal references Article 5

(1)of the 2004 Law Article 8 of the Grand-ducal Regulation of 1 February 2010 Chapter 6 of the CSSF Regulation 12-02 especially Article 48

(1)and

(2)Article 5 of the Law of 20 July 2022 (adding sanction avoidance as predicate offense in Luxembourg) Article 6 of the Law of 19 December 2020 Articles 33 and 39 of the CSSF Regulation 12-02 Suspicious Activity Reports (« SAR ») Suspicious Transaction Reports (« STR ») Cooperation with the Financial Intelligence Unit (« FIU ») Mutual Evaluation Report of FATF - September 2023 - Key findings - Immediate outcome 4 (page 135) “Compliance with reporting obligations is divergent. There are low number of reports filed by most DNFBPs, and a large proportion of reports are driven by adverse media hits which not all FIs, DNFBPs and VASPs properly analyse to establish if there are grounds for suspicion before filing the report.” DNFBPs include TCSPs TCSPs include Corporate domiciliation agent and/or Professionals providing company incorporation and management services. Slight decrease of the number of PFS-SP who did not report to the FIU during the year on the period from 2017 to 2022 (source: Questionnaire on Financial Crime) 70% 60% 50% 40% 30% 20% 10% 0% 2017 2018 2019 2020 2021 2022 CSSF core messages: Messages: Do not hesitate to file a report to the FIU. Do not file reports for the sake of filing, the reports have to be meaningful and of use to the FIU. When you decide not to file a SAR/STR - Your legal obligations: Do it in writing Do not forget to analyse and conclude Legal references: Article 48

(2)of CSSF Regulation 12-02 “The analysis and the resulting decision shall be retained in writing and made available to the competent authorities.” When you decide not to file a SAR/STR - best practices: Use a Memo or Note Keep it in your files Explain the reason(s) for not filing a report and document if possible Beware of clients’ testimomies The fact that a client is under investigation but that no information on a conviction is found is NOT a valid reason to delay the report. Adverse media – An example Protector Settlor Trustee Trust Investor: Company (Bahamas) EUR 3 M invested Lux Fund Sources: BBC, CNBC, Wall Street Journal, Reuters, Al-Jazeera Beneficiaries Information held on file/red flags reported: Adverse media relating to the settlor, the protector and companies that they control. SoW originally coming from the above-mentioned companies SoW changed during the course of the business relationship Change of bank accounts (3 times) in 4 years, the latest account being open in the name of a 3rd party being a bank in the Middle East on which adverse media was found. No answers to the PFS’s queries Multiple offshore jurisdictions used with no clear purpose Dealing with adverse media Good practices: Is the source of information reputable? Is there a link with my investor/client? Review the past transactions and the KYC documents looking for red flags in light of the information found? Any other red flags? Strawman and sanction evasion – Another example Client is a Luxembourg company held by a Russian woman initially living in Russia (« UBO ») At the time of the acquisition of the client company

(2007), the UBO was 26 years old She acquired the shares for EUR 8,700,000 through a company in Cyprus held by a company in BVI The acquisition was financed by a loan taken by the BVI Company guaranteed personnally by the UBO Source of wealth (not corroborated): revenue (assistant judge at the Supreme Arbitration Court of the Russian Federation (!!!)), ownership of licensed softwares in Russia (!!!) The client company owns real estate in the South of France The Russian woman moved from Russia to France in 2022 Information held on file/red flags: Important amount invested vs young age of the UBO Occupation of the UBO surprising and not corrobated Russia raising concerns of corruption and sanctions Use of Cyprus (remember Cyprus confidential) Loan with a BVI company French Riviera is a known place where sanctionned russians own properties 2022: year of the conflict between Russia and Ukraine Quality of the reports to the FIU The report to the FIU did not mention: - the acquisition of the client company by a young UBO - the use of a complex structure with several jurisdictions (Luxembourg/Cyprus/BVI/Russia) - The way the acquisition was financed Other examples include incorrect services reported, incorrect names (beware of similar client names in a structure chart), etc. Filing a SAR/STR – Your obligations Train the 1st line of defense/business lines to identify red flags and report them internally Be careful with the quality of your reports to the FIU Article 46

(2)of the CSSF Regulation 12-02 “The training and awareness-raising programme of the personnel shall include (…) for all the employees, the regular participation to internal or external continuing education which is addressed, in particular, to the members of the personnel in direct contact with customers in order to help them identify unusual transactions and recognise money laundering or terrorist financing attempts. This continuing education shall also concern the professional's internal procedures to be followed by the employees in case they suspect or have reasonable grounds to suspect money laundering, an associated predicate offence or terrorist financing” Article 5

(1)a) of the AML Law “This report must be accompanied by all supporting information and documents having prompted the report.” Targeted Financial Sanctions (TFS) Cooperation with the Ministry of Finance (MoF) Delay to report to the MoF – An example Sanctioned individual Swiss bank acting as nominee/intermediary Lux bank acting as nominee/intermediary Specialised PFS acting as RC and transfer agent for a Lux fund (Lux) Communication of a sanctioned investor between professionals must be done swiftly to enable each professional to report without delay. Publication on the sanction list Day 1 Specialised PFS Day 197 Swiss bank Day 6 MoF TOTAL= over 6 months Lux bank Day 13 (existence) Day 145 (name) Conclusions Communication to the MoF should be done without delay even if the name of the sanctioned person is unknown There is no professional secrecy between professionals Legal references: Article 41

(2)of the Law of 5 April 1993 on the financial sector, as amended “The obligation to maintain secrecy shall not exist where disclosure of information is authorised or required by or pursuant to any legislative provision, even where the provision in question predates this Law.” How to improve communication - Request immediate information from intermediaries/nominees and test it by requesting information regularly (use a risk based approach) - Check escalation processes between 1st line and 2nd line of defense - Update Internal reports (example: blocked clients/investors) - Write down what to do in your procedures in case of sanctionned clients/investors - Train the 1st line of defense to know what to do in this case and to understand the urgency of this matter FATF President's remarks to G20 Anti-Corruption Ministerial -22 October 2020 “The gatekeepers to the financial system – such as lawyers, accountants and company service providers – need to be inside the regulatory tent so law enforcement agencies have relevant information to build cases.” Results of FATF’s Mutual Evaluation 2023 2024 AML/CFT Conference - Specialised PFS 22 January 2024 Mr. Jérémie Ogé – Deputy Director Direction LBC/FT Agenda Introduction II. Summary of the report I.

1. Technical compliance ratings
2. Effectiveness ratings
3. Positive points
4. Areas for improvement III. Specialised PFS
5. Understanding of risks and obligations
6. Risk mitigating measures
7. CDD, record-keeping, EDD
8. Targeted financial sanctions
9. Reporting obligations to the FIU IV. Recommendations V. Implementation and next steps 36 I. Introduction 37 Introduction (1/2)  FATF mutual evaluations have two components: • Technical compliance : ‒ 40 recommendations ‒ Technical annex to the report • Effectiveness: ‒ Are the AML/CFT systems are operational and producing positive effects? ‒ Eleven objectives (Immediate Outcomes) ‒ Core of the report 38 Introduction (2/2) 4th assessment round of Luxembourg by the FATF • Process ran from 2019 to 2023 • Process lengthened due to the COVID-19 pandemic • On-site visit took in November 2022  Period assessed: 1 January 2017 to November 2022  Five assessors  Report discussed and adopted by the Plenary meeting in June 2023  Publication of the MER: 28 September 2023  39 II. Summary of the report 40 Summary of the report (1/6)
10. Technical compliance ratings R1 ASSESSING RISKS AND APPLYING A RISK-BASED APPROACH R2 NATIONAL COOPERATION AND COORDINATION R3 MONEY LAUNDERING OFFENCE R4 CONFISCATION AND PROVISIONAL MEASURES R11 RECORD KEEPING R12 POLITICALLY EXPOSED PERSONS (PEPS) R13 CORRESPON DENT BANKING R14 MONEY OR VALUE TRANSFER SERVICES (MVTS) R15 NEW TECHNOLOGIES R25 TRANSPARENC Y AND BENEFICIAL OWNERSHIP OF LEGAL ARRANGEMENT S R26 REGULATION & SUPERVISION OF FINANCIAL INSTITUTIONS R35 SANCTIONS R36 INTERNATIONAL INSTRUMENTS R21 TIPPING-OFF & CONFIDENTIALI TY R22 CUSTOMER DUE DILIGENCE (DNFBPs) R23 OTHER MEASURES (DNFBPs) R24 TRANSPARENC Y AND BENEFICIAL OWNERSHIP OF LEGAL PERSONS R31 POWERS OF LAW ENFORCEMENT AND INVESTIGATIVE AUTHORITIES R32 CASH COURIERS R33 STATISTICS R34 GUIDANCE AND FEEDBACK R5 TERRORIST FINANCING OFFENCE R6 TFS RELATED TO TERRORISM & TF R16 WIRE TRANSFERS R7 TFS RELATED TO PROLIFERATIO N R8 NON-PROFIT ORGANISATIO NS (NPOS) R17 RELIANCE ON THIRD PARTIES R18 INTERNAL CONTROLS & FOREIGN BRANCHES & SUBSIDIARIES R9 FINANCIAL INSTITUTION SECRECY LAWS R10 CUSTOMER DUE DILIGENCE (CDD) R19 HIGHER RISK COUNTRIES R20 REPORTING OF SUSPICIOUS TRANSACTIONS Compliant Largely compliant Partially compliant R27 POWERS OF SUPERVISORS R28 REGULATION AND SUPERVISION OF DNFBPs R29 FINANCIAL INTELLIGENC E UNITS (FIU) R30 RESPONSIBILITIE S OF LAW ENFORCEMENT AND INVESTIGATIVE AUTHORITIES R37 MUTUAL LEGAL ASSISTANCE (MLA) R38 MLA: FREEZING & CONFISCATIO N R39 EXTRADITION R40 OTHER FORMS OF INTERNATIONAL CO-OPERATION Non-compliant Not-applicable 41 Summary of the report (2/6)
11. Effectiveness ratings Immediate Outcomes MER Ratings 1 Risk, Policy and Co-ordination Substantial 2 International Co-operation Substantial 3 Supervision Moderate 4 Preventive Measures Moderate 5 Legal Persons and Arrangements Substantial 6 Financial Intelligence ML/TF Substantial 7 ML Investigation and Prosecution Moderate 8 Confiscation Moderate 9 TF Investigation and Prosecution Substantial 10 TF Preventive Measures and Financial Sanctions Moderate 11 PF Financial Sanctions Moderate 42 Summary of the report (3/6)
12. Positive points  Good understanding of the ML risks  Good national cooperation and coordination mechanisms  Key role played by the Financial Intelligence Unit (FIU) in producing and disseminating financial intelligence 43 Summary of the report (4/6)
13. Positive points  Proactivity in TF investigations and excellent international cooperation with counterpart authorities in neighboring countries  Strong understanding of ML risks by financial institutions, good knowledge of their obligations and implementation of appropriate mitigation measures  Recognition of the efforts made by Luxembourg in terms of transparency of legal persons and legal arrangements 44 Summary of the report (5/6)
14. Areas for improvement  Better communicate TF risk stemming from Luxembourg’s status as an international financial centre  Lack of a risk-based approach at the level of the NPO supervisor and poor understanding of TF risk by the sector  Concerns about the quantity of human resources from different authorities including the FIU, investigative and judicial authorities and DNFBP supervisors 45 Summary of the report (6/6)
15. Areas for improvement  Improve understanding and application of AML/CFT and TFS obligations by the private sector (especially non-financial sector)  Provide the FIU with STRs containing a certain level of analysis (not just adverse media reports)  Some of the penalties and remedial measures imposed are inadequate or insufficient, particularly those imposed by DNFBP supervisors and with regard to publication requirements in the RBE. 46 III. Specialised PFS 47
16. Understanding of ML/FT risks and AML/CFT obligations      FIs = good understanding ML risks but TF risks varied. FIs = various risk assessments (SSRA, NRA and VRA) : useful guides for developing their own risk assessments. FIs = reduced their appetite for risk following Panama Papers, increased regulatory requirements and inclusion of tax offences as primary ML offences. FIs = refusing potential customers if not necessary comfort on customer's tax compliance, origin of funds and wealth, inconsistencies on BOs. Specialised PFS = well attuned to ML risk posed by investors and how risk arise through schemes’ promoters and from the underlying investments. 48
17. Understanding of ML/FT risks and AML/CFT obligations  Main negative point = understanding of TF risks in relation to TF levels stemming from international organisations using Luxembourg’s IFC status.  A more in-depth TF risk understanding by FIs is beginning to develop following the publication of the 2022 TF VRA (in May 2022). However, it does not give the necessary details to obliged entities to understand the TF typologies and methods within their business activities, services and products.  Understanding of AML/CFT obligations is strong for FIs. 49
18. Risk mitigation measures  A vast majority of FIs = apply appropriate mitigating measures to manage ML/TF risks and have measures commensurate with their risks.  Specialised PFS = scrutinise investment fund transactions. Control includes understanding the tax implications, screening the buyer and seller and considering whether the asset value reflects the market. 50
19. CDD, record-keeping and EDD Effective CDD and record-keeping measures in place. Where gaps = mostly minor and non-systemic.  FIs = effective processes in place for onboarding customers and conducting CDD.  Small proportion of specialised PFS rely on third parties who do the CDD to introduce new customers. Apply appropriate oversight and monitoring which includes a review of the third party’s procedures and spot-checks to ensure that the third party applies appropriate controls.  EDD = no shortcomings (PEPs, correspondent services, New technologies, Higher-risk countries).  51
20. TF-targeted financial sanctions  FIs = aware of the obligation to freeze without delay. Many use automated tools to screen UN sanctions regimes.  Screening enables the identification of sanctioned individuals within 24 hours of designation. In the event of a "hit", a declaration is made to the Ministry of Finance.  However, some players did not know to which authority these reports should be addressed. 52
21. Reporting obligations to the FIU 99% of STRs = banks + EMIs. FIs = good understanding of their STR obligations.  Large proportion of STRs = driven by adverse media hits. Not all professionals conduct proper analyse to establish if there are grounds for suspicion before filing the STR.  Quality and relevancy of TF-related reports submitted = a concern. Low level of TF reporting. Not clear whether there are reports that include the aspect of financing or if they are all related to terrorism itself: need for the private sector to further develop its TF risk understanding.  Increase in STRs in 2017 following the introduction of tax offences as ML's primary offence.  53 IV. Recommendations 54 Recommendations (1/2)  Improve understanding of foreign TF risk, methods and exposure, arising from Luxembourg's exposure as an international financial centre with significant crossborder activities and the fact that terrorist funds may be utilized, parked or in transit.  Set up in-house training courses and take advantage of training courses where authorities are invited, and communicate on the types and risks associated with TF. 55 Recommendations (2/2)  Register with the FIU in GoAML ( www.justice.public.lu > Organisation de la Justice > CRF > Inscription d’un nouveau déclarant).  Improve the quality of STRs (analyse and report suspicious activities and transactions). Better analysis of adverse media reports with corroborating indicators. 56 V. Implementation and next steps 57 Implementation and next steps After the adoption of the mutual evaluation report, assessed countries enter the follow-up process.  Given Luxembourg's good results, the country has been placed under regular follow-up (default follow-up mechanism).  Luxembourg will have to send the FATF a progress report three years after the adoption of the mutual evaluation report.  Luxembourg is continuing its process of constant improvement of its AML/CFT system by responding to the MER recommended actions.  The 5th round of mutual evaluations begins in
22.  58 Thank you for your attention! 59 INSIGHTS FROM THE FIU LUXEMBOURG FOR SPECIALIZED PROFESSIONALS OF THE FINANCIAL SECTOR 2024 AML/CFT Conference dedicated to Specialised Professionals of the Financial Sector 22 January 2024 About Us AGENDA CRF - FIU Luxembourg in a nutshell Key figures 2023 General overview Fight against ML / TF – Trends observed The important role of FIUs Focus on specialised PFSs Key figures 2023 & importance of an appropriate risk assessment Best practices guide Reporting suspicious activity and / or transactions to the CRF - FIU Q&A CRF - FIU LUXEMBOURG IN A NUTSHELL FIU Luxembourg In a Nutshell Judicial FIU Total number of employees: 43 Multidisciplinary team Operationally independent and autonomous Under the administrative supervision of the General prosecutor A team of magistrates, IT and data scientists, administrative officers, as well as operational and strategic analysts specialised in a variety of areas, including terrorist financing, tax offenses, virtual assets and cybercrime, the investment fund industry, corruption, corporate structuring and complex money laundering schemes. FATF MER LUXEMBOURG SEPT 2023 Luxembourg has a solid anti-money laundering and counter-terrorist financing (AML/CFT) framework and a good understanding of its money laundering and terrorist financing risks. Introducing FIU Luxembourg FIU FIU International cooperation FIU to FIU FIU CRF National cooperation Judicial authorities SRE Supervisory authority Self-regulatory bodies Tax authorities Other authorities Total number of reports filed 2010 - 2023 60000 55948 52374 50000 50197 53259 44628 40000 40782 38744 30710 30000 20000 10000 8306 11138 4866 11023 4492 6866 0 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 Evolution of traditional reports filed 2017 - 2023 SAR / STR TFAR / TFTR 600 14000 12479 12000 10871 10000 8000 4000 2000 4897 5098 400 483 444 454 373 321 300 7501 6000 500 6215 220 200 3197 225 100 0 0 2017 2018 2019 2020 2021 2022 2023 2017 2018 2019 2020 2021 2022 2023 Evolution of requests for information sent to the sector 2020-2023 3000 2417 2500 2148 2000 1831 1800 1500 1000 500 0 2020 2021 2022 2023 FIU Luxembourg In addition  cross-border reporting via FIU.net Key figures 2023 44 628 > 10 500 2 765 762 ~ EUR 850 mio Reports filed Registered professionals in Disseminations by CRF Disseminations received Currently frozen goAML 100% Digital and paperless Top 5 predicate offenses • Fraud • Criminal tax offenses • Counterfeiting & product piracy • Money laundering from foreign FIUs Top 5 Top 5 International cooperation – International cooperation – outgoing incoming 331 Financial analysis reports transmitted to the judicial authorities and other national AML/CFT competent authorities. THE FIGHT AGAINST ML/TF TRENDS OBSERVED THE IMPORTANT ROLE OF FIUS CHALLENGES IN IDENTIFYING THE CRIMINALS Catch Me Identifying the criminals If You Can Challenges • • • The techniques and tools used by the criminals advance quickly, as they take advantage of technological and geopolitical developments. • Crime as a service Asset recovery remains one of the most powerful tools to fight back. • Impact of digitalisation However - the amount of captured proceeds still remains too low - below 2% of the yearly estimated proceeds of organised crime. • Instant payments Source: EUROPOL’s latest trend report “The other side of the coin: an analysis of financial and economic crime in the EU” • Professional money launderers • Cross border crime • Cyber enabled crime • Anonymity • Untraceability • Use of advanced technologies • Use of alternative financial channels The important role of FIUs in detecting ML schemes and recovering assets. +/- 50,000 CRF FIUs play a crucial role in receiving relevant information from reporting entities In many cases, FIU intelligence is the starting point of law enforcement investigations If the FIU is unable to identify the most significant cases, there is a risk that these will never be prosecuted. Connecting the dots  Analysis based on ML/TF indicators and patterns  The information included in a report often does not contain sufficient elements to justify police / judicial investigations  The combination of different sources of information allows the identification of specific targets. Collection of data from national reporting entities The combination of different sources of information allows the identification of specific targets, large ML schemes and to render the case actionable and “fit for prosecution”. High quality cooperation is key. NRIs Suspicion of fin. crime related activites - Description of activities and reporting of KYC data Involved persons, involved entities, involved accounts, Addresses, Phone Number, Email, IP Login Data, etc. Reporting FIU Luxembour g Analysis of report - Analysis of transactions Verification of links Gathering of available and obtainable information and data Determination of additional information and data needed Entity STR/SA R FI: Financial institution SAR: Suspicious Activity Reports STR: Suspicious Transaction Reports NRI: National Request for Information Collection of additional information - New transactions are integrated New KYC data enables further NRIs FIs and any other relevant professional subject to the 2004 Law Collection of data from national reporting entities High quality cooperation is key. Information found on one account may not give full picture. Combining multiple accounts and the associated red flags may lead to stronger suspicion, further links, more intelligence for prosecution or foreign FIU. Auditor / accountant Bank Specialised PFS € € € SAR 1 SAR 2 KYC and CDD documentation • Source of wealth (not complete view) • KYT information • KYT information – identification of links to further involved persons • Loan agreements & consultancy agreements • SAR 3 • • Onboarding and KYC documentation Source of wealth (not complete view) CRF - FIU LUXEMBOURG KEY FIGURES 2023 FOCUS ON SPECIALISED PFS Disclaimer Beware of the statistics in this presentation! A reporting entity can play different roles,  Registrar agent  Corporate domiciliation agent  Family Office  Professional providing company incorporation and management services However, goAML does not allow to specify multiple roles. Therefore, statistics may give an incomplete picture of the level of cooperation with a specific sector. Number of reports filed by specialised PFSs compared to the total number of reports filed 2017-2023 Total specialised PSFs 156 44628 2023 2022 215 40782 218 52374 2019 230 55948 2018 2017 168 50197 2021 2020 150 53259 38744 171 Total number of reports filed by specialised PFSs Breakdown 2023 Specialised PFS 2017 2018 2019 2020 2021 2022 2023 Total Article 28-
23. PFS / PFS / Corporate domiciliation agents 134 157 171 170 121 113 113 979 Article 28-
24. PFS / PFS / Debt recovery 4 0 0 20 15 1 2 42 Article 28-
25. PFS / PFS / Professionals performing lending operations 2 2 2 2 1 0 2 11 Article 28-
26. PFS / PFS / Professionals providing company incorporation and management services 2 6 3 3 10 8 4 36 Article
27. PFS / PFS / Registrar agents 29 48 36 15 18 22 20 188 Article 28-
28. PFS / PFS / Family offices 0 17 5 3 0 1 1 27 Article
29. PFS / PFS / Operators of a regulated market authorised in Luxembourg 0 0 1 1 1 4 10 17 Article 26.-
30. PFS / PFS / Professional depositaries of assets other than financial instruments 0 0 0 1 1 0 1 3 Article
31. PFS / PFS / Professional depositaries of financial instruments 0 0 0 0 1 1 3 5 Total 171 230 218 215 168 150 156 1308 Focus on the number of TCSP related SARs/STRs filed by specialised PFS 2023 PFS/ Corporate domiciliation agents 2023 113 2022 113 2021 PFS/ Professionals providing company incorporation and management services 2023 2022 2021 2020 121 2020 170 0 50 100 150 200 4 8 10 3 0 PFS/ Family Offices 2023 1 2022 1 2021 0 2020 3 0 0,5 1 1,5 2 2,5 3 3,5 2 4 6 8 10 12 Suspicious transactions reports filed by specialised PFSs Top 5 predicate offenses Statistics 2023 Sanction evasion 2% 0% 0% 0% 0% 0% 0% 10% % 1% 1% 1% 1% 2% 2% Active corruption 7% Others 45% Fraud 7% Criminal tax offences 12% Money laundering 13% Suspicious transactions reports filed by specialised PFSs Top 5 Indicators Statistics 2023 1 Open source indications and information and sanctions lists hits 2 Reluctance to provide KYC / KYT documentation 3 Unusual behavior of the customer / Beneficial ownership issues 4 Offshore based companies / Inconsistencies regarding the economic origin of funds 5 Suspicious transaction pattern THE FIGHT AGAINST MONEY LAUNDERING AND TERRORIST FINANCING IMPORTANCE OF AN ACCURATE RISK ASSESSMENT Detection in the fight against money laundering and terrorist financing Focus on the risk assessment – exposition Art 2-2 2004 AML/CFT Law Specialised PFSs shall ensure to adopt appropriate measures to identify, assess and understand the ML/TF risks to which they are exposed (risk factors related to their clients, countries or geographical areas, products, services, transactions or distribution channels, etc.). Professionals shall ensure to take into account national and supranational risk assessment or risk factors communicated by supervisory authorities, self-regulatory bodies or European supervisory authorities. Factors to consider (non-exhaustive list): Customer and structure of the group The planned transaction Financial flows and source of funds Géographical factors Detection in the fight against money laundering and terrorist financing Focus on the risk assessment – when? Art 2-2 2004 AML/CFT Law Involvement in numerous legal and commercial acts with a wide variety of national and international clients and companies. Real estate transactions Incorporation of a company d’une entité juridique Merger & Acquisition Loans & debt transactions Capital increase Detection in the fight against money laundering and terrorist financing Focus on customer due diligence Art 2-2 2004 AML/CFT Law Customer due diligence / beneficial ownership verifications, source of funds verifications and legitimacy of the transaction verifications should be carried out independently and should not rely on information provided by other professionals. Statements & explanations given by the client Database & list screening Watch out for “easy” documents Loan agreement CONSISTENCY Open source checks Shareholder agreement Supporting documents Screening & monitoring tools Consultancy agreement THE FIGHT AGAINST MONEY LAUNDERING AND TERRORIST FINANCING BEST PRACTICES GUIDE Best practices guidance Challenge: DATA QUALIY Importance of filing data in a structured way. Please file all suspects, natural / legal persons / bank accounts / etc. mentioned in the « reason for suspicion » free text field Clearly stating the suspicion – explaining the link to ML/TF – choosing the appropriate indicators in goAML Try to be as complete as possible. E.g.: Negative public information is available about XYZ. => by itself, not actionable for CRF Add information about the business relationship with your client XYZ, possible additional information (is there a link between the publication and the client?), suspicious transactions, banking relationships in Luxembourg and abroad, etc. Link with Luxembourg if applicable Explanation of the relationship Explanatory memo (suspicious activity or transaction) Tax memo if applicable Explanation Supporting doc Structure chart (+ UBO) Data Agreements, invoices and any other supporting documents Known banking relationships (domestic and international) Focus on adverse media hits Adverse media : In general, just because a person / entity / group is negatively known is not in itself a suspicion of ML/TF. Such a hit should trigger a careful review of all the circumstances and factors of the business relationship, including but not limited to the origin of wealth, respectively funds, entourage, etc. However: Example 1: SAR/STR linked to adverse media on corruption - with info on assets directly linked to predicate offence or - with info on assets deriving from an apparently legal origin, but which might be confiscated by equivalent at later stage.  In both cases, info is potentially relevant and actionable via FIU freeze and exchange with foreign counterpart. Example 2: SAR/STR linked to adverse media on TF Transactions of suspect might seem normal, no KYC issue, but SAR/STR with financial intelligence might by very valuable because of info on : - geolocation of suspects (ATM cash withdrawals, etc), - suspect’s movements, - types of purchases; - relationships with others (potential accomplices). Focus on sanctions evasion Focus on doubt vs. suspicion vs. evidence In accordance with Article 5

(1)a) of the AML/CFT Law of 12 November 2004, as amended, professionals are obliged to inform the CRF without delay, on their own initiative, when they know, suspect or have reasonable grounds to suspect that money laundering, an associated predicate offence or terrorist financing is taking place, has taken place or has been attempted. Doubts or suspicions can be removed with regard to: Person concerned Evolution of the business relationship Origin of funds or wealth Purpose or nature of the transaction Behaviour of the person concerned Doubt vs. suspicion Doubt Suspicion Doubt often stems from "negative" information based on open source information* (unfavourable media, sanctions, compliance or monitoring lists, etc.) or is linked to the behaviour of the person concerned (+ fake/forged supporting documents). Doubt may arise from an unusual transaction/operation or a transaction that deviates either from the norm or from unusual transactional behaviour of the client (e.g. transactional flows are disproportionate to the reported sources of income (Mule)). Indicators based on the amount or frequency of a transaction, the beneficiary or its unusual character. Verification of doubt: Is there a legitimate explanation for the observations made (e.g. KYC, KYT, etc.)? No residual doubt There are explanations for the unusual patterns. Residual doubt Despite all verficiations, the doubts remain. CRF report CRF report Suspicion arises when doubt cannot be lifted. * Pandora Papers, Panama Papers, Openlux, etc. Thank you for your attention! Questions? CSSF’s expectations on AML/CFT outsourcing notifications 22 January 2024 Circular CSSF 22/806 on outsourcing arrangements Gathers all supervisory requirements on outsourcing arrangements in one single document. Implements a simple prior notification process when outsourcing a critical or important function. Requires the concerned entities to maintain a register for all outsourcing arrangements that can be used by competent authorities in the context of their prudential supervision. Circular CSSF 22/811 – Autorisation and organisation of entities acting as UCI administrator According to point 100, a UCI administrator that intends to delegate a critical or important operational task shall notify in advance its plans to the CSSF. Notification template for delegating critical or important UCI administration tasks, Point 11. Specific considerations for outsourced AML/CFT related functions. Outsourcing arrangements shall be subject to the following principles: An appropriate oversight. Ensure that outsourced operational tasks are effectively performed. Responsibility of the management body for the Entity and all its activities can never be outsourced. Outsourcing arrangements shall not create undue operational risks. Intragroup outsourcing is subject to the same regulatory framework and conditions as outsourcing to service providers outside the group. Assessment of outsourcing arrangements: Entities shall establish whether an arrangement with a third party falls under the definition of outsourcing. (Points 15 to 17) Entities shall always assess if an outsourced function is critical or important. (Points 18 to 20) The outsourcing of functions shall not result in the delegation of the management body’s responsibilities which remains fully responsible and accountable for complying with all of the regulatory obligations or the responsibilities to their customers, including the ability to oversee the outsourcing of critical or important functions. (Point 33) In-Scope Entities shall maintain at all times sufficient substance and not become ‘empty shells’ or ‘letter-box entities’. (Point 37) a. meet all the conditions of their authorisation at all times b. retain a clear and transparent organisational framework and structure that enables them to ensure compliance with legal and regulatory requirements c. exercise appropriate oversight and be able to manage the risks that are generated by the outsourcing of critical or important functions d. have sufficient skilled resources and capacities to ensure compliance with points a. to c. The management body of an In-Scope Entity that has outsourcing arrangements in place or plans on entering into such arrangements shall approve, regularly review and update a written outsourcing policy and ensure its implementation. (point 39) Supervisory conditions for outsourcing: An In-Scope Entity that intends to outsource a critical or important function shall notify in advance its plans to the competent authority using the instructions and, where available, the forms on the CSSF website. Such a notification is to be submitted at least three

(3)months before the planned outsourcing comes into effect. Pre-outsourcing analysis (Section 4.3.1) Before entering into any outsourcing InScope entities shall: a. Assess if the outsourcing arrangement concerns a critical or important function b. assess if the supervisory conditions for outsourcing are met; c. identify and assess all of the relevant risks of the outsourcing arrangement; d. undertake appropriate due diligence on the prospective service provider; and e. identify and assess conflicts of interest that the outsourcing may cause. Contractual phase (Section 4.3.2) The rights and obligations of the InScope Entity and the service provider shall be clearly allocated and set out in a written outsourcing agreement. (Points 76 and 77) Oversight of outsourced functions (Section 4.3.3) In-Scope Entities shall monitor, on an ongoing basis, the performance of the service providers with regard to all outsourcing arrangements on a risk-based approach and with the main focus being on the outsourcing of critical or important functions, including that the continuity of the services provided under the arrangement and the availability, integrity and security of data and information are ensured. (Point 104) Notification template for outsourcing a critical or important business process (BPO) In-Scope Entities shall notify the competent authority in advance in the following cases of outsourcing of a critical or important function:

1. a)planned, new critical or important outsourcing arrangements;
2. b)Material changes to existing critical or important arrangements, and
3. c)Changes to outsourcing arrangements that lead to an outsourced function becoming critical or important. Chapter 10 of the BPO: additional information for outsourced AML/CFT related functions Detailed description of the AML/CFT related functions: - Purpose of each outsourced function - Frequency of execution - Detailed provisions on the procedures to apply when using a service provider - For each service provider: roles/responsibilities/ duties, name of the department, country where the service provider is located Detailed description of IT-systems involved: screening systems, transaction monitoring systems Have the Compliance and the RC been involved in the outsourcing project? Has the staff from the service provider carrying out the outsourced AML/CFT finctions been trained to Luxembourg legal and regulatory framework? Description of the controls implemented (initial validation and regular controls) Confirmation that the conditions of Article 37 of the RCSSF 12-02 are met. Outsourcing is analysed as per the conditions set in Article 37 of the RCSSF 12-02 Detailed description of the due diligence measures and procedures to be implemented Conditions regarding the transmission of information to the professional, including, notably, to make available immediately the information gathered while fulfilling the customer due diligence obligations and the transmission, upon request and without delay, of a copy of the original supporting evidence received in this respect. The policies relating to outsourcing and agency relationship as well as the internal procedures of the professional wishing to use third-party delegates shall notably include detailed provisions on the process for the selection and evaluation of third-party delegates, including of subcontractors at different levels in case of sub outsourcing. In particular, the professional shall ensure that the service provider has the necessary resources to carry out all the outsourced functions (outsourced process, service or activity). The professionals shall carry out a regular control of compliance by the third-party delegate with the commitments arising from the contract. In accordance with the risk-based approach, the regular control shall ensure that the professional is provided with means to test (for example, through sampling) and monitor regularly and occasionally (for example, by carrying out on-site visits) compliance with the obligation’s incumbent upon the third-party delegate. As regards its customers’ data, the professional and the CSSF shall have access rights to the systems/databases of the thirdparty delegate A risk assessment with respect to the outsourced functions and, where appropriate, the outsourcing chain shall be carried out prior to the conclusion of the outsourcing contract. The rights and obligations of the professional and service provider as well as their roles, responsibilities and duties shall be clearly listed, distributed and defined in the outsourcing contract.