← Luxembourg

Publication of the update of the Private Banking Sub-Sector ML/TF Risk Assessment

Published on 7 February 2024 Email this Share this on LinkedIn Share this on Facebook Communiqué Publication of the update of the Private Banking Sub-Sector ML/TF Risk Assessment With assistance from the members of the Expert Working Group on Private Banking (EWG PB), which includes representatives of the private banking sector, the ABBL, the FIU and the CSSF, the CSSF has updated its Private Banking Sub-Sector Risk Assessment (PBSSRA) of

  1. Since the publication of the first PBSSRA, Luxembourg has made several important publications relating to AML/CFT. A revised National Risk Assessment of Money Laundering and Terrorist Financing and a Vertical Risk Assessment on Virtual Asset Service Providers were published in
  2. Furthermore, a Vertical Risk Assessment on Legal Persons and Legal Arrangements and a Vertical Risk Assessment on Terrorist Financing were published in
  3. Drawing on the experience gained from these assessments, as well as the FATF Mutual Evaluation Report of 2023, the CSSF has now reviewed and updated the PBSSRA. The 2023 PBSSRA update includes several new sections (e.g. on the terrorist financing risk in private banking as well as new or developing risks) and provides updated recommendations to the private banking sub-sector. The CSSF expects all supervised entities engaging in private banking activities to integrate the findings, conclusions and recommendations resulting from this sub-sector risk assessment into their AML/CFT frameworks to ensure they remain appropriate to effectively mitigate ML/TF risks. 7 February 2024 Private Banking Sub-Sector Risk Assessment – 2023 update CSSF Analysis of Money Laundering and Terrorist Financing Risks in Private Banking – 2023 update Studies and reports PDF (1.6Mb) Main topic: Financial crime Relevant for Credit institutions Investment firms Private Banking Sub-Sector Risk Assessment 2023 UPDATE CONTENTS 1.INTRODUCTION ............................................................................................................ 5 1.
  4. INTERNATIONAL ML/TF CONTEXT FOR PRIVATE BANKING....................................................... 5 1.
  5. LUXEMBOURG ML/TF CONTEXT FOR PRIVATE BANKING .......................................................... 6 1.2.1.LUXEMBOURG’S NATIONAL RISK ASSESSMENT ........................................................................... 6 1.2.2.PRIVATE BANKING SUPERVISION IN LUXEMBOURG ....................................................................... 7 1.2.3.ENTITIES PROVIDING RELATED SERVICES IN LUXEMBOURG ............................................................. 8 2.STAKEHOLDERS, METHODOLOGY AND DATA ................................................................. 9 2.
  6. STAKEHOLDERS IN THIS ASSESSMENT................................................................................. 9 2.
  7. METHODOLOGY OF THE ASSESSMENT .................................................................................. 9 2.
  8. DATA AND LIMITATIONS ............................................................................................... 10 3.LUXEMBOURG PRIVATE BANKING ECOSYSTEM ........................................................... 11 3.
  9. 3.
  10. 3.
  11. 3.
  12. 3.
  13. PRIVATE BANKS ......................................................................................................... 12 INVESTMENT FIRMS ..................................................................................................... 13 CLIENTS ................................................................................................................... 13 INTERMEDIARIES ........................................................................................................ 16 EXTERNAL SERVICE PROVIDERS ...................................................................................... 17 4.INHERENT RISK – THREAT ASSESSMENT .................................................................... 19 4.
  14. PRIVATE BANKING’S EXPOSURE TO MONEY LAUNDERING GLOBALLY .......................................... 19 4.
  15. ML THREATS MOST RELEVANT FOR PRIVATE BANKING IN LUXEMBOURG ..................................... 20 4.2.1.TAX CRIMES ................................................................................................................ 21 4.2.2.FRAUD ...................................................................................................................... 23 4.2.3.CORRUPTION AND BRIBERY ............................................................................................... 25 4.
  16. TF THREATS IN PRIVATE BANKING................................................................................... 28 4.3.1.SITUATION IN THE EUROPEAN UNION ................................................................................... 28 4.3.2.TF EXPOSURE OF PRIVATE BANKING IN LUXEMBOURG ................................................................. 28 5.INHERENT RISK – VULNERABILITY ASSESSMENT ....................................................... 31 5.
  17. RISK FACTORS IMPACTING PRIVATE BANKING ACTIVITIES IN LUXEMBOURG ............................... 31 5.1.1.CLIENTS AND GEOGRAPHY ................................................................................................ 31 5.1.2.INTERMEDIARIES .......................................................................................................... 32 5.1.3.MARKET STRUCTURE....................................................................................................... 33 5.1.4.PRODUCTS AND SERVICES ................................................................................................ 33 5.1.5.EXTERNAL ADVISORS ...................................................................................................... 37 6.MITIGATING FACTORS AND RESIDUAL RISK ASSESSMENT ......................................... 38 6.
  18. RISK MITIGATION BY PRIVATE BANKING PROFESSIONALS ...................................................... 38 6.1.1.ML/TF RISK ASSESSMENT/RISK APPETITE .............................................................................. 38 6.1.2.CUSTOMER DUE DILIGENCE AND INDIVIDUAL RISK ASSESSMENT ..................................................... 39 6.1.3.COOPERATION WITH COMPETENT AUTHORITIES ......................................................................... 40 6.1.4.INTERNAL ORGANISATION, GOVERNANCE, SUITABILITY, AND TRAINING ............................................. 41 6.
  19. RISK MITIGATION BY CSSF .......................................................................................... 42 6.2.1.UNDERSTANDING OF ML/TF RISK ....................................................................................... 42 6.2.2.MARKET ENTRY ............................................................................................................. 44 6.2.3.SUPERVISION .............................................................................................................. 45 6.2.4.RULES ENFORCEMENT ..................................................................................................... 46 6.
  20. MOST FREQUENT OFF- AND ON-SITE FINDINGS ................................................................... 47 6.
  21. RESIDUAL RISK CONCLUSION ......................................................................................... 49 7.EMERGING AND INCREASING AREAS OF RISK ............................................................ 50 7.
  22. 7.
  23. 7.
  24. 7.
  25. 7.
  26. EVER EXPANDING LIST OF FINANCIAL SANCTIONS ............................................................... 50 OUTSOURCING OF AML/CFT TASKS ............................................................................... 51 NEW TECHNOLOGIES ................................................................................................... 52 VIRTUAL ASSETS ........................................................................................................ 52 STANDALONE MONEY LAUNDERING / PROFESSIONAL MONEY LAUNDERING ................................. 53 8.AREAS FOR FURTHER ENHANCEMENT ......................................................................... 55 8.
  27. RECOMMENDATIONS FOR THE PRIVATE SECTOR ................................................................... 55 8.
  28. CSSF INITIATIVES ..................................................................................................... 57 APPENDIX A. RED FLAG INDICATORS .......................................................................... 58 APPENDIX B. APPLICABILITY FOR INVESTMENT FIRMS .............................................. 65 APPENDIX C. ACRONYMS ............................................................................................. 67 Private Banking Sub-Sector Risk Assessment 2023 Foreword Since the initial publication of the Private Banking Sub-Sector Risk Assessment in 2019, CSSF’s and the private sector’s understanding of money laundering and terrorist financing risks in private banking in Luxembourg has continuously improved. This has been favoured by the public private partnership put in place with the Luxembourg Bankers’ Association, private banks and the Luxembourg FIU, which has created a forum where money laundering, terrorism financing and proliferation financing risks are discussed to the mutual benefit of its members. Luxembourg is one of the leading international financial centres in the world, a position to which private banking has significantly contributed over the years. The growth of the financial sector overall, and private banking in particular, increases Luxembourg’s exposure to the evolving threat of money laundering and terrorism financing. Whilst the financial services sector as a whole is exposed, private banking activities are particularly and specifically at risk when it comes to money laundering. This has been highlighted in all iterations of the National Risk Assessment since its first publication in 2018, confirming similar findings by the FATF or the most recent European Commission’s Supra-National Risk Assessment, dated October 2022, and by supervisors in many other countries. Luxembourg in general, CSSF in particular, but also private banks have committed significant resources to combatting the money laundering and terrorism financing risks. Over the years, Luxembourg’s AML/CFT framework has been continuously strengthened, the country’s understanding of its ML/TF risks has been deepened and refined and the effectiveness of mitigating and preventive measures considerably enhanced. These efforts were also recognised during the FATF’s recent review of Luxembourg and the Mutual Evaluation Report published in September
  29. The Private Banking Sub-Sector Risk Assessment and the work done by the Expert Working Group on Private Banking are cornerstones of Luxembourg’s efforts to continuously maintain and improve its understanding of financial sector risks and are a key tool for all private banking stakeholders, to better understand the money laundering and also terrorism financing risks associated with private banking, and the measures necessary to combat them. I would like to express the CSSF’s thanks to the members of the group for their contributions, and in particular the Luxembourg FIU for sharing its experience through a series of case studies which contribute to a better understanding of some of the threats described herein. Supervised entities are expected to use this risk assessment to review and strengthen their understanding of ML/TF threats and vulnerabilities and further contribute towards the development of proportionate and effective controls. While some potential areas for further improvement have been identified, the recent Mutual Evaluation Report shows that Luxembourg is on the right path and has made substantial progress during the past years. And with new risks emerging, there is no time for standing still. CSSF will continue its efforts to maintain and further enhance its AML/CFT supervision and expects the private banking sub-sector and all entities that are under its supervision to do the same, in order to minimise risk to themselves and the Luxembourg economy, preserve Luxembourg’s reputation as an international financial centre and ensure a solid foundation for its continued development. Claude Wampach Director, CSSF Page | 4 Private Banking Sub-Sector Risk Assessment 2023
  30. INTRODUCTION The Financial Action Task Force (FATF) recurrently highlights private banking as a sector particularly exposed to money laundering (ML). This view is echoed in the European Commission’s Supranational Risk Assessment (SNRA), by supervisors in many countries as well as Luxembourg’s own National Risk Assessment (NRA). In Luxembourg, private banking is an important part of the country’s banking sector. 1 The sub-sector has been highlighted as having a “very high” inherent ML risk in the 2018 National Risk Assessment (NRA), and again in the updated NRA of
  31. Consequently, CSSF completed a first, dedicated Private Banking Sub-Sector Risk Assessment (PBSSRA) in December 2019, to identify more precisely which aspects of private banking activities are particularly exposed to money laundering/terrorism financing (ML/TF). This risk assessment revisits, and updates where necessary, the conclusions of the 2019 assessment. CSSF Banking Supervision has led this assessment, in close cooperation with the Supervision of Investment Firms department, the Luxembourg FIU (CRF), the Luxembourg Bankers Association (ABBL) and the Expert Working Group (EWG) on ML/TF risks in private banking. New additions to the PBSSRA include a revised section on TF risk. TF-linked threats in private banking have been reassessed in section 4.3 in light of the 2022 publications of the updated SNRA and Luxembourg’s first Terrorism Financing Vertical Risk Assessment (TFVRA), in line with a recommendation by the FATF. Furthermore, a new Chapter 7 has been inserted, to address emerging and increasing areas of ML/TF risk identified by CSSF, including a section focussing on financial sanctions. Further areas that were reviewed include outsourcing, new technologies and virtual assets. Section 7.5 draws attention to professional money launderers, who insert themselves in the money laundering process as an additional layer, thus rendering detection even more difficult. Finally, Chapter 8 revisits and updates the recommendations for the private sector, based on conclusions from CSSF’s supervision, and highlights some of CSSF’s present and future initiatives. 1.
  32. International ML/TF context for private banking Before considering the specifics of the private banking sub-sector in Luxembourg, it is useful to have a look at private banking internationally. FATF has identified several areas of ML risks in wealth management, including: “culture of confidentiality, difficulty to identify beneficial owners, concealment (use of offshore trusts), banking secrecy, complexity of financial services and products, PEPs, high value transactions [and] multiple jurisdictions”. 2 FATF encourages private banks 3 to understand the different ML/TF risks associated with their clients and activities and take appropriate mitigating actions. FATF also states that “private banking accounts can be attractive to money launderers and particularly those wishing to launder the proceeds of corruption because of the high net worth of the customer, the offshore nature of many of the facilities offered, and the type of products and services available. These services are likely to attract money launderers who look for adequate ventures to move large sums of money without attracting notice.” 4 The 2022 SNRA highlights i.a. that “Given the combination of sophisticated financial products and services, and a wealthy customer base, which sometimes includes politically Luxembourg National Risk Assessment, 2020 FATF, Guidance for a Risk-Based Approach: the Banking Sector, 2014 3 “Private bank(s)” as used in this document refers to banks offering significant private banking services. 4 FATF, Specific Risk Factors in Laundering the Proceeds of Corruption, June 2012 1 2 Page | 5 Private Banking Sub-Sector Risk Assessment 2023 exposed persons (PEPs), the sector can be abused also for tax evasion, especially in cases where assets of the beneficial owners are hidden behind complex ownership structures and direct private banking customers are the associates or family members of the actual beneficial owners”. The SNRA rates the ML threat related to private banking as “significant/very significant”, an increase as compared to the 2017 SNRA referenced by the 2019 PBSSRA and a continuation of its assessment of
  33. 5 A number of national supervisors have highlighted in the past the high inherent ML/TF risks in private banking, and the European Banking Authority (EBA) dedicated guideline 12 of its ML/TF Risk Factor Guidelines 6 entirely to the identification and prevention of wealth management/private banking related ML/TF risks. 1.
  34. Luxembourg ML/TF context for private banking 1.2.
  35. Luxembourg’s National Risk Assessment In December 2018, Luxembourg published its first NRA, which was updated in
  36. The purpose of the NRA is to identify, understand and assess the ML/TF risks to which the country is exposed, and inform, direct and support the national AML/CFT strategy. Table 1: National exposure to ML/TF threats map from NRA 7 5 European Commission, Commission staff working document accompanying the REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the assessment of the risk of money laundering and terrorist financing affecting the internal market and relating to cross-border activities, 2022 6 EBA, Guidelines under Articles 17 and 18

(4)of Directive (EU) 2015/849 on customer due diligence and the factors credit and financial institutions should consider when assessing the money laundering and terrorist financing risk associated with individual business relationships and occasional transactions (“The ML/TF Risk Factors Guidelines”), EBA/GL/2021/02 consolidated version, 2023 7 Subsequently to the NRA’s threat assessment, the Law of 20 July 2022, modifying the Law of 9 December 2020 on international financial sanctions regimes (Financial Sanctions Law), introduced in article 506-1 of the Luxembourg Criminal Code a new predicate offence relating to breaches of financial sanctions. Page | 6 Private Banking Sub-Sector Risk Assessment 2023 The NRA identifies predicate offences (threats) that are particularly relevant in Luxembourg. Starting from FATF’s designated categories and using a weighted average of external and domestic exposure, the 2020 NRA concludes that fraud and forgery, tax crimes, and corruption and bribery are “very high” threats in Luxembourg, driven predominantly by the country’s international nature and cross-border exposure. In contrast, and with the exception of fraud and forgery, the threat of ML from domestic crimes is much lower, due to Luxembourg’s overall lower low crime rate and limited presence of organised crime. The NRA also identifies and scores the inherent risk (i.e. risk before the application of mitigating factors) of the banking sector as inherently “high”, and the private banking subsector as “very high” risk. Table 2: Overview of Luxembourg’s NRA – risks in the banking sector 8 Following the publication of the updated NRA and the publication of Luxembourg’s TFVRA in 2022, and considering its own experience accumulated since 2019, CSSF is now reviewing its sub-sector risk assessment of private banking. Sub-sector risk assessments bridge the gap between risk assessments at sector level (covered by the NRA) and entity level (covered by CSSF’s supervision). 1.2.
  1. Private banking supervision in Luxembourg CSSF is in charge of supervising the financial sector in Luxembourg and enforcing compliance with professional obligations related to AML/CFT by professionals. Within CSSF, Banking Supervision performs market entry controls and exercises ongoing AML/CFT and prudential supervision of all banks in Luxembourg. 9 CSSF applies a risk-based approach to AML/CFT supervision, in line with FATF guidelines and recommendations. This involves identifying, assessing and understanding ML/TF risks faced by the banking sector, its specific products and services and the clients and jurisdictions it serves as well as taking AML/CFT measures commensurate to those risks. 10 CSSF regularly communicates to the private sector on AML/CFT obligations and ML/TF risks through regulations, circulars, bilateral communication, participation to industry events such as conferences, interaction with representative industry bodies and publicprivate partnerships (PPP). ABBL has established in 2007 a dedicated private banking cluster to support the needs and development of players within the private banking sector in Luxembourg, via training, opinion building, working groups, position papers and other tools. In 2019 CSSF and ABBL established a joint Expert Working Group for AML/CFT in Private Banking (EWG PB), as a PPP. 11 This working group was joined in January 2020 by the Luxembourg FIU. The EWG meets on a regular basis to discuss AML/CFT topics and strengthen the framework to combat ML and TF in banks offering private banking services. 8 Note, the NRA ranks risks on a five-point scale (Very High, High, Medium, Low, Very Low) – this risk assessment uses a four-point scale (High, Medium-High, Medium-Low, Low). 9 Since November 2014, the licensing (including licence withdrawal and approval of qualifying holdings) of all new banks within the Eurozone is under the ultimate authority of the European Central Bank (ECB). 10 FATF, Guidance for a Risk-Based Approach: the Banking Sector, 2014 11 AML/CFT: The ABBL, the CRF and the CSSF sign a public-private partnership Page | 7 Private Banking Sub-Sector Risk Assessment 2023 1.2.
  2. Entities providing related services in Luxembourg Whilst this document focuses primarily on private banks, some of the services described herein are also provided by other actors and in particular investment firms. 12 Since March 2023, representatives from the investment firms sector have also joined the EWG PB. Professionals of the Financial Sector that provide investment services or perform investment activities according to art. 24-1 to 24-9 of the Law of 5 April 1993 (LFS). 12 Page | 8 Private Banking Sub-Sector Risk Assessment 2023
  3. STAKEHOLDERS, METHODOLOGY AND DATA This section describes the stakeholders involved in the risk assessment and the methodology and data used. 2.
  4. Stakeholders in this assessment This document was written by CSSF’s AML/CFT Banking Supervision in close collaboration with other departments and internal experts as well as after consultation of the EWG PB, which brings together representatives from private banks, investment firms 13, ABBL, the CRF and CSSF. 2.
  5. Methodology of the assessment The assessment identifies relevant ML/TF threats and potential areas of vulnerability to evaluate risk and assesses residual risk following the mitigating measures put in place by both CSSF and the private sector. The methodology is closely aligned to that used in Luxembourg’s NRA. The methodology is also aligned to the revised Guidelines on RiskBased Supervision 14 and Guidelines on ML/TF Risk Factors 15, to FATF Guidance and to peer practices. General approach 16 In its guidance for national money laundering and terrorist financing risk assessments, the FATF has defined risk as a function of three factors: threat, vulnerability and consequence. Inherent risk – Threat assessment The FATF defines a threat as “a person or group of people, an object or activity with the potential to cause harm. In the ML/TF context this includes criminals, terrorist groups and their facilitators, their funds, as well as past, present and future ML or TF activities” (predicate offences). The objective of this threat assessment is to understand the environment in which predicate offences are committed, to identify their nature, and to assess the exposure of private banking to them. This document examines the most relevant ML threats for private banking, building on the conclusions of the NRA. 17 Note: TF specific threats are presented separately in section 4.
  6. In line with the SNRA and the NRA, as well as the TFVRA dated May 2022, this assessment highlights the overall low prevalence of TF via private banking and provides reasons behind this observation. Investment firms participate in the EWG PB since March
  7. EBA, The Risk‐Based Supervision Guidelines, EBA/GL/2021/16, 2021 15 EBA, The ML/TF Risk Factors Guidelines, EBA/GL/2021/02 consolidated version, 2023 16 This section contains extracts and abbreviated quotes from the FATF’s Guidance for national money laundering and terrorist financing risk assessments. 17 NRA, 2020 13 14 Page | 9 Private Banking Sub-Sector Risk Assessment 2023 Inherent risk – vulnerability assessment According to the FATF, vulnerability refers to “those things that can be exploited by the threat or that may support or facilitate its activities. In the ML/TF risk assessment context, looking at vulnerabilities as distinct from threats means focussing on, for example, weaknesses in AML/CFT systems or controls or certain features of a country, sector, product or service that make them attractive for ML or TF purposes”. Vulnerabilities determine thus the relative attractiveness of a sector or sub-sector for ML/TF purposes. Vulnerability arises from activities which are particularly exposed to abuse or misuse for ML/TF purposes. Vulnerability in private banking is driven by multiple factors, including the international nature of the sector and its clients, the volume of crossborder flows and their size, the intervention of intermediaries, its structure, products and services offered, or the involvement of external advisors. Consequence refers to the impact or harm that ML or TF may cause on financial systems and institutions, as well as the economy and society more generally. Consequences include financial losses and fines suffered by an institution, public shaming, loss of confidence and trust in the institution or the sub-sector or sector as a whole, up to economic, political, societal, durable reputational damages at country level and beyond. The main objective of this assessment is to determine the level of ML/TF risk posed by different private banking activities. Mitigating factors and residual risk assessment Mitigating factors are all the elements in place that contribute to combating ML/TF. This includes both private sector controls (e.g. internal control frameworks and systems) as well as public measures (e.g. legal, judicial, supervisory and institutional frameworks) in place to reduce and prevent ML/TF risks. Mitigating measures cover the full lifecycle of supervision: understanding of ML/TF risks, market entry (including licensing, qualifying holding procedures, registration and fitness and propriety checks), rules setting and oversight, assessment of compliance with rules and enforcement. Residual risk is the risk of ML/TF occurring after considering mitigating factors in place. The level of residual risk of the sub-sector is determined by reducing the level of inherent risk by an amount commensurate with the strength of mitigating factors. Note, if residual risk and inherent risk scores are the same, this does not mean that there are no mitigating measures in place (only that the mitigating measures do not reduce inherent risk substantially). 2.
  8. Data and limitations This assessment uses both quantitative and qualitative data from a variety of relevant sources. These include international sources (e.g. international organisations, foreign competent authorities, industry bodies, academia), data published by the ABBL’s private banking cluster, data from other domestic competent authorities (e.g. CRF), CSSF internal data collected as part of supervisory measures, information exchanged with the EWG PB as well as other information provided by the private sector (e.g. via surveys, interviews or workshops). Where information was missing or incomplete, the assessed level of risk has been increased, in line with a conservative approach recommended by FATF. Page | 10 Private Banking Sub-Sector Risk Assessment 2023
  9. LUXEMBOURG PRIVATE BANKING ECOSYSTEM Luxembourg’s private banking sub-sector is quite fragmented, with the largest ten private banks holding a market share of close to 70%, and many smaller institutions. 18 Some offer exclusively private banking services, others have more of a mixed business model, offering other services alongside private banking. Most private banks in Luxembourg are foreignowned and operate in Luxembourg as part of European and international groups. 19 Since 2015, the number of private banks has been decreasing by 25%, reflecting a growing sector consolidation and the pressure especially on smaller banks from increasing costs and a highly competitive environment. Nevertheless, private banking remains an important component of Luxembourg’s banking sector. 20 Taxonomy This assessment has split the different actors of the private banking ecosystem into five categories: Table 3: Actor taxonomy for the purpose of this private banking sub-sector risk assessment Actor category Private banks Investment firms Clients Description of actor’s role Private banks are banks that provide personal banking services and tailor-made products to their clients. Private banks typically provide two main categories of activities: asset management (i.e. custody of financial assets and investment services) and ancillary services (i.e. current account banking, credit solutions, wealth structuring and insurance solutions). Investment firms are a category of professionals of the financial sector defined in Articles 24-1 to 24-9 of the LFS. Investment firms can be authorised to provide different services, including portfolio management, investment advisory and some ancillary services, comparable to private banks. Clients include both direct clients (i.e. account-holders) and ultimate beneficiaries. They show different characteristics based on the value of their assets under management, the geographic origin of their assets, and their legal structure. Ultimate beneficiaries are natural persons who are the ultimate source of funds or who ultimately own the assets and benefit from private banking activities. ABBL data, 2023 CSSF internal data, 31 December 2023 20 KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2022-2023 18 19 Page | 11 Private Banking Sub-Sector Risk Assessment 2023 Intermediaries External service providers 3.
  10. Intermediaries facilitate interactions between private banks/investment firms and clients and often maintain a regular relationship with the private bank/investment firm or the client. For example, the actors in this category could be: Power of Attorney (POA) holders carrying out instructions on behalf of the client, such as signing documents; business introducers helping banks grow their client base; or third party managers managing the client’s assets. External service providers are specialists that support clients and/or private banks/investment firms with specialised services provided at specific occasions. For example, they can provide financial or legal expertise, trust or company services or assist private banks/investment firms with specific aspects of client due diligence. Private banks Private banks provide diverse, personalised wealth management services. For the purpose of this assessment, these activities have been split into two core categories of asset management services and four categories of ancillary services. 21 Table 4: Activity taxonomy for private banking banks Categories Taxonomy elements Asset management Custody of financial assets Investment services Description Booking and safekeeping of financial assets along with all related back-office services, such as for instance transaction execution (e.g. brokerage services) and settlement, dividend and interest collection and distribution, corporate action processing or tax reporting. Optimising clients’ financial investments according to agreed objectives. There are two main kinds of investment services provided in Luxembourg: discretionary asset management services and investment advisory. 22,23,24 Ancillary services Current account banking Providing services meant to satisfy clients’ day-to-day banking needs, such as current accounts, payment This is an illustrative categorisation defined for the purpose of this risk assessment. Discretionary asset management services are investment services and products provided by a private bank while following the risk tolerance and the financial requirements agreed in advance with the client. The private bank manages investments on behalf of the client, who typically cannot ask for specific investment decisions (e.g. buying stocks from a specific company). 23 Investment advisory refers to the provision of advice on investments related to the client’s portfolio (e.g. monitoring of markets, private equity, debt products). 24 Note, in recent years, some banks have added robo-advisors to their service offer. A robo-advisor is a digital tool that provides automated financial planning and investment services with little to no human supervision. 21 22 Page | 12 Private Banking Sub-Sector Risk Assessment 2023 services, credit cards or electronic banking Credit solutions Wealth structuring Insurance solutions 3.
  11. Credit solutions typically include the provision of credit lines to improve portfolio returns as well as loans and mortgages unrelated to portfolio investments. Advising in particular High Net Worth (HNW) and Ultra-High Net Worth (UHNW) clients on their investment strategy and on the most appropriate legal or fiscal structure to fit the client’s needs for asset protection, succession planning or tax planning. It also includes creating bespoken personalised investment schemes. Wealth structuring is often offered by external advisors. Distributing life and non-life insurance solutions to clients structured by licensed insurance professionals. In Luxembourg, insurance professionals are supervised by the Commissariat Aux Assurances (CAA). Investment firms Investment firms are supervised by the Supervision of Investment Firms department within CSSF. Investment firms comprise different types of professionals and can provide a range of services comparable to private banks, including portfolio management, investment advisory services and some ancillary services. 25 Wherever investment firms carry out private banking activities as described in this risk assessment, they are exposed to the same threats and present the same vulnerabilities as private banks. 26 Accordingly, those relevant sections of this private banking assessment are, mutatis mutandis, applicable to investment firms as well. 3.
  12. Clients Private banking clients can be natural persons, legal entities or legal arrangements. 27 Private banking clients may also be categorised according to multiple additional criteria to understand and evaluate the level of ML/TF risk. For example, they can be analysed 25 Due to the nature of the license held by investment firms, they cannot provide current account banking services, credit solutions, or insurance solutions. 26 Refer to Annex B for further information regarding investment firms. 27 Refer to the section on taxonomy at the beginning of Chapter
  13. Page | 13 Private Banking Sub-Sector Risk Assessment 2023 according to their fiscal residency, nationality, source of wealth (e.g. wealth derived from inheritance or a family business), geographical spread of business operations, investment behaviour, etc. 28 The industry is specialised in cross-border services, with some 80% of private banking clients having their fiscal residence outside Luxembourg. The client base remains nevertheless largely European. According to the ABBL, the number of private banking accounts in Luxembourg has decreased from some 255,000 in 2012 to about 152,000 at the end of 2021
  14. However, while the share of affluent clients has continuously decreased, at the same time, the importance of HNW/UHNW clients has increased. 30 As a result, despite an apparent loss of clients, the total value of assets under management (AuM) by private banks in Luxembourg has steadily grown since the 2008 financial crisis, from EUR 225 billion in 2008 to EUR 585 billion at the end of
  15. The 2022 figure represents an increase of 61% over the data used in the 2019 PBSSRA, and of 160% since
  16. 31,32 The geographic origin of private banking clients in Luxembourg is diverse. Approximately 20% of private banking clients come from Luxembourg, while the remainder come from abroad. Of the latter, approximately 20% originate from Luxembourg’s direct neighbouring countries, while over 40% are from other European countries. 33 The remaining share is very international, with a notable presence of clients from Latin America and the Middle East. Typical motivations for foreign investors to hold their assets in Luxembourg are the stable political, economic and juridical environment, the strong property protection, the well-regulated and stable financial sector providing numerous investment opportunities, the central European location including membership of the Eurozone, the diverse and high-quality services, the concentration of experts and the international, multi-lingual workforce. Many other categorisations can exist and their appropriateness may depend on banks’ specific business models. ABBL data 30 Refer to Figure 3: Evolution of the distribution of client wealth bands. 31 KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 32 According to ABBL, the total private banking AuM dropped slightly in 2022 as compared to 2021, due to geopolitical turbulence, supply chain constraints, fears of recession and tightening of monetary policy. 33 Based on: KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 28 29 Page | 14 Private Banking Sub-Sector Risk Assessment 2023 Figure 1: Geographical origin of PB clients 34 Predominantly European origin of private banking clients Rest of World ~ 20% Other European countries ~ 40% Direct neighbours (BE, DE, FR) ~ 20% Luxembourg ~ 20% Figure 2: Evolution of private banking AuM in Luxembourg 35 34 Based on: KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 Page | 15 Private Banking Sub-Sector Risk Assessment 2023 The 2023 KPMG-ABBL Private Banking Report categorised private banking clients into 5 wealth bands, ranging from below EUR 1 million AuM to above EUR 20 million AuM. The survey showed that, whereas the share of the middle wealth bands (EUR 5 – 20 million) in the sub-sector’s total AuM has remained relatively stable over the years, the importance of the two lower wealth bands has been steadily and considerably declining whereas the top wealth band (> EUR 20 MM) makes up for 59% of the sub-sector’s AuM and drives the sector’s growth
  17. Figure 3: Evolution of the distribution of client wealth bands, % of total AuM (2011-2022) 36 3.
  18. Intermediaries Intermediaries interact between clients and private banks at different stages of the private banking value chain. Intermediaries active in Luxembourg’s private banking sub-sector include business introducers, POA-holders, and third-party managers. 37 Business introducers are natural persons or legal entities increasing private banks’ reach, helping them to grow their client base. 38 They may be lawyers, financial advisors, accountants, asset managers or other financial institutions. They typically have a professional relationship with the bank that is subject to an agreement setting out the responsibilities of the bank and the introducing intermediary. To some extent, private banks may also rely on intermediaries to provide inputs to conduct client due diligence (CDD), e.g. when collecting client documentation. Private banks that are subsidiaries or branches of foreign-owned banks may benefit from their parent or other group companies to grow their client base through referrals of clients. While these group companies may KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 37 Please note that this is an illustrative categorisation defined for the purpose of this risk assessment. Additional intermediaries may exist, and some of these activities may be performed by the same intermediary. 38 Also referred as “business finders” or third-party introducers, as defined in The Wolfsberg Group’s The Wolfsberg AML Principles Frequently Asked Questions with Regard to Intermediaries,
  19. 35 36 Page | 16 Private Banking Sub-Sector Risk Assessment 2023 also provide inputs for CDD on those clients, the private bank in Luxembourg remains ultimately responsible for the due diligence. POA-holders can be individuals or legal entities with, for example, signatory authority over an account or on behalf of a beneficial owner but that do not act on a professional basis as an asset manager. For example, they may be lawyers or accountants, but also family members or trusted individuals representing the account holder or the ultimate beneficiary of the account. When the account holder is not a natural person, the ultimate beneficiary could also act as a POA-holder. Third-party managers are professional asset managers, typically investment firms providing discretionary management or advisory services to clients. They may be located in Luxembourg or abroad. In most countries, including Luxembourg, asset management services can only be provided by licensed professionals. 3.
  20. External service providers For the purpose of this assessment, external advisors are third-party specialist service providers that support clients and/or private banks with specific, highly specialised services. 39 For example, these can include legal, financial, tax, TCSP or due diligencerelated services. 40 Financial advisory services: External professionals with specialist financial expertise may provide specific or tailored services to private banks and/or clients. Such financial experts can include external asset managers (e.g. private equity funds), economic advisors (e.g. merger and acquisitions advisors and corporate finance advisors), accountants, auditors, insurers and real estate agents. Tax advisory services: Specialised tax advisors often advise private banking clients, especially in the higher wealth bands, on tax efficient investment, wealth or estate planning strategies. Tax advisors may also be authorised to provide other services, or work closely together with other professionals, such as lawyers. TCSP services: Clients or private banks themselves may also request support from trust and company service providers to optimise relevant investments or wealth structuring strategies. According to the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (AML/CFT Law) and in line with FATF’s definition, there are five types of trust and company services: 41,42 • Incorporation services consist of forming companies or other legal persons. • Representation services include acting or arranging for another person to act as a director or secretary of a company, a partner of a partnership, or a similar position in relation to other legal persons. 43 • Domiciliation services include providing a registered office, business address, correspondence or administrative address, or business premises and other related services for a company, a partnership or any other legal person or arrangement. 39 There are other service providers that also support private banks but are less specific to private banking activities (e.g. Information Technology vendors, Human Resources providers). Such providers are out of the scope of this report. 40 Please note that this is an illustrative categorisation defined for the purpose of this risk assessment. Additional specialist services may exist, and some of these may be performed by the same professional. 41 Luxembourg, AML/CFT Law Chapter 1, Article 1, Paragraph 8(a) to 8(e) 42 FATF, Methodology for assessing compliance with the FATF Recommendations and the effectiveness of AML/CFT systems, 2021 43 Note that true “nominee directors” do not exist under Luxembourg company law. All appointed directors share the same obligations and responsibilities. Page | 17 Private Banking Sub-Sector Risk Assessment 2023 • Fiduciary/trustee services correspond to companies acting as, or arranging for another person to act as, a fiduciaire in a fiducie, a trustee of an express trust or an equivalent function in a similar legal arrangement, and • Shareholder proxy services consist in acting as, or arranging for another person to act as, a shareholder representative or proxy. 44 Several types of professionals can perform trust or company services. A number of these are supervised by CSSF, such as banks, investment firms, management companies or specialised professionals of the financial sector (among which family offices). Legal advisory services: Lawyers provide legal advice and set up contracts and agreements, and notaries create the investment vehicles or other corporate or legal structures to implement the client’s tax, estate planning or investment strategies. 45 Client due diligence services: Private banks may leverage third parties to get assistance when performing specific due diligence requirements or screening prospects and existing customers, such as HNW/UHNW customers. Private banks may request external expertise or group capabilities on specific CDD inputs (e.g. due diligence reports, access to specialised due diligence database, information on source of wealth) or may leverage clients’ documentation in possession of intra-group competence centres to fulfil due diligence requirements. Nevertheless, private banks remain ultimately responsible for the due diligence. As discussed above, introducing intermediaries may also conduct part of the CDD. 44 Note that true “nominee shareholders” do not exist under Luxembourg law; while shareholder proxies or representatives may be appointed in certain circumstances, the identity of the true shareholder must be disclosed. 45 FATF defines legal professionals as “Lawyers, notaries and other independent legal professionals – this refers to sole practitioners, partners, or employed professionals within professional firms. It is not meant to refer to ‘internal’ professionals that are employees of other types of businesses, nor to professionals working for government agencies, who may already be subject to AML/CFT measures”, FATF, Money Laundering and Terrorist Financing Vulnerabilities of Legal Professionals,
  21. Page | 18 Private Banking Sub-Sector Risk Assessment 2023
  22. INHERENT RISK – THREAT ASSESSMENT The purpose of this section is to understand and to review the exposure of private banking activities to ML/TF threats 46 in general, and to determine and assess those ML/TF threats that are most relevant for private banking in Luxembourg. 4.
  23. Private banking’s exposure to money laundering globally Private banks are exposed to ML during all stages: placement, layering and integration. 47 Placement is the initial entry of illicit proceeds into the financial system. Layering involves using complex movement of funds to distance the illicit money from the source. Integration involves returning money to the criminal from what seem to be legitimate sources. At the placement stage, private banks are exposed to multiple ways in which illicit proceeds can be placed in the financial system, for example, cash deposits, cheques, or money orders. Historically, cash was more commonly used by criminals because it is difficult to ascertain the source of funds and can be impossible to know the intended beneficiary. Private banks can be abused or misused as the point of entrance of their clients’ illicit cash to the financial market. However, private banks’ primary exposure is during the layering and integration stages. Criminals may abuse or misuse sophisticated investment services to obscure the audit trail and sever the link with the original crime. During these stages, funds are typically transferred electronically from one investment or account to another and potentially across several geographies. Eventually, funds are returned in one form or other to the criminal, from what seem to be legitimate sources. Figure 4: Illustration of ML scheme through private banking The exposure of private banks to layering and integration is due to multiple factors, among which the following are considered particularly relevant: • Objectives of the business: Wealth preservation is a goal shared by the criminal as well as the portfolio manager to whom the funds are entrusted, which makes the 46 “Risk can be seen as a function of three factors: threat, vulnerability and consequence”, FATF, National Money Laundering and Terrorist Financing Risk Assessment,
  24. 47 FATF, FAQ: How is money laundered ? Page | 19 Private Banking Sub-Sector Risk Assessment 2023 simulation of legitimate investor behaviour easier and facilitates the establishment of a relationship. • High value of investments and transactions: Private banking clients are by nature wealthy and invest larger amounts of funds. Large value transactions are likely to occur more frequently in private banking than in other banking sectors, making an unusual and illicit nature of large transfers more difficult to detect and facilitating the introduction of large sums into the financial system. • International nature of the business: The international nature of private banking increases the likelihood of dealing with illicit proceeds from predicate offences committed in foreign jurisdictions, in particular when in contact with high-risk jurisdictions. This can be exacerbated by the use of (foreign) intermediaries that create distance between the client and the private bank. • Complexity of some products and schemes used in private banking and wealth management: The inherent complexity of some products and schemes used to serve clients’ needs (e.g. for wealth preservation or tax planning by HNW/UHNW clients), can increase the opaqueness of client relationships and increase the difficulty in detecting ML. • Difficulty in identifying beneficial owners: The use of legal entities or legal arrangements can increase the difficulty of identifying beneficial owners. 48 Complex legal structures might be used by criminals to hide their identity or the role of beneficial owners. 4.
  25. ML threats most relevant for private banking in Luxembourg When considering the 2018 and 2020 NRAs’ conclusions, discussions held during working groups, Suspicious Transaction / Suspicious Activity reporting data and CSSF’s off- and onsite supervisory experience, the following three predicate offences appear as particularly relevant threats for the private banking sub-sector in Luxembourg:
(1)tax crimes;
(2)fraud; and
(3)corruption and bribery. Luxembourg is typically not the country of origin of tax crimes or corruption offences, although the country is exposed to some level of domestic fraud. Also, typically, private banks in Luxembourg are at risk of ML especially at the layering and integration stages. 49 The following sub-sections focus on these three threats and assess the specific exposure of the private banking sub-sector in Luxembourg. Occasionally, taking into account that predicate offences are committed more often abroad, information from global sources may be used to complement more limited, Luxembourg-specific data. A register of beneficial owners was set up by the law dated 13 January 2019 with effect from 1 March 2019 implementing provisions of the fourth Anti-Money Laundering Directive into Luxembourg law (Loi instituant un Registre des bénéficiaires effectifs). In order to protect legitimate privacy concerns, the Court of Justice of the European Union (CJEU) subsequently limited access to such registers on a legitimate need-to-know basis. 49 NRA, 2020. Note, it is at these two stages that the CRF most commonly receives STRs or other information from Luxembourg-based institutions. 48 Page | 20 Private Banking Sub-Sector Risk Assessment 2023 4.2.1. Tax crimes Tax crimes involve the intentional breach of law to evade tax. Across the world, these crimes are one of the main sources of criminal proceeds and have been highlighted in the SNRA as particularly relevant for private banking. 50 Tax evasion (escroquerie fiscale) and aggravated tax fraud (fraude fiscale aggravée) are predicate offences in Luxembourg. 51,52 The international nature of Luxembourg private banks’ operations is one of the primary drivers of the sub-sector’s exposure to misuse/abuse related to tax crimes. 53 In particular, the diverse geographic origin of private banking assets and clients exposes Luxembourg to the risk that foreign individuals may misuse/abuse private banks for tax evasion/fraud. 54 In contrast, misuse/abuse related to domestic tax evasion/fraud is assessed to be much lower. This is due to Luxembourg’s tax system and small shadow economy (domestic tax evasion is estimated to be lower in Luxembourg than most other OECD countries, ~0.9% of GDP vs. 1-1.1% in Germany, France and Belgium). 55 The relative exposure to tax crimes from foreign and domestic individuals is also reflected in the nature of cases investigated by the CRF, as shown in the case study below. Figure 5: Case study of suspicious activity in banking related to possible tax crimes 56 The present case study is based on suspicious transactions (ST) involving Luxembourg based companies (LuxCos) and an unregulated Luxembourg securitisation vehicle presenting the following suspicious activities: (
  1. i)numerous cash withdrawals of low amounts generally not exceeding the EUR 10,000 threshold, (
  2. ii)transfers of part of the LuxCos’ securities portfolios to an external asset manager’s omnibus account in Luxembourg, or (iii) purchase of gold bars and their physical delivery. Initial findings: i. The securitisation vehicle had been set up in December 2016 by a TCSP. ii. The two directors, shareholders and UBOs of the TCSP, both Luxembourg residents, had subscribed the securitisation vehicle’s shares, acted as its directors and then later also registered as its ultimate beneficial owners (UBOs). iii. The securities portfolios held by the LuxCos were initially held directly by a number of unrelated foreign natural and legal persons (Persons) and these securities portfolios had not been declared to the relevant foreign tax authorities. In December 2014, the aforementioned TCSP had set up the LuxCos to hold the securities portfolios in consideration for shares issued to the relevant Persons. In December 2016, the Persons transferred their European Commission, Commission staff working document accompanying the REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the assessment of the risk of money laundering and terrorist financing affecting the internal market and relating to cross-border activities, 2022 51 Law of 23 December 2016 and Circular CSSF 17/650, 2017 52 Aggravated tax fraud is defined according to the tax thresholds evaded or the level of reimbursement obtained. For tax evasion, increased gravity is related both to the amounts involved and the fact that means have been employed with a view to deceiving the tax authorities. Both offences related both to direct taxes (e.g. income and inheritance tax) and indirect taxes (VAT). 53 This includes both the laundering of the proceeds of tax crimes, and the use of private banks’ products and services to facilitate the tax crime itself. 54 See Section 5.1.1 for further details on inherent risk related to ‘Clients and Geographies’. 55 CESifo Group, Size and Development of Tax Evasion in 38 OECD Countries, 2012. The shadow economy includes “all market-based legal productions of goods and services that are deliberately concealed from public authorities for the following reasons: avoid payment of taxes, avoid payment of social security contributions, avoid certain legal labour market standards and avoid complying with certain administrative procedures” (CESifo, F. Schneider, Estimating the size of the shadow economies, December 2016) 56 Case study provided by the CRF 50 Page | 21 Private Banking Sub-Sector Risk Assessment 2023 shares in the LuxCos via separate purchase agreements to the securitisation vehicle. iv. Numerous partial redemptions of the securitisation vehicle’s notes by various Persons thus indicating that the Persons, being the former beneficial owners of the securities portfolios, still had control over them. The red flags outlined in (
  3. i)to (iii) above are an additional indicator that the securitised LuxCos’ shares were still under the control of the Persons who appeared to repatriate their undeclared funds after having channelled them through a corporate structure in Luxembourg. Outcome: The apparent lack of an economic rationale for setting up the LuxCos and later on selling their shares in the LuxCos to the securitisation vehicle in exchange for notes is in itself not illegal. But put in the context of the amendments to Luxembourg’s legal framework on the common reporting standards for the automatic exchange of tax information on a European level, this increased layering of corporate structures over time between the Persons and their securities portfolios, from being held directly or through offshore structures in private banks to becoming noteholders in a securitisation vehicle, is a serious indicator of tax fraud given that as a result of these changes the foreign UBOs had effectively been removed from the OECD’s Common Reporting Standard (CRS) scope. Indeed: In January 2015, Luxembourg started to exchange bank account data (on financial revenues) of non-resident natural persons with other EU countries, but corporate accounts remained out-of-scope. As a result, by transferring their securities portfolios from a private account (resp. offshore company account) to a corporate account in late 2014, the Persons could avoid the reporting of the securities portfolios to their competent tax authorities. In January 2017, passive Non-Financial Foreign Entities (NFFEs) also fell within the scope of the CRS. The more comprehensive automatic exchange of information in tax matters includes, among other things, the exchange of information relating to financial accounts held in Luxembourg by (
  4. i)individuals resident abroad and (
  5. ii)certain legal entities with economic beneficiaries resident abroad. The first exchanges took place in 2017. The LuxCos were so-called passive companies (of the SOPARFI type) and had foreign residents as beneficial owners, therefore information relating to the bank accounts of the LuxCos and their beneficial owners should have fallen within the scope of this new law. However, in December 2016, just before the more extensive automatic exchange of information came into force, the Luxembourg securitisation vehicle was set up. As previously mentioned, the 2 UBOs of the TCSP, both Luxembourg residents, had registered as beneficial owners of the securitisation vehicle and the LuxCos. As a result, the structure and its true beneficial owners (i.e. the Persons) no longer fell within the scope of the new law on the more comprehensive automatic exchange of information. Red flags: • Complex ownership structure • Frequent changes in the ownership structure including beneficial ownership shift to out-of-scope individuals • Corporate structure changes shortly prior to legislative changes on the common reporting standards Page | 22 Private Banking Sub-Sector Risk Assessment 2023 • Unknown/ poorly documented origin of funds • Cash withdrawals of low amounts generally not exceeding EUR 10,000 threshold Since 2017, annual statistics show that more than 40% of traditional banks’ 57 Suspicious Transaction and Suspicious Activity Reports (STR/SAR) pertaining to fiscal offences are consistently filed by private banks each year, although the number of accounts and transactions of the sub-sector is much lower than that of other sub-sectors, such as retail for instance. The data also shows that fiscal offences remain the predicate offence with the highest exposure level for private banks in Luxembourg. Nevertheless, this high number of STR/SAR related to tax offences also illustrates the positive impact of adding tax evasion (escroquerie fiscale) and aggravated tax fraud (fraude fiscale aggravée) to the list of predicate offences for ML. Private banks in particular are today very much aware of this risk and have since 2017 made considerable efforts to detect and report suspected offences to the FIU. Luxembourg has put in place a strong legal and regulatory framework to combat international tax evasion. The Organisation for Economic Co-operation and Development’s (OECD) Common Reporting Standard (CRS) for the automatic exchange of financial information was implemented in 2017. The OECD has rated Luxembourg to be “fully compliant”, with the legal framework being “in place” and the effectiveness “on track””.” 58 Luxembourg is also a Member of the OECD/G20 Inclusive Framework on BEPS (Base Erosion and Profit Shifting) and has approved the July 2023 Outcome Statement on the Two-Pillar Solution to Address the Tax Challenges Arising from the Digitalisation of the Economy, which will ensure multinational enterprises are subject to a 15% minimum corporate tax. 59 4.2.2. Fraud Fraud in this section refers to a broad set of deceptive practices. Globally, private banks can be abused or misused to launder the proceeds of various types of fraudulent activity. These can range from simplistic frauds such as falsification, to more complex schemes, such as: Ponzi schemes: investment schemes in which money from new investors is used to provide a return/repayment to previous investors. Insider Trading: 60 an individual or group trade on the stock exchange to their own advantage through having access to confidential information. Advance fee fraud: a criminal offers a high reward in exchange for a fee to be paid in advance. Once the fee is paid, the criminal disappears. Forged invoices: E.g. invoices sent via electronic communication means are intercepted, the invoice details and payment account are modified, then the forged instructions are transmitted onwards to the recipient with a label “urgent”. An accompanying telephone call will highlight the urgency and leave the false impression of a verbal confirmation. Cyber Fraud: In particular, via phishing, which is a form of social engineering and scam where attackers deceive people into revealing sensitive information or installing malware “Traditional banks” designates banks that do not operate exclusively online. OECD Global Forum on Transparency and Exchange of Information for Tax Purposes, Peer reviews of the AEOI Standard’s implementation | READ online (oecd-ilibrary.org), 2022 59 OECD, 138 countries and jurisdictions agree historic milestone to implement global tax deal 60 In Luxembourg’s NRA, ‘Insider Trading’ is treated as a separate category of predicate offence. Here it is grouped alongside ‘Fraud and Forgery’ in the broad category of ‘Fraud’. 57 58 Page | 23 Private Banking Sub-Sector Risk Assessment 2023 such as ransomware 61. Phishing has become increasingly common via electronic communication means and platforms as a way to commit (online) fraud. CSSF has over the past decade also noted a consistently high number of fraud attempts over the internet by entities pretending to be licensed financial intermediaries or misusing the names of licensed financial intermediaries. These schemes involve criminals trying to attract customers through an interesting offer of investment services by reference to Luxembourg’s reputation as an international financial centre. Figure 6: Case study: Abuse of corporate assets 62 The following case study describes a technique of abuse of corporate assets involving a non-profit organisation (NPO), a commercial company (Company) and the private bank accounts of the Company’s ultimate beneficial owner (UBO). More specifically, suspicious transactions can be observed between the NPO paying substantial sums to the UBO’s personal bank accounts, as well as to the Company’s corporate bank account. The funds received from the NPO are the Company’s sole source of income. Moreover, no apparent link exists between the NPO’s activity and the Company’s official business purpose. Furthermore, outgoing payments to accounts of the UBO’s family are identified. The funds are then used for private purposes, like for example the purchase of different real estate properties or cars. The inflows observed on the NPO's bank account are exclusively donations paid in from foreign debit cards and allegedly relating to donations made for sick children. No outgoing transactions in connection with the fulfilment of the NPO’s purpose have been identified. Red flags: 61 62 • No online presence, website nor official listing of the NPO • Suspicious transactions between the UBO’s account, the Company and the NPO • No outgoing transactions in line with the NPO’s purpose Source: Wikipedia Case study provided by the CRF Page | 24 Private Banking Sub-Sector Risk Assessment 2023 • No incoming and outgoing transactions in line with the Company’s business purpose Figure 7: The COVID-19 crisis The COVID-19 crisis has given rise to specific fraud typologies. Criminals have tried in particular to exploit shortages of certain medical supplies to artificially inflate prices, deliver counterfeit products, obtain advance payment for products that were never delivered. Furthermore, the hurried transition to remote working and increased reliance on electronic communication have presented opportunities to bypass traditional fraud controls. According to the CRF, in 2020 COVID-19 related fraud attempts were mainly reported by online payment service providers 63. Fraud related to medical supplies was dominant and almost exclusively occurred during the first months of the crisis. This appears logical insofar as medical masks, disinfectants or test equipment were particularly scarce or inexistent in winter/spring of 2020 while at the same time seasonal effects increased the virus’ impact. In similar crisis situations, private banks, too, could inadvertently become involved in a fraudulent scheme driven e.g. by a new client whom they do not know very well yet. Any crisis situation typically implies the use of emergency measures and processes that deviate from established procedures and offer opportunities to criminals to bypass traditional, well-proven controls. Identifying a new client or the legitimate sender of an instruction can become more difficult. Private banks should draw conclusions from potential difficulties encountered during the COVID-19 crisis and ensure their crisis procedures incorporate mechanisms to compensate potential weaknesses. STR/SAR reporting over the years as well as CSSF supervisory experience show that fraud is a material ML threat for private banks in Luxembourg. Accordingly, fraud is not solely driven by predicate offences committed abroad. Furthermore, the international exposure and geographically diverse client base of private banks, the complexity and opacity of some products (e.g. wealth structuring activities) as well as the use of third parties and intermediaries are all factors which can create distance between the private bank and its clients and increase the difficulty for the bank to assess the legitimacy of the client and his business. Moreover, private banks are also exposed to internal fraud, e.g. by account managers exploiting internal control loopholes and falsifying client instructions or transaction records. When combined, all the abovementioned factors create opportunities for criminals to commit fraud in a private banking environment, and then launder the proceeds of these illicit activities through the bank and the financial system. 4.2.3. Corruption and bribery Corruption and bribery includes all relevant offences defined across Luxembourg’s Criminal Code, including domestic bribery (Articles 240 and 310 et seq.) and corruption of foreign public officials as defined in Article 252. 64 Corruption and bribery undermines the rule of law and is often linked to political instability and human rights abuses. According to the UN Development Programme, of the approximately USD 13 trillion that governments spend on public spending, up to 25 percent is lost to corruption. 65 CRF, Annual Report 2020, 2021 Luxembourg, Code pénal (Note, the Luxembourg Criminal Code does not establish quantitative or qualitative limitations on facilitation payments. The analysis regarding a qualification as bribery is made on a case-by-case basis). 65 UN Development Programme, The cost of corruption, 2022 63 64 Page | 25 Private Banking Sub-Sector Risk Assessment 2023 In Luxembourg, the primary exposure of private banks relates to foreign corruption and bribery. This is due to the limited size of the country and the domestic market, the international nature of the sub-sector’s activity, the concentration of wealthy and politically exposed clients, and the involvement of third parties and intermediaries. According to the CRF, “declarations received by the CRF often relate to primary offences committed abroad”. 66 Although much more limited, private banks should remain watchful also in their domestic relationships. The nature of these exposures is exemplified in the case studies below. Figure 8: Case study: Money laundering in Luxembourg of a predicate offence committed abroad 67 This case study is based on allegations of embezzlement of public funds, illicit enrichment and money laundering related to a foreign PEP and beneficial owner of several holding companies under Luxembourg law holding, together with family members and close associates, business relationships with several local banks. Most of the funds held on the accounts in Luxembourg were initially transferred from foreign bank accounts, either private accounts or corporate accounts of offshore companies belonging to the group of suspects, and invested in real estate properties around the world. A contract suspected to be without economic reality permitted the arrival of several million USD on European accounts of a company, whose beneficial owner was a family member. The funds were then allegedly channelled to other accounts in Europe, then to accounts in non-EU jurisdictions and back to European bank accounts of companies linked to the beneficial owner and his entourage. The Luxembourgish bank accounts were mainly used as transit accounts shifting funds from nominative or corporate bank accounts held in foreign jurisdictions to further bank accounts opened in other foreign jurisdictions. The purposes of the transfers were mainly in relation with advanced payments or loans provided to companies of the group. Red flags: 66 67 • Pass-through accounts • The subject in the transaction was a foreign PEP, family members or close associates and received and/or sent unusually large amounts of funds in different currencies • Funds received in bank accounts of persons, legal entities, or legal arrangements with no visible connection to PEPs, or other officials, but known to be controlled by such (via frontman, strawman) • Misrepresentation and/or inconsistency (with client profile and/or source of revenues) between the declared source of wealth of a PEP, his/her family members or close associates • A transaction or financial activity, which involves foreign nationals with no relevant link to the country where the transactions took place • Financial flows, which reveal complex financial mechanisms and involvement of multiple layers of foreign legal entities or arrangements • Open-source information relating to ongoing investigations into individuals and concerns about corruption. CRF, Annual activity reports. Applies to all sectors and all declarations. Case study provided by the CRF Page | 26 Private Banking Sub-Sector Risk Assessment 2023 Figure 9: CSSF thematic review: Suspicious transactions involving the Estonian branch of Danske Bank A/S 68 Following the publication of media reports about significant volumes of suspicious transactions involving the Estonian Branch of Danske Bank A/S (Danske Estonia), CSSF contacted a number of banks to obtain more information on
(1)potential transactions with Danske Estonia;
(2)banks’ conclusions from their own investigation of their monitoring of these clients and transactions; and
(3)any actions taken or proposed to be taken as a result of their investigation. The main purpose of CSSF’s intervention was to ascertain whether banks had respected their professional obligations and monitored their clients and transactions adequately. Banks were also requested to review the effectiveness of their processes and procedures to ensure they were adequate to detect similar risks going forward. CSSF’s work showed that (consistently with the NRA), Luxembourg’s banking sector is exposed to ML/TF risks from its international clientele and the high volume and frequency of cross-border flows. Findings and Conclusions: As an international financial centre with a high degree of expertise as well as political and economic stability, Luxembourg is attractive for wealthier clients aiming to protect their assets. CSSF’s work has shown that this applies in particular also to high-risk clients from jurisdictions lacking those qualities, but that are known e.g. for a high degree of corruption. These wealthy, high risk clients often set up multiple accounts with multiple banks and are introduced to these banks through intermediaries. They often seek out private banking departments of banks, even when their banking activity can be very transactional, complex and difficult to assess. Private banks (as well as all other banks) must operate under a clearly defined ML/TF risk appetite, ensure their risk-based approach considers all relevant risk factors and weighs them appropriately (in particular those inherent to clients and geographical origin of assets). Undervaluing client risk typically leads to insufficient due diligence and monitoring measures being applied, exposing the bank to financial sanctions and reputation risk. The threat from corruption of domestic origin is deemed to be comparatively low in Luxembourg. 69 Transparency International ranks the country 10th out of 180 in its Corruption Perception Index (although the country’s rank and score have slightly dropped in 2022 as compared to previous years), and the World Bank ranks Luxembourg 9th in its Controls of Corruption Estimate. 70,71 Overall, when looking solely at STR/SAR reporting over the years, the threat from corruption would appear to be lower for private banks than the threats driven by tax offences or fraud. According to the CRF however, while sometimes all money laundering indicators point to corruption, it can be difficult to prove the link with the underlying primary offence and the declaration could be classified by the CRF as “money laundering” or “other” 72, while nevertheless the laundering of corruption monies remains a very real threat for Luxembourg. The amounts involved in foreign corruption can be important, just as the publicity received by those cases and the reputational damage they create. Also, foreign predicate offences increase detection and verification difficulties because of the CSSF thematic work, 2019 NRA, 2018 70 Transparency International, Corruption Perception Index, 2022 71 World Bank, Data Bank: Worldwide Governance Indicators, Control of Corruption, 2021 72 CRF, Annual activity report 2021-2022, 2023 68 69 Page | 27 Private Banking Sub-Sector Risk Assessment 2023 dependency of information from sometimes remote countries and foreign press articles, therefore private banks should remain cautious and readily declare suspicions to the CRF. 4.
  1. TF threats in private banking 4.3.
  2. Situation in the European Union Terrorist financing refers to the financing of terrorism, terrorist acts, terrorists and terrorist organisations. It encompasses the raising, movement and use of funds by terrorist actors or terrorism sponsors and financiers and is considered as one of the most important threats to global security. 73 The SNRA continues to assess TF risk in the private banking sector as non-relevant. However, it admits the possibility that wealthy terrorism sponsors might use private banking services in the EU to manage on their behalf assets not directly related to, or intended for, the financing of any terrorist activities
  3. Table 5: SNRA analysis of ML/TF risk in private banking, 2017 - 2022 Statistics on the number of terrorist attacks that were prevented or failed, as well as arrests linked to terrorism financing compiled by Europol 75 show a declining trend since 2019, with Islamist terrorism remaining a more likely threat for EU Member States than right- or left-wing terrorism. Out of a total of 388 terrorism related arrests reported by Member States in 2021, only 14 were made in relation to the financing of terrorism
  4. Across the EU, individual donations remain one of the primary means of funding for terrorist and violent extremist organisations, and Non-Profit Organisations (NPOs) and charitable organisations continue to be used by terrorist organisations and sponsors to obtain donations. Although crowdfunding and online payment and money value transfer services seem to attract a growing interest, the traditional banking system and smurfing techniques remain a frequent choice for transferring funds across borders. 4.3.
  5. TF exposure of private banking in Luxembourg Luxembourg private banks’ potential exposure is driven by the relative importance of the sector, its international nature and clientele as well as the general banking ability to facilitate rapid cross-border flows of large sums of money. In line with the NRA, the most relevant risk driver for the banking sector as a whole is the cross-border movement of funds. Terrorist actors could misuse/abuse banking products 73 FATF, International standards on combating money laundering and the financing of terrorism and proliferation – the FATF recommendations, 2012 74 European Commission, Commission staff working document accompanying the REPORT FROM THE COMMISSION TO THE EUROPEAN PARLIAMENT AND THE COUNCIL on the assessment of the risk of money laundering and terrorist financing affecting the internal market and relating to cross-border activities, 2022 75 Europol, European Union Terrorism Situation and Trend Report 2022, 2022 76 Europol, European Union Terrorism Situation and Trend Report 2022, 2022 Page | 28 Private Banking Sub-Sector Risk Assessment 2023 and services, for example by opening a current account and using the associated debit card to withdraw funds oversees (e.g. in a conflict zone or where an attack is planned). The low value nature of such activity makes it difficult to detect, with research showing that 75% of violent extremism cases in Europe between 1994 and 2013 cost less than USD 10,
  6. 77 The limited cost of terrorism acts makes retail and online banks more suitable to be misused for this purpose. In private banks, the close relationship between the client and the bank, the high entry thresholds, the longer-term view on investments, the particularly high level of due diligence and the specific nature of transactions (high value, but low numbers facilitate a closer scrutiny) make them an unlikely and unsuited target for the financing of (low value) terrorist support or acts. Luxembourg private banks also have a traditional operating model, preferring direct contact and face-to-face relationship management over solely online identification and communication methods. In accordance with the SNRA, Luxembourg private banks could in theory be exposed to TF risk driven by wealthy individuals or organisations that act as terrorism sponsors or are suspected to support terrorist organisations, and who invest money not directly linked to, or directed at, the financing of terrorism, via their accounts held with a private bank. This risk could be particularly high with clients such as legal entities or arrangements, or even NPOs, where beneficial ownership and the exact nature and purpose of their activity can be more difficult to establish. An initial review of the financial flows of Luxembourg private banks with jurisdictions presenting a higher potential risk of involvement in terrorist financing has not shown any obvious exposure. This has likely to do with banks’ awareness of TF risk and their Europecentric client base. The share of clients from across Europe and in particular the EU, has over the past years represented over 80% of the sub-sector’s total client base, while the share of client relationships originating from jurisdictions considered high risk for the purpose of ML/TF has consistently remained below 0.5%. 78 In a second phase, CSSF has now launched a more focussed, risk-based analysis of selected banks and flows across all sub-sectors, to achieve a more granular assessment of any potential TF threats. CSSF’s supervision, rigorous market access controls and preventive as well as repressive measures have done their part to minimise risk. The fines imposed by CSSF on banks over the past years, many of which were related to CDD deficiencies, have resulted in banks enhancing their CDD processes further, especially the initial due diligence and risk assessment for higher risk clients. Discussions at the EWG PB show that private banks are today very aware of the risk represented by their increasingly HNW/UHNW client base. Other elements explaining the absence of a material exposure to TF in private banking in Luxembourg, are the products offered and the nature of private banking transactions. Private banks in Luxembourg do currently not offer virtual assets or similar high-risk products. The preferred service offered by private banks is portfolio management. Discretionary portfolio management brings the clients’ assets under control of the bank, in line with a signed mandate, so that the clients cannot dispose freely themselves of their assets under management with the bank. As regards cross-border transactions, while transaction sizes in private banking are large, owing also to the increasing share of HNW/UHNW clients, the number of transactions is much lower than in retail banking, enabling private banks to perform more intrusive investigations on the origin and destination of fund flows during the in- and outflow phases. In light of the preceding, the type of banking activities most exposed to TF risk would be those of online banks, as well as retail and business banks, rather than private banks. CRF 77 78 Forsvarets Forskningsinstitutt, Oftedal, Emilie, The financing of jihadi terrorist cells in Europe, 2015 CSSF & ABBL data, 2021 & 2022 Page | 29 Private Banking Sub-Sector Risk Assessment 2023 statistics and conclusions indeed show that the vast majority of TF related declarations are made by the online and non-bank sectors. As regards traditional banks, while the number of TF related declarations has generally declined in recent years, it is retail and business banks that file most declarations, whereas the number of declarations made by private banks is almost non-existent. 79 This picture is aligned with the general assessment that private banks’ exposure is not exposed to terrorism financing transactions, but rather to wealthy terrorism sponsors that might invest their assets not directly related to terrorism with private banks. 80 Hence, private banks’ detection of TF-linked transactions will be limited and their efforts focussed more on carrying out strong due diligence, monitoring sanctions and black lists, and screening the media for the names of their clients. Therefore also, any declarations based on those screening results should not be considered pure defensive reporting. The CRF received a total of 454 TF related declarations in 2020, 321 in 2021 and 220 in 2022 (TFAR and TFTR combined). Within the above totals, traditional banks generated 40 declarations in 2020 (5 by private banks), 15 in 2021 (none by private banks) and 10 in 2022 (only 1 by a private bank). 81 While the number of yearly declarations appears to be decreasing, as also identified by Europol, it remains to be seen if this trend will continue through 2023 and 2024 in light of more recent geopolitical instability and armed conflicts. As a conclusion, while there is today no strong indication that private banks in Luxembourg are particularly exposed to TF risk, they are well advised to remain cautious and continue monitoring not only sanctions lists, but also other public “black” lists as well as negative press closely, as these are key sources for their TF prevention. Figure 10: Case study: Luxembourg banks’ exposure to terrorism financing 82 A suspicious wire transfer from a Luxembourgish bank account held by a foreign citizen to a non-EU country account was reported to the CRF. The suspicions were mainly based on press articles related to raids in an EU Member State targeting two NPOs. The NPOs were suspected of aiding a religiously motivated terrorist group under the guise of humanitarian aid. As a result of these press articles, the reporting entity had placed the bank accounts belonging to those NPOs on an internal "blacklist". It turned out that the beneficiary account of the above-mentioned wire transfer matched one of the blacklisted bank accounts. CRF, Annual Report 2021-2022, 2023 See also SNRA and Luxembourg’s Vertical risk assessment on terrorist financing, published in 2022: https://mj.gouvernement.lu/en/dossiers/2020/lutte-blanchiment/evr.html. 81 CRF, Annual Reports 2020 and 2021-2022, 2023 82 Case study provided by the CRF 79 80 Page | 30 Private Banking Sub-Sector Risk Assessment 2023
  7. INHERENT RISK – VULNERABILITY ASSESSMENT This chapter evaluates how vulnerable the core and ancillary activities of private banking identified in Section 3.1 are to ML risks. Overall, the activities of the sub-sector are considered inherently high risk. 83 Table 6: Summary of ML/TF inherent risk – vulnerability assessment Sub-sector Private Banking Inherent Risk High Inherent Risk Activities Asset management Ancillary services Custody assets of financial High Investment services Medium-High Current account banking High Credit solutions High Wealth structuring High Insurance solutions Medium-High The vulnerability assessment considers five risk factors:
(1)Clients and geography;
(2)Intermediaries;
(3)Market structure;
(4)Activities and products; and
(5)External advisors, and analyses how these five risk factors influence the ML/TF risk in the two core and six ancillary activity categories. 5.
  1. Risk factors impacting private banking activities in Luxembourg 5.1.
  2. Clients and geography Risks linked to ‘clients and geography’ impact all private banking activities. The large client base (in excess of 150,000 accounts according to ABBL) and the increasing share of more sophisticated HNW/UHNW clients also increase the ML risk of private banking in Luxembourg. According to the ABBL, UHNW clients with AuM exceeding EUR 20 million represented in 2022 close to 60% of all private banking AuM in Luxembourg, whereas in 2011 this client category represented 41% only. At the other end of the spectrum, affluent clients with AuM of less than EUR 1 million saw their share decrease from 24% to only 7% in
  3. While affluent clients still represent the majority of private banking clients in number, they hold a minority of total AuM in Luxembourg. 84 A non-negligible (albeit decreasing) share of private banking clients in Luxembourg are legal persons or legal arrangements. The use of more complex, international ownership structures (e.g. to facilitate investing or wealth structuring and ensure privacy to especially Note, this risk assessment uses a four-point scale (High, Medium-High, Medium-Low, Low) compared to the five-point scale used in the NRA (Very High, High, Medium, Low, Very Low). The conclusions of this risk assessment and the NRA are therefore in line. 84 ABBL & CSSF data, 2013-2022 83 Page | 31 Private Banking Sub-Sector Risk Assessment 2023 HNW/UHNW clients) can also decrease transparency regarding beneficial ownership. Multiple corporate layers or legal structures that potentially obfuscate beneficial ownership can increase ML/TF risks for private banks as they may have difficulty in ensuring full visibility on beneficial ownership. In terms of geographical origin, according to the KPMG-ABBL survey and CSSF internal data, the majority of AuM belongs to clients from Europe, but outside Luxembourg. This may complicate the identification of beneficial owners and the origin of their wealth. Approximately one fifth of private banking AuM belong to Luxembourg accountholders. 85, The diverse, international clientele reflects the attractiveness of Luxembourg as an international private banking centre, but it can also decrease the level of transparency on the funds invested in the sub-sector. Private banks themselves rate a considerable share of their clients high ML/TF risk. The percentage of clients rated high risk is higher than in other banking sub-sectors and represents about 20%. 86 Clients that are residents of high risk or non-CRS participating jurisdictions, or whose wealth originates in high-risk jurisdictions or high-risk industries, can increase ML/TF risk (e.g. as concerns tax crimes or corruption) for the bank. While the number of those clients is very low, their impact on the sub-sector’s reputation can be disproportionate. CSSF’s analysis and supervisory experience, including from onsite inspections, shows that the ‘clients and geography’ category represents the most important risk driver in private banking. This conclusion comes hardly as a surprise: private banks’ clients largely determine the ML/TF risk, through their past and current activities and actions, the source and origin of their wealth, their business relationships and affiliations. Accordingly, it’s on initial and ongoing due diligence that banks need to focus to a large extent their AML/CFT compliance efforts. 5.1.
  4. Intermediaries A number of banks use intermediaries in providing private banking activities. This assessment identifies 3 sub-categories of intermediaries used by private banks and their clients: business introducers, POA-holders and third-party managers. Whilst the number of accounts and volume of transactions that involve these categories of intermediaries is not especially high, their involvement can increase the distance between the bank and its client and hence complicate initial as well as ongoing due diligence. Transparency on beneficial ownership or source of wealth can be reduced and therefore exposure to threats such as tax crimes, corruption or fraud may increase. Business introducers help private banks acquire new clients and grow their AuM. They can be licensed or registered professionals (such as tied agents), supervised for AML/CFT purposes, be part of the same group, and/or bound by a commercial agreement. Approximately 15% of private banks are working with business introducers who assist the bank in performing CDD obligations
  5. As a result of this intermediation between private banks and their clients, level of transparency and direct interaction with clients and beneficial owners may decrease, potentially reducing banks’ knowledge about their clients. Similarly, the presence of POA-holders with signatory authority over a client’s account and acting on behalf of the client may limit the direct contact between the client and the bank, making it more difficult to “know the client” or understand his/her transactional account behaviour. POA-holders may be from any jurisdiction and there are no mandatory KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 CSSF internal data, 2022 87 CSSF internal data, 2021 85 86 Page | 32 Private Banking Sub-Sector Risk Assessment 2023 requirements of supervision or registration, nor even professional qualifications, which may further increase risk. Third-party managers act on behalf of their clients. Their clients’ assets may be held in an omnibus account with the bank, where the bank has a limited relationship with the thirdparty manager’s clients. The bank may perform certain contractual tasks on behalf of the third-party manager in accordance with a bi- or tripartite agreement, and must comply with its own legal obligations, e.g. in relation to sanctions lists screening and transaction monitoring. Sometimes clients may agree to move assets to an account in their name at a particular private bank on condition that these assets will continue to be managed, in part or in whole, by a dedicated external asset manager. In this latter case, the bank has a direct relationship with the client. The presence of a third-party manager limits face-toface interactions between the private bank and its client and may reduce the bank’s knowledge of the client, his global investment strategy, portfolio of investments, history of business activities and transactions. On the other hand, since third-party managers are authorised and supervised, they may provide an additional level of ML/TF control (as they will have their own AML/CFT obligations in respect to their clients). 5.1.
  6. Market structure According to the KPMG-ABBL survey "Clarity on performance of Luxembourg private banks”, the private banking sub-sector in Luxembourg accounted for EUR 585 billion AuM at the end of
  7. 88,89 Private banks in Luxembourg have a wide variety of sizes and business models. Not all of them are solely focused on private banking, many banks have a mixed service offer. Most banks offering private banking services are part of, and can count on the support of, European or international groups. There are some large actors, but also a (decreasing) number of smaller institutions competing for a share of the market. 90 Smaller or standalone private banks typically have less resources at their disposal, potentially resulting in less sophisticated AML/CFT controls. Not being part of a group means not being able to rely on the group’s support, expertise, policies, processes, and international network. The 2022 KPMG-ABBL survey has estimated that, in order to remain economically viable, a private bank must today have a minimum of EUR 10-12 billion in AuM, up from only EUR 5 billion some years back. The study also showed that, as could be expected, larger institutions cope significantly better with rising (regulatory) costs than the smaller ones. This may impact on the risk appetite and exposure of smaller private banks that could be inclined to accept higher risks. Additionally, smaller private banks may have less sophisticated AML/CFT controls in place (e.g. transaction monitoring systems) than their larger peers, making the monitoring and detection of suspicious account movements initiated by the client (e.g. in relation to bribery and corruption) more difficult. 5.1.
  8. Products and services The typical service offer of private banks comprises custody and investment services as well as ancillary products and services relating to current account management and KPMG-ABBL, Clarity on performance of Luxembourg private banks, 2023 Note, private banking can be defined as an activity across all banks, or as the group of those banks offering mainly private banking services. The resulting statistics would differ slightly. 90 CSSF internal data, 2021 88 89 Page | 33 Private Banking Sub-Sector Risk Assessment 2023 payments, loans and credit lines, life/non-life insurance, wealth structuring and tax and inheritance planning. Custody services and products inherently have a low exposure to ML/TF, since such services are mostly commoditised and standardised (e.g. custody of shares, dividend and interest payment collection and distribution). However, ML/TF risks may arise due to activity volumes, remote nature of the services, in relation to asset ownership (CDD) or transactions (upon entry/exit of assets). Investment advisory services include the provision of advice related to more or less standardised investment products available from or through the bank, or schemes that are tailored to the needs of the client. It is difficult to conceal illicit activities through standardised products. However, the vast majority of assets under management in Luxembourg are increasingly held by European HNW/UHNW clients; these clients typically require more complex advisory services and investment solutions (e.g. access to specific corporate and legal structures, alternative/specialised investment funds and/or remote markets) than less wealthy clients with more mainstream investments (e.g. public investment funds with risk diversification requirements such as UCITS). Discretionary asset management services have a moderate ML/TF exposure, because investments are typically in products that are relatively transparent (e.g. listed stocks and investment funds) and have been reviewed and approved by the bank, who also takes the investment decisions. The bank’s investment decisions follow a pre-agreed investment strategy, clients cannot give direct buying orders. Performing and disguising illicit activities within the management mandate is therefore difficult. ML/TF risk is mostly concentrated around in- and outflows, which must be scrutinised by the bank. Current account and payment services are highly standardised. They are significant in volume and typically allow clients to transact on their own, via electronic banking, which may increase ML/TF risk because of the absence of control by a relationship manager. Although cash withdrawals and deposits still are a common method of ML/TF due to the anonymity provided by cash and the difficulty of monitoring for suspicious activity 91, major cash deposits and withdrawals are today a rare occurrence in Luxembourg private banks. Electronic payment services are also highly exposed to ML/TF. Whilst private banks are legally obliged, and able to trace the direct recipient/sender of payments, the increasing volume of funds transferred electronically makes illicit funds increasingly difficult to detect. 92 The often cross-border nature of payments further increases risk. Prepaid cards can serve as substitutes for current accounts and facilitate the transportation of cash across borders. Loans are part of the standard service offer of any bank. They can also be a selling argument to attract new clients and an area for competition among banks. ML/TF risks are typically higher for credit solutions unrelated to (discretionary-managed) investment portfolios at the bank, especially when these loans involve external parties and crossborder business transactions. Credit solutions could for example be obtained by pledging illicit assets as collateral. 93,94 The bank would seize the collateral and sell it if the client defaults on its loan repayment. When credits unrelated to investment services are backed with collaterals from foreign or even offshore jurisdictions, it will become more complex for private banks to assess the origin of funds at the basis of the pledged assets (as detailed in the typology below). 91 Multiple case studies explain how cash from illicit proceeds may be placed in a bank through cash deposits in the report: FATF, Money Laundering through the Physical Transportation of Cash, October 2015 92 FATF, Money Laundering using New Payment Methods, 2010 93 Note however that all authorised professionals are required by law to obtain all necessary information regarding the origin of the customer’s source of funds (see AML/CFT Law, Article 3.2.c and CSSF Regulation 12-02, Article 24). 94 A collateral is an asset that a lender accepts as a guarantee for a loan. This collateral may be pledged deposits, pledged liquid assets or tangible assets (e.g. a property). Page | 34 Private Banking Sub-Sector Risk Assessment 2023 Moreover, clients could use repayment of their loan as a justification to transfer funds of illicit origin deposited in offshore jurisdictions to their accounts in Luxembourg. These funds could be used to repay the principal and interest of the loan. In contrast, loans granted to improve portfolio returns (e.g. investment lines, margin lending) are less exposed to the above ML/TF risks. Margin lending mostly answers short and medium-term treasury needs linked to a client’s strategy for optimising portfolio returns. The risk is particularly low when the portfolio is managed by the bank under a discretionary mandate. The repayment of principal and interest typically derives directly from portfolio returns, and not from an external source of funds. Moreover, the assets in the portfolio typically serve as guarantee for the credit line, often without need for additional collateral. The typology below illustrates how credit solutions unrelated to investment service activities (in this case an international mortgage) could, hypothetically, be abused for laundering illicit proceeds used as collateral. Figure 11: Typology: Use of a loan & collateral to launder illicit funds The following example illustrates how credit solutions can be abused or misused to launder collaterals generated from illicit activities. The following steps may occur:
  9. Mr X and Mr Y create an offshore company A with nominee directors. Company A is in an offshore jurisdiction 95 with strict bank secrecy which is not a member of the Common Reporting Standard. Mr X and Mr Y (owners of Company A) use a TCSP to manage Company A. Their control over Company A is not disclosed.
  10. Company A opens an account with Bank 1 in the offshore jurisdiction and deposits illicit funds into the account.
  11. Mr X has an account at a Luxembourg-based private bank (Bank 2). Mr X asks Bank 2 for a new loan to invest in a licit real estate project.
  12. Bank 2 is reluctant to provide the loan to Mr X as the value of the assets deposited on his account in Luxembourg is not high enough to grant the loan. Bank 2 requests a guarantee to Mr X.
  13. Mr X arranges for Bank 1 (through Company A) to provide a bank guarantee to Bank 2, which could be drawn by Bank 2 on Bank 1 in case of a default on the loan. Bank 1 takes a pledge on company A’s deposit. The money deposited in Bank 1 originates from the illicit activities of Mr X and Mr Y. If Bank 2 were to call on the guarantee from Bank 1, Bank 1 would use the deposit pledged by Company A to settle the payment with Bank
  15. Bank 2 lends the money to Mr X. Bank 2 only sees Bank 1’s guarantee, not the individuals controlling Company A – it is therefore difficult to establish the true origin of the source of funds. Through the loan by Bank 2, Mr X can provide a valid explanation for the money used to finance the real estate investment. Mr X initially makes loan and interest payments to Bank 2 using income from the licit real estate investment.
  16. After a few payments, Mr X stops paying the payment of the principal and the interest on the loan; and
  17. Based on the loan agreement and the banking terms, Bank 2 calls on the bank guarantee from Bank
  19. Bank 1 uses the pledged deposit to settle the payment to Bank
  20. Mr X keeps the clean money from the loan. Hence, the pledged deposit is laundered. Offshore companies “apply to the situation where a company is incorporated in one jurisdiction for persons who are resident in another jurisdiction”, FATF, ML&TF through the real estate sector,
  21. 95 Page | 35 Private Banking Sub-Sector Risk Assessment 2023 Wealth structuring (including tax and inheritance planning) comprises services for advising on the client’s global investment strategy and on the most appropriate legal or corporate structure to fit the client’s needs for asset protection, succession planning and tax planning. It is especially important to HNW/UHNW clients and includes creating bespoke personalised investment schemes. Wealth structuring is offered by some private banks, but more often involves external advisors. The complex nature of wealth structuring services significantly increases the vulnerability of these activities to ML/TF. Complex and sometimes opaque wealth structuring products (such as tailor-made vehicles and legal structures) can be used both to conceal the proceeds of crime (e.g. proceeds from bribery and corruption) and to enable economic crimes themselves (e.g. tax crimes). They also can be difficult to assess and monitor from an AML/CFT perspective, for example if beneficial ownership is concealed through layers of legal structures in a bespoke personalised investment scheme. When a private bank is not providing these services itself, it can still be exposed to related ML/TF risks, because of the client accounts held and the transactions processed. The level of ML/TF risk could even increase for the bank, because not being directly involved in the creation of any structures or schemes can limit a bank’s knowledge and understanding of them. On the other hand, this type of services is typically used only by a limited number of HNW/UHNW clients because of the cost involved for counselling services and the creation and maintenance of the underlying structures. Private banks are also well aware of the increased ML/TF risk presented by these clients and their more sophisticated setups. Insurance products are generally less flexible than most other financial services (e.g. loans, payment services) as they often pay out against pre-defined events (e.g. death or accident) and require more specific knowledge than banking services. However, insurance products can be vulnerable to ML/TF risks when they have flexibility of payment, flexibility of investment, ease of access to accumulated funds, negotiability (i.e. can be used as collateral) and anonymity. 96 96 NRA, 2020 Page | 36 Private Banking Sub-Sector Risk Assessment 2023 Private banks are not the issuer of insurance but can act as intermediaries (insurance distributors) when they have been authorised to do so by the supervisory authority of the insurance sector in Luxembourg (CAA). Non-life insurance solutions are considered to hold a low ML/TF risk. The non-life subsector offers standard low-risk products, is smaller and less international than the life insurance sub-sector. 97 Life insurance products are considered to be the most exposed products of the insurance sector. Known money laundering techniques used include retracting from a contract shortly after its signature and requesting a refund of the premium already paid, payments to/from third parties, paying a large top-up shortly before the end of the policy, cashing out of policies prematurely despite high penalties, or using them as a collateral in a setup similar to Figure
  22. However, life-insurance products are typically structured by licensed insurance companies with whom private banks cooperate and who are subject to AML/CFT obligations (including with regard to CDD) identical to those applicable to banks. Overall, the vulnerability of Luxembourg’s insurance sector is considered to be medium, owing in particular to its considerable size and growth in recent years. 98 5.1.
  23. External advisors In Luxembourg, the amount of wealth structuring services offered by private banks themselves is limited since international and large HNW/UHNW clients often require specialist advice and know-how and use their own advisors. Wealth structuring may also be performed by an affiliate company of the Luxembourg private bank or its parent. External advisors are typically chosen for their financial, legal or fiscal expertise. The use of advisors may increase complexity of the investment schemes or decrease direct interaction between private banks and their clients and ultimate beneficial owners. For instance, when private banks themselves are not at the origin of the credit schemes, the client’s rationale for requesting the loan can become more difficult to assess, reducing the possibility to detect ML/TF. Wealth structuring involves specialists such as TCSPs and legal experts, who set up legal entities or legal arrangements including add-on services such as representation, domiciliation, fiduciary/trustee service or tax strategies, while notaries may help configure real estate investment schemes. 97 98 NRA, 2020 NRA, 2020 Page | 37 Private Banking Sub-Sector Risk Assessment 2023
  24. MITIGATING FACTORS AND RESIDUAL RISK ASSESSMENT The purpose of this section is to identify and assess the mitigating measures in place to reduce ML/TF inherent risk. The section is divided into three sub-sections: • Risk mitigation by private banking professionals can be grouped into four main areas:
(1)Internal ML/TF risk assessment and risk appetite;
(2)customer due diligence (including ongoing due diligence) and individual risk assessment;
(3)cooperation with competent authorities; and
(4)internal organisation, governance and controls, suitability, and training. • Risk mitigation by CSSF can also be broadly categorised into four areas:
(1)promotion of understanding of ML/TF risks (e.g. via publications and regular communication with the private sector);
(2)market entry controls, including licensing, qualifying holding and fit & proper processes and procedures;
(3)off- and onsite supervision; and
(4)enforcement of compliance with AML/CFT obligations (e.g. administrative measures and fines). • Most frequent off- and on-site findings: Typical weaknesses identified during onand offsite supervision include insufficient documentation, lack of critical analysis with respect to the plausibility of some transactions or the origin of wealth/funds, and late or no reporting to the FIU. Whilst new potential threats have emerged since the first PBSSRA published in 2019 and some areas for improvement can still be identified in private sector controls, the combined efforts of CSSF and the private sector have nevertheless allowed private banks to maintain a residual risk level of medium-high. 99,100 6.1. Risk mitigation by private banking professionals Private banks’ mitigating measures have been grouped hereafter in four main areas:
(1)ML/TF risk assessment/risk appetite;
(2)customer due diligence and risk assessment;
(3)internal organisation, governance, training and fitness and propriety; and
(4)cooperation with competent authorities. The nature of these mitigating factors is outlined at a highlevel below. 101 6.1.1. ML/TF risk assessment/risk appetite All professionals including private banks are required by law to identify, assess and understand their ML/TF risks 102 based on their clearly defined risk appetite, having considered also relevant conclusions from the EC’s SNRA, the NRA, and the PBSSRA. Overall, Luxembourg private banks have implemented risk assessments that are 99 The NRA considers the private banking sub-sector to be inherently “very high” risk. This is because in the NRA, risks are ranked on a five-point scale (Very High, High, Medium, Low, Very Low). This risk assessment uses a four-point scale (High, Medium-High, Medium-Low, Low) and therefore the “high” inherent risk assessment is compatible with the conclusions of the NRA. 100 The level of residual risk is determined by reducing the level of inherent risk by an amount commensurate with the strength of mitigating factors. If residual risk and inherent risk are the same, this does not mean that there are no mitigating measures in place (only that mitigating measures do not reduce inherent risk substantially). 101 The description of mitigating factors reflects observed practice and is not intended to be exhaustive. 102 Article 4, CSSF Regulation 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended by CSSF Regulation No 20-05 of 14 August 2020. Page | 38 Private Banking Sub-Sector Risk Assessment 2023 appropriate considering their level of exposure and risk appetite. The number of related findings identified during CSSF onsite inspections carried out in 2020-2021 is very low. 103 6.1.2. Customer due diligence and individual risk assessment Private banks apply a number of measures to assess and control the individual risk linked to each customer or group of customers. These include the CDD process at onboarding (which often involves an “acceptance committee”) and ongoing due diligence throughout the business relationship. Customer due diligence 104 When customers are onboarded, private banks assess the ML/TF risk and conduct a due diligence process (CDD), applying their risk-based approach. They identify the customer and verify his identity using reliable and valid documents and data from independent sources. They also identify the beneficial owner and obtain information on the purpose and intended nature of the business relationship as well as the source of wealth. This process involves screening against PEPs, sanctions lists and other public information available (e.g. on the internet), as well as typically database information acquired from commercial sources (e.g. WorldCheck). Where ML/TF risks are higher, an enhanced due diligence (EDD) with additional verification measures may be performed. Enhanced CDD is legally required in the cases specified in article 3-2 of the AML/CFT Law, including business relationships and transactions with natural and legal persons from higher risk countries as well as PEPs. In certain circumstances (e.g. in relation to PEPs or cross-border correspondent relationships), senior management approval is legally required before establishing the business relationship. For many private banks, acceptance of new customers also requires written authorisation from a manager or specifically appointed internal body. This ensures decision-making is made by those with appropriate seniority and allows for the intervention of AML/CFT compliance officer(
  1. s)where appropriate. In certain cases, a specific acceptance committee provides the authorisation. These committees are composed of individuals from different departments within the organisation (e.g. executive management, sales, legal, compliance) and ensure a range of perspectives are incorporated into decisions to authorise new relationships. Where third-party professionals are used by private banks to conduct CDD, they must abide by all the professional obligations enshrined in the AML/CFT Law. 105 Whilst such third-party professionals can come from outside Luxembourg, private banks are obligated to ensure they meet the conditions prescribed by law, and must not rely on those professionals that are established in third countries and do not (or insufficiently) apply AML/CFT measures. Additionally, any private bank using an external service provider for CDD services must draw up a contract setting out the service provider’s detailed obligations and enforce appropriate monitoring of the service provider’s compliance, while the responsibility remains entirely with the bank. The creation in 2019 of a register of beneficial owners of entities registered on the trade and company register, as well as the creation in 2020 of a register of fiducies and trusts recording the settlors, trustees, fiduciaries, protectors, beneficiaries or classes of CSSF internal data, 2020-2021 Note, this is sometimes referred to as completing “Know Your Customer” (KYC) checks. 105 The AML/CFT Law defines third parties as professionals (as listed in Article 2), the member organisations or federations of those professionals, or other institutions or persons situated in a Member State or third country that: (
  2. a)apply customer due diligence requirements and record-keeping requirements that are consistent with those laid down in this law and in Directive (EU) 2015/849; and (
  3. b)have their compliance with the requirements of this law, Directive (EU) 2015/849 or equivalent rules applicable to them, supervised in a manner consistent with Chapter VI, Section 2 of Directive (EU) 2015/849. 103 104 Page | 39 Private Banking Sub-Sector Risk Assessment 2023 beneficiaries and any other natural person exercising effective control over, or benefitting from a trust or fiducie, have provided banks with additional means of corroborating beneficial ownership of legal entities and arrangements, but also created an obligation for them to maintain the register data on their eligible clients and beneficiaries up-to-date. 106 Ongoing due diligence In addition to CDD/EDD at onboarding, private banks also conduct ongoing due diligence on the business relationship. This includes ensuring that documentation and data collected during CDD/EDD is kept up to date, as well as conducting periodic due diligence on existing client relationships on the basis of materiality and risk (e.g. rescreening new/changed client data against sanctions, PEP and other high-risk lists during periodic and event driven reviews). Banks also monitor transaction activity and screen accountholders, related parties, beneficiaries and transaction data against various sanctions lists. They keep all necessary records on transactions (both domestic and international), as well as records obtained through CDD measures, account files and business correspondence, and any analysis undertaken in accordance with legal retention requirements. The due diligence of clients at onboarding and on an ongoing basis is aided by the majority of private banks making use of the “dedicated banker” principle (“banquier attitré”). Under this principle, each client has a dedicated relationship manager. The relationship manager’s close contact with the customer facilitates understanding the client’s source of wealth, why complex or unusual arrangements may nonetheless be genuine and legitimate, or why extra security may be appropriate, improving 1st line controls. However, since this may also give rise to conflicts of interest if the relationship manager is too close to the customer, a solid internal governance and 2nd line oversight are important. 6.1.3. Cooperation with competent authorities Private banks cooperate with competent authorities through several different channels. These include monitoring transactions and accounts and reporting those that are suspicious to the CRF, as well as participating in and helping to drive forward industry cooperation initiatives such as the EWG PB. Suspicious activity and transaction reporting Private banks monitor transactions undertaken by clients to ensure those are legitimate and consistent with the banks’ knowledge of the customer, their business and risk profile, and known source of funds. This includes the screening of all incoming and outgoing transactions against sanctions, PEPs, and other high-risk lists, as well as the monitoring of transactions to identify potentially suspicious activities, behaviours and transactions. Private banks also ensure that the requirements of Regulation (EU) 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds, are complied with. According to the EC’s 2022 SNRA, the level of suspicious SAR/STR reporting by the private banking sector across the EU remains relatively low, raising the question whether private banks’ commercial objectives might conflict with reporting obligations, or whether there is enough awareness in the sector of the threats fac

🔗 Vers la source officielle

AI explanation based on the official legal text. Indicative, not a substitute for legal advice.