Published on 28 January 2026 Email this Share this on LinkedIn Share this on Facebook Communiqué Looking back on the 2026 CSSF AML/CFT Conference for Specialised PFS In order to foster interaction with the Specialised PFS under its supervision, the Commission de Surveillance du Secteur Financier (CSSF) held an online conference on 26 January 2026 highlighting the key issues on AML/CFT for the sector. Representatives of the Luxembourg Ministry of Justice and the Luxembourg Financial Investigations Unit (FIU) were also amongst the speakers. The orators provided feedback and clarifications on the following topics: Update Sub-Sector Risk Assessment Specialised PFS providing corporate services Thematic review on Terrorist Financing Insights from the FIU for Specialised PFS 2025 ML National Risk Assessment You can find the speakers’ presentations below. 28 January 2026 2026 AML/CFT Conference dedicated Specialised PFS CSSF Studies and reports PDF (5.34Mb) Main topic: Financial crime Relevant for Mortgage credit intermediaries Specialised PFS 2026 AML/CFT Conference Dedicated to Specialised Professionals of the Financial Sector 26 January 2026 Rules of the conference Cameras, microphones and chat function are deactivated No recording (audio, video, …) Presentation slides will be published on CSSF website This conference cannot replace the regular AML/CFT trainings No certificate of attendance will be provided Agenda Foreword Update Sub-Sector Risk Assessment Specialised PFS providing corporate services Thematic review TF Insights from the FIU for Specialised PFS 2025 ML National Risk Assessment Conclusion 3 SSRA on TSCPs Specialised PFS providing corporate services (Trust and Company Service Providers) Why a SSRA on TCSPs? EU SNRA Luxembourg NRA, including sector level RA Sub-sector level RA & typologies Entity level RA Objectives of the SSRA: • Better understanding of the risk in relation to TCSP activities • Resource for the supervision by the CSSF • Guidance to the industry for the assessment of the risks of TSCP activities • Promotion of understanding of ML/TF risks and AML/CFT obligations in the industry • Public-private partnership 5 Sector and sub-sector risk assessment approach 6 The SSRA provides for the link between the NRA and entity-level risk assessments. It fulfils multiple objectives Reflect the CSSF’s own understanding of specific ML/TF risks in the sub-sector; Further improve the CSSF supervisory activities and subsector specific supervisory strategy, where relevant; Act as an input into CSSF’s entity-level risk assessments; Serve as a resource for the industry in informing their own ML/TF risk assessments; Promote the understanding of ML/TF risks and AML/CFT obligations in the industry; and Support public-private interaction. 7 Definition of TCSP The 2004 AML/CFT Law recognises 5 types of TCSP activities: Incorporation: Forming companies or other legal persons; Directorship and secretarial services: Acting as or arranging for another person to act as a director, manager, member of the board of directors, member of the executive board or secretary of a company, a partner of a partnership, or a similar position in relation to other types of legal persons; Domiciliation: Providing a registered office, business address, correspondence or administrative address or business premises and, where applicable, other related services for a company, a partnership or any other legal person or arrangement; 8 Fiducie/trust: Acting as, or arranging for another person to act as, a fiduciaire in a fiducie (as defined the 2003 Fiducies and Trust Law), a trustee of an express trust or an equivalent function in a similar legal arrangement; and Nominee shareholder: Acting as, or arranging for another person to act as, a nominee shareholder for another person. 9 TCSPs may be exposed for multiple reasons The sector is large and diverse, with a variety of licensed professionals and activities that can be conducted. Detection of ML threats may prove challenging in a market where diverse TCSPs and products exist. The international nature of the business, foreign client base and foreign ownership of assets, may increase the likelihood of dealing with illicit proceeds. Challenges in UBO identification and origin of funds/wealth as a result of the diverse nature of clients which includes legal entities and arrangements in the shareholding structure which may enable the beneficial owner to hide his identity, particularly in instances where the primary relationship is with an intermediary advising the client. 10 Intermediation of the relationships between a TCSP and client because of the presence of intermediaries (e.g. lawyers, accountants, business providers, advisors). This can reduce transparency around client identity. Services offered by TCSPs may be abused or misused to conceal the identity of the beneficial owner or their source of funds and facilitate the laundering of illegal proceed. 11 Threats for Specialised PFS Specific Money Laundering threats There are three specific predicate offences that are most relevant for Specialised PFS performing TCSP activities, which are: fraud and forgery, tax crimes, corruption and bribery Terrorism Financing threats There has been a significant change in how terrorists and terrorist organisations finance their operations. While they initially relied heavily on donations from sympathizers, they now increasingly turn to illegal activities as their primary sources of funding. These activities include extortion, drug trafficking, and kidnapping, which are primary offences of money laundering. 12 Profileration Financing threats The primary driver of these risks for Specialised PFS providing corporate services is that these services are deemed high risk in international guidance given they could be misused to obfuscate links between transactions and designated persons/entities. The United Nations Security Council indicated that designated persons and entities, and those persons and entities acting on their behalf have quickly adapted to financial restrictive measures and developed complex schemes to make it difficult to detect their illicit activities. 13 Risk mitigation (sample) Identify, assess and understand the ML/TF risks. The risk assessment should then drive the application of the professional’s risk-based approach to AML/CFT. Specialised PFS have defined a ML/TF risk appetite. Specialised PFS are also required to apply control measures in relation to customer due diligence (CDD) at on-boarding and throughout the life of the business relationship. Where ML/TF risks are higher, an enhanced due diligence (EDD) will need to be performed. 14 Specialised PFS have a client acceptance policy based on a risk-based approach and different levels of internal authorisation in place. Specialised PFS are required to conduct ongoing due diligence on the business relationship and transaction monitoring. Specialised PFS have in place ongoing employee training and awareness-raising programmes to ensure staff understand ML/TF risks and AML/CFT obligations Strong leadership and engagement by senior management and the board of directors in AML/CFT is an important aspect of the application of the risk-based approach. Senior management must create a culture of compliance, ensuring that staff adheres to the firm’s policies, procedures and processes designed to limit and control risks 15 Risk mitigation measures taken by the CSSF CSSF promotes an understanding of ML/TF risks and AML/CFT obligations through multiple channels. CSSF also performs a risk assessment on all Specialised PFS. This includes a risk assessment on the basis of findings by internal and external control functions, existence of policies, controls and procedures, provision of ongoing employee training and awareness-raising programmes to ensure staff understand ML/TF risks, AML/CFT obligations and the obligation to cooperate with authorities. CSSF operates AML/CFT market entry controls at the instruction of a Specialised PFS, (including a licensing process) and at any subsequent change within the ownership structure. 16 Fit and proper checks are carried out on the management and ownership structure of the Specialised PFS in instruction and during the lifetime of the Specialised PFS. Ongoing desk-based review of AML/CFT relevant information and documentation (such as review of the closing documents of the Specialised PFS…). Regular interactions with the professional, including face-to-face meetings and/or calls performed on a risk basis. Annual AML/CFT questionnaire with specific questions depending on the activities of the Specialised PFS to collect additional information. 17 An on-site inspection division is dedicated to performing full scope, targeted or thematic AML/CFT on-site inspections, the frequency and intrusiveness of which have increased in recent years. The CSSF has significantly increased its staff number both in the Specialised PFS off-site department and in the on-site department. Both the offsite and onsite inspection divisions can trigger remediation and enforcement and have at their disposal a wide range of supervisory tools. Enforcement follows the “Procédure Administrative Non-Contentieuse (PANC)” process. 18 Most frequent off- and on-site findings (best practices) Establishing a clear AML/CFT risk appetite statement and communicating it throughout the organization. Promoting a strict compliance culture throughout the organisation, especially in the first line of defence. Performing Targeted Financial Sanctions, PEP and adverse media screening to ensure screening is done immediately after an update in the sanction lists. Performing transaction monitoring. Complete documentation/information on the origin of funds, source of wealth, the identity of legal persons and beneficial owners. 19 CSSF recommendations to the private sector (sample) Specialised PFS should take a proactive approach to mitigating ML/TF risks. They should use this risk assessment to increase their understanding of ML/TF threats and vulnerabilities and develop proportionate and effective controls. Take appropriate steps to identify and assess firm-wide ML/TF risks. Implement a clear AML/CFT risk appetite and strategy. Ensure that name screening against Targeted Financial Sanctions screening is performed immediately as required notably by EU regulations. 20 Review client relationships on a periodic basis to determine whether ML/TF risk has changed. Ensure that the transaction monitoring process is effective and adapted to the activity performed and the type of client. Report without delay suspicious activities and transactions to the CRF and targeted financial sanction breaches to the Ministry of Finance. Ensure that resources dedicated to AML/CFT are commensurate with the professional’s level of risk. 21 The CSSF expects SPFS to reflect the findings and conclusions from this SSRA into their frameworks to ensure they remain appropriate to effectively mitigate ML/FT risks. 22 Thematic review on terrorist financing (“TF”) Outcome of the Thematic review carried out in 2025 Context 2023 FATF mutual evaluation report (recommendation for immediate outcome 1): “Luxembourg should further develop its understanding of TF risks and vulnerabilities stemming from its role as international financial centre, and transit jurisdiction for foreign TF financial flows and businesses linked to TF activity, including undertaking a qualitative assessment of what Luxembourg legal persons are used for, their links to higher-risk jurisdictions and other intelligence and investigatory materials from law enforcement and other authorities.” TF risks - Reminders Result of the 2022 Terrorist Financing Vertical Risk Assessment (“TF VRA”): None of the sub sectors in which PSF SP are active have been considered as vulnerable to TF. POST (not a PSF SP but supervised by our department): please refer to retail banks (high inherent risk and medium residual risk). Mortgage credit intermediaries (not a PSF SP but supervised by our department): not in scope of the TF VRA. Scope Trust and Company Service Providers (« TCSP »): to include it in the Sub Sector Risk Assessment of PSF SP providing corporate services but some conclusions can be of use to all professionals. TF risk self-assessments (14 interviews). Clients held by Non Profit Organisations (« NPOs ») (4 TCSPs). Beneficial Owners (« BO») in Israel and the United Arab Emirates (UAE) (9 TCSPs). CSSF conclusions on the TF Risk self-assessments of TCSPs • TF risks not always covered (no explanations, rating) or limited explanations (2 sentences). Legal References to remember: • Article 2-2
(1)of the Law on the fight against money laundering and terrorist financing(“AML/CFT Law”) states that “the professionals shall take appropriate steps to identify, assess and understand the risks of (…) terrorist financing that they face”. • Article 2-2
(2)of the AML Law: “the professionals shall consider all relevant risk factors before determining the overall risk level”. • TF risks mixed with ML risks. • TF risks were often overestimated (very cautious, not tailor made, focus on reputation). TF Risk self assessment – example of issues detected number 1 Comments CSSF: « The evaluation of the PFS’s vulnerability to Terrorist Financing (TF) risk is not treated as an independent element within its Risk-Based Approach (RBA). Instead, it is included in the ML/TF risk scoring. » • No separate TF analysis and risk rating to be reported in the Questionnaire on Financial Crime. • FATF (terrorist financing risk assessment guidance): « Crucially the factors associated with TF risk are also distinct from those associated with ML risk. (…) Although there may be some overlap in the potential vulnerabilities that criminals and terrorists misuse, the motive, and therefore the threat and risk indicators, differs ». TF Risk self assessment – example of issues detected number 2 Client risks: “Presence of non-profit organizations and then states, individuals, or corporate groups with potential interests in financing terrorism; Clients involved in cash-intensive sectors; High number of suspicious activity reports filed for TF.” Comments CSSF: • Theoritical risk factors quoted to explain a high risk rating but in fact none of them were applicable to the TCSP. TF Risk self assessment – example of issues detected number 3 Comments CSSF: “Considering the regulatory guidance, including NRA 2025, prior assessments, and market trends, the PFS is formalizing the Risk Assessment 2025 reclassifying TF risk from high to medium.” • The 2025 ML National Risk assessment (« NRA ») does not cover TF. Useful references for your TF risk self assessment Relevant legal references explaining risk assessments and risk indicators include notably CSSF circular 11/529 and CSSF circular complemented by Circular CSSF 25/878 and the FATF report “Comprehensive update on Terrorist Financing risks”). Other relevant sources to assess the level of risk include (as applicable) the VRA TF
(2022), the VRA legal persons legal arrangements
(2022), the SSRA on collective investment sector (last update 2025), the SSRA on Specialised PFS providing TCSP services if applicable (published last week). CSSF conclusions on clients held by NPOs and BOs in Israel and UAE • No TF deficiencies found showing that the mitigation measures applied to ML are also effective for TF. • Limited presence of NPOs in clients structures and UBOs linked to TF countries (Israel and UAE mostly represented) and no links to terrorists/terrorist groups/financing of TF needs (propaganda…). Points of attention to consider for the future: - Legal persons (not just NPOs) are also abused for TF “Terrorist groups, such as Hamas, and other illicit actors use increasingly sophisticated money laundering techniques including smuggling cash and using shell companies to avoid detection and hide their involvement in financial transactions.” - Possible links between TF and organised crime “As methods based on front and shell companies are already widely spread in the field of ML, any further convergence between organised crime and TF could result in such schemes becoming more common” Sources: How Hamas raises, uses, and moves money Atlantic Council FATF Comprehensive update on terrorist financing risks Final conclusions and best practices in relation to TF SSRA of PSF SP providing corporate services (TCSP services) (residual risk)
(2026): “The CSSF considers the risk to be very low” Understanding of TF risks has already improved among PSF SP as a result of this thematic review. Guidance/Good practices: Separate TF risk assessment. Specific TF training including case studies, TF red flags. Transaction monitoring: Checks in the transaction messages: suspicious communications? Transaction monitoring: Checks countries involved (all parties including financial institutions). Name screening: update of lists (automated tools) and checks without delay. Thank you Cellule de Renseignement Financier (CRF) Specialised PFS: CRF updates Luxembourg, January 26th 2026 Agenda Cellule de Renseignement Financier (CRF) Key figures for 2025 Reflecting on reporting & Key Data re. specialised PFS Key figures and insights on terrorist financing Compliance corner: New Feedback Template for Reporting Entities & Sector specifics Financial Restrictive Measures (Russia) Emerging typologies (AI Deepfakes & BEC Fraud) Cellule de Renseignement Financier (CRF) 1 – Key Figures for 2025 FIU Luxembourg (CRF) 2025 key figures (The numbers presented are indicative only and shall not be construed as final) ~ 68 000 ~ 15 000 Filed reports Cellule de Renseignement Financier (CRF) 1 995 1 133 ~ EUR 162 mio Registered professionals Disseminations sent by Disseminations received of assets frozen in 2024 on goAML Luxembourg FIU from foreign FIUs In addition, cross-border reporting is done via FIU.net 100% Top 5 Top 5 Top 5 ~ 600 Digital and paperless Associated Predicate Offences International cooperation - International cooperation - Financial analysis reports Information to foreign countries Information from abroad submitted to judicial Fraud authorities and other Counterfeiting and national AML/CFT product piracy authorities Tax offences Money laundering Cellule de Renseignement Financier (CRF) 2 – Specialised PFS: Reflecting on reporting & Key data for 2025 Luxembourg’s NRA : Specialised PFS - ML/TF risk exposure Cellule de Renseignement Financier (CRF) NRA: High Inherent ML risk for specialised PFS providing Corporate services though! Link here! BUT Bearing in mind! Do not mix the RBA with Suspicions! Inherent Risk Mitigation Residual Risk Will the reporting evolve ? Prioritization, Relevance and Quality: Art. 69
(2)of the new (EU) AML Regulation Cellule de Renseignement Financier (CRF) • Art. 69
(2)AMLR: “For the purposes of paragraph 1, obliged entities shall assess transactions or activities carried out by their customers on the basis of and against any relevant fact and information known to them or which they are in possession of. Where necessary, obliged entities shall prioritise their assessment taking into consideration the urgency of the transaction or activity and the risks affecting the Member State in which they are established”. “A suspicion pursuant to paragraph 1, point (a), shall be based on the characteristics of the customer and their counterparts, the size and nature of the transaction or activity or the methods and patterns thereof, the link between several transactions or activities, the origin, destination or use of funds, or any other circumstance known to the obliged entity, including the consistency of the transaction or activity with the information obtained pursuant to Chapter III including the risk profile of the client”. Assessment to be based on relevant facts & information NEW: Efficiency in the reporting Prioritization where necessary (Currently no such level of details in Art. 5 of the AML Law) Quality of reportings in the FATF MER
(2023)Cellule de Renseignement Financier (CRF) FATF IO 6 conclusion pinpointed issues re. the “relevancy and accuracy of information received from obliged entities (…) impacting the quality of the CRF work and responsiveness” “ADEQUATE, ACURATE & UP TO DATE INFO“ FATF IO 4 emphasized that “a large proportion of reports are driven by adverse media hits which not all FIs (…) properly analyse to establish if there are grounds for suspicion before filing the report” THE NEW CRITERIA SET IN ART. 69
(2)AMLR WILL COME HANDY HERE ! Reporting “promptly” (STRs/SARs) Cellule de Renseignement Financier (CRF) AML Law of 12 November 2004 • Art. 5, 1 (
- a)AML Law: “(…) the professionals (…) are required to: (
- a)inform promptly (“sans délai”), on their own initiative, the Financial Intelligence Unit (…) when they know, suspect or have reasonable grounds to suspect that money laundering, an associated predicate offence or terrorist financing is being committed or has been committed or attempted, (…)” QUID with the new (EU) AMLR ? • Recital 140 (AMLR): “FIUs should be able to obtain swiftly from any obliged entity all the necessary information relating to their functions” (…) • Art.69
(1)(AMLR): “Obliged entities, and, where applicable, their directors and employees, shall cooperate fully with the FIU by promptly: (
- a)reporting to the FIU (…)” No changes here: STRs/SARs shall be reported “promptly”! Mind the delays in case of a National Request of Information ! SARs/STRs filed by specialised PFS (2020 – 2025) Cellule de Renseignement Financier (CRF) 250 231 221 204 200 170 153 155 2022 2023 150 100 50 0 2020 2021 2024 2025 Your reporting in light of NRA 2025 Cellule de Renseignement Financier (CRF) - Make sure that your suspicions match the predicate offences highlighted in the NRA ! - Do adapt your procedures according to the findings of the NRA and the newly released CSSF SSRA Cellule de Renseignement Financier (CRF) 3 - KEY FIGURES AND INSIGHTS ON TERRORIST FINANCING Cellule de Renseignement Financier (CRF) 4 - COMPLIANCE CORNER: NEW FEEDBACK TEMPLATE FOR RES & SECTOR SPECIFICS Future content of the new Feedback template for REs Cellule de Renseignement Financier (CRF) General overview Follow-up I Follow-up II Evolution of STRs/SARs Information received when Exchange of Info with Report Quality Feedback Evolution of TFTRs/ TFARs File is closed foreign counterparts . (latest 9 TRIM) Cellule de Renseignement Financier (CRF) 5 – FINANCIAL RESTRICTIVE MEASURES (RUSSIA) Current Legal Framework (Luxembourg) Cellule de Renseignement Financier (CRF) Law of 19 December 2020 on the Implementation of Financial Restrictive Measures (FRM): (
- i)Implementing automatically the FRM adopted by United Nations’ Security Council and (
- ii)Various Acts of the European Union: Common positions, Decisions and Regulations (of direct application) Art. 10: Failure to comply with the RM “adopted by way of and Act by the European Union“ Law of 20 July 2022 setting up a monitoring committee for restrictive measures in financial matters: (
- i)Setting-up a committee to “monitor” the implementation of financial sanctions (
- ii)Amending Art. 506-1 of the Criminal Code = a Breach of Art. 10 of the Law on FRM constitutes a Predicate Offence of Money Laundering ! Triggers the competence of the CRF ! EU Regulations focusing on Russia Cellule de Renseignement Financier (CRF) Council Regulation (EU) N°833/2014 of 31 July 2014 concerning restrictive measures in view of Russia's actions destabilising the situation in Ukraine: (“MEASURES”) More focused on financial instruments/bank accounts issued/held by persons of Russian nationality or residing in Russia, the Russian state, Russian financial institutions/companies and other FRM. Council Regulation (EU) N°269/2014 of 17 March 2014 concerning restrictive measures in respect of actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine: (“PERSONS”) Mostly targets directly specific persons and imposes a freeze on their assets/economic resources. Violations of specific provisions of these two Regulations will fall within the remit of Art. 10 of the FRM Law ! Overall core Typologies Cellule de Renseignement Financier (CRF) Undervalued shares transfers • Use of non-sanctioned persons to acquire Luxembourg and EU-based companies on behalf of a sanctioned person via share transfers at a suspiciously low share price. Straw investment channels • Indirect investments made in investment funds by offshore front companies or straw men on behalf of underlying sanctioned UBOs. Legal proxy shield • Use of foreign transactions on individuals. law firms to conduct behalf of sanctioned Breach of export bans • Use of commercial companies suspected of exporting goods to Russia via neighboring and/or facilitating countries in the context of corporate and correspondent banking relationships. Third-party (re)payments • Loan repayments or invoice payments performed by a non-sanctioned third-party individual or entity on behalf of a sanctioned individual. Use of enablers/facilitators professional • Use of professional enablers/facilitators to set up sanction evasion schemes. Cellule de Renseignement Financier (CRF) 6 - EMERGING TYPOLOGIES Trend alert 1 - Use of Deepfakes/AIs Cellule de Renseignement Financier (CRF) Personal EMoney fraudulent accounts opened remotely & used as mule accounts Use of pre-recorded video (using AI), also with the use of fake ID documents (unfortunately not detected @ onboarding stage) Fraudulent account being credited by third parties with no apparent link with the fraudster account (scam occurs here) Funds then promptly transferred to third parties foreign accounts (online transfers or payment cards using crypto currency exchange platform) Trend alert 2 - Business Email Compromise targeting the investment Sector Cellule de Renseignement Financier (CRF) Increasing number of SARs involving cyber enabled fraud schemes targeting the investment sector Scams using fake capital calls or drawdown notices, usually involving Business Email Compromise and other impersonation techniques High value transactions FUND MANAGERS, ADMINISTRATORS, INVESTORS, TCSPs Make sure that you do have robust procedures to deter such frauds: Art. 4, para
(1),
- a)of the AML Law of 2004 (Adequate Internal Management Requirements) BEC Fraud: How does it look like ? Cellule de Renseignement Financier (CRF) 3 1 2 Steps: 1. Impersonation (phishing / fake identity setup) 2. Transmission of fraudulent payment instructions 3. Fund diversion & layering Publications and typology Luxembourg FIU (CRF) reports Luxembourg FIU (CRF) regularly releases sector-specific and general trends and typologies reports. Latest trend alerts on: (
- i)Deepfakes & AI to circumvent AML preventive measures and (
- ii)BEC targeting the IS. from Cellule de Renseignement Financier (CRF) Cellule de Renseignement Financier (CRF) Thank you for your attention! National Risk Assessment Money Laundering Observation period: 2020 - 2023 26/01/2026 Contents Part I: The central role of the NRA in the AML/CFT framework and the risk-based approach Part II: The NRA ML – main findings and conclusions of the 2025 update 61 Part I The central role of the NRA in the AML/CFT framework and the risk-based approach 62 FATF Recommendation 1 – Assessing risks and applying a risk-based approach and its Interpretative note obligations and decisions for countries Identify, assess and understand ML/TF risks for the country Designate an authority or mechanism to coordinate actions to assess risks, and apply resources, aimed at ensuring that risks are effectively mitigated Steering Committee; Prevention Committee Apply a RBA to ensure that measures to prevent or mitigate ML/TF are commensurate with the risks identified (= essential foundation to efficient allocation of resources across the AML/CFT regime) Keep the assessments up-to-date and have mechanisms to provide appropriate information on the results to all relevant stakeholders Where countries identify higher risks, they should ensure that their AML/CFT regime adequately addresses such risks. Where countries identify lower risks, they may decide to allow simplified measures for some of the FATF Recommendations under certain conditions (in line with the NRA) Countries should require obliged entities and professionals to identify, assess and take effective action to mitigate their risks 63 Practical implications for the private sector Interpretative note to FATF R1 concerning obligations to professionals Assessing ML/TF risks Professionals should be required to take appropriate steps to identify and assess their ML/TF risks (for customers, countries or geographic areas; and products, services, transactions or delivery channels) Link to the NRA methodology These assessments should be appropriate to the nature and size of the business Risk management and mitigation Professionals should be required to have policies, controls and procedures that enable them to manage and mitigate effectively the risks that have been identified (either by the country or by the professional) Where higher risks are identified, professionals should be required to take enhanced measures to manage and mitigate the risks Where lower risks are identified, countries may allow professionals to take simplified measures to manage and mitigate those risks The measures taken to manage and mitigate the risks (whether higher or lower) should be consistent with national requirements and with guidance from competent authorities and SRBs 64 Different levels of granularity of risk assessments Macro analysis Micro analysis At EU or national level At product/activity/crime/techniques, entity level Focus of the supra-national risk assessment (EU) and the NRA (Luxembourg), with macroeconomic and financial data, criminality rates, demographics… Focus of entity-level risk assessments with granular data about products, typologies, case studies, types of entities… Aims to identify, assess and understand ML/TF risks at the EU/national level Aims to identify, assess and understand ML/TF risks at the product/activity level Allows elaborating a global strategy (EU or Luxembourg) and prioritising of resources across agencies Allows applying specific rules to products/activities following their risk level and for instance guide supervisors when conducting controls (e.g.: prioritisation of target entities, products, etc) Meso (or intermediate) analysis: At the (sub-)sector level (e.g.: Legal persons and legal arrangements vertical risk assessment at the national level; Private banking; collective investments by the CSSF) Focus of (sub-)sector risk assessments with aggregated micro data, surveys, questionnaires… Aims to identify, assess and understand ML/TF risks at the (sub-)sector level Allows understanding risks at the (sub-)sector level and elaborating a specific (sub-)sector strategy 65 Part II The NRA ML – main findings and conclusions of the 2025 update 66 NRA – overall approach Fight against ML and TF Common legal framework May exploit the same vulnerabilities of a product or service ML and TF Own specificalities Differ in their nature, source and purpose A separate analysis: allows for a better understanding of the particular drivers of each type of risks facilitates the implementation of more targeted and ultimately more effective mitigation actions Two separate risk assessments: 67 NRA – overall approach Luxembourg NRA Step 1: Inherent risk assessment (i.e. in the absence of mitigating factors) Threats Vulnerabilities The objective of the threats analysis is to understand the environment in which predicate offences are committed to identify their nature and to assess the exposure to them The aim of the vulnerability analysis is to determine the x of each sub-sector exposure subject to AML/CFT obligations to money laundering risks cf. slides: 10 - 16 Inherent risk Inherent risk reflects the level of risk without taking into account mitigating factors (e.g. private = sector controls, supervisors, etc.). This risk level can be considered as the “gross” level of risk cf. slides: 17 - 22 Luxembourg NRA Step 2: Mitigating factors and residual risk Mitigating factors Inherent risk - The aim of the mitigating factor analysis is to assesses the effectiveness of mitigating measures that are in place (e.g. legislation, private sector controls, supervisors’ actions, etc.) cf. slides: 23 - 25 Residual risk Residual risk reflects the level of = risk once mitigation measures are applied. This risk level can be considered as the “net” level of risk cf. slides: 26 - 30 68 Threats assessment National ML risk assessment 2025 69 Threats scorecard This scorecard is used to assess the probability, proceeds and consequences of each crime category assessed in the context of the NRA exercise Criteria Probability of crime (“likelihood”) Proceeds of crime (“size” and “complexity”) Human, social and reputational impact (“consequences”) Sub-criteria Example of indicators that can be used Level of criminality Crime rate/number of crimes (domestic) Terrorist events (incidents, attempts, casualties, etc.) Presence and activities of known terrorist groups Number of offences, open/new notices, prosecutions and convictions (with and without ML) Proceeds generated Amounts seized Estimated value generated per crime committed Estimate of trade and financial flows with foreign countries (in particular with high risk countries) Estimated value of proceeds from international crimes Number of STRs and SARs filed Form of proceeds Cash proceeds vs. Non-cash physical Use of innovative forms (e.g. virtual currencies) ML expertise Sophistication (knowledge, skills, expertise) Capability (network, resources, etc.) Geography Origin/source Destination Economic and social cost Foregone revenues Financial system stability and its perceived integrity Attractiveness of the country for business, ability to attract FDI, broad “reputation” of country 70 National exposure to ML threats Considering Luxembourg’s important financial centre, the external threat level reflects the threat that proceeds from crimes committed abroad are laundered via Luxembourg The domestic exposure to ML is significantly smaller (low crime) and reflects the threat that crimes are committed in Luxembourg and related proceeds are laundered in the country or abroad 71 Threats assessment Remarks: Availability and granularity of data per crime varies Important number of stakeholders involved (located at different points within the enforcement and penal chain) Threat level = combination of quantitative and qualitative information Flexibility between different categories: one offence can be linked to another 72 External exposure: focus on top three threats 73 External exposure: focus on top three threats Fraud and forgery • Cyber-enabled fraud (FATF, Egmont Group, Interpol): on the rise (new technologies, digitalisation); proceeds tend to be laundered through a network of accounts (involving individual money mules, shell companies controlled by criminals, legitimate business) • Fraud affecting the EU’s financial interests (expenditure fraud): overall increasing amount of EU spending (especially post Covid-19) Luxembourg’s position as a payments, investment and cyber hub increases the likelihood that criminals potentially launder the proceeds of fraud via Luxembourg Tax crimes • • • Globally, legal persons and arrangements are observed to be misused for tax crimes (direct and indirect taxes) Some level of knowledge/sophistication required to commit tax crimes VAT fraud: exposure through payment hub processing transactions in relation with e-commerce (fraudulent businesses trying to evade VAT obligations) and Luxembourg legal persons (conduit companies in VAT carousel fraud, MTIC fraud) Corruption and bribery • • • Luxembourg context:
(1)limited size of domestic market: Luxembourg’s economy is internationally oriented;
(2)Luxembourg’s financial centre is a preferred destination for investment and corporate group activities Considering the level of expertise required and the high level of proceeds involved, sophisticated sectors are probably more likely to be targeted by criminals Cost of corruption estimated to be significant (6% of EU’s GDP) 74 Domestic exposure: focus on top three threats Fraud and forgery generate, together with drug trafficking, the most important proceeds in Luxembourg Theft (“vols simples”) is the most reported criminal offence registered with the Police 75 Vulnerability assessment National ML risk assessment 2025 76 Vulnerability scorecard This scorecard is used to assess the inherent risk level of each sub-sector analysed in the context of the NRA exercise 77 Vulnerability assessment: overview of inherent risk levels 78 Vulnerability assessment: overview of inherent risk levels 79 Vulnerability assessment: Specialised PFSs providing corporate services Risk drivers (specialised PFSs providing corporate services) Market structure and complexity: Specialised PFSs sub-sector includes various licenses, each offering different services (registrar agents, corporate domiciliation agents, professionals providing company incorporation and management services and family offices) The clientele was almost entirely made up of legal persons with more than half of the client companies’ BOs residing in non-EU countries, increasing ML risks Sub-sector provides TCSP services, which are deemed high risk from a ML perspective What activities fall under the scope of trust and company service providers? Acting as a formation agent for legal entities Acting as a director or secretary of a company, a partner of a partnership, or a similar position in relation to other legal persons Providing a registered office, business address or accommodation, correspondence or administrative address Acting as a trustee of an express trust ore performing the equivalent function for another form of legal arrangement Acting as a nominee shareholder for another person 80 Vulnerability assessment: legal persons and legal arrangements The analysis leverages on the methodology developed in the 2022 LPs/LAs VRA and updated data. This resulted in a more detailed, nuanced and data-based assessment - The 2018 and 2020 NRA assessed LPs/LAs as “High” risk, with Sociétés commerciales, followed by some NPOs bearing the highest inherent risk 2025 NRA ML, the inherent risk levels remain roughly the same for all categories of legal persons (with the exception of “Other legal persons”, assessed as High risk, in line with the 2022 LPs/LAs VRA, and ASBLs falling under FATF NPO definition carrying out local activities, that have been assessed as Low risk) 81 Mitigating factors National ML risk assessment 2025 82 Mitigating factors framework These dimensions are reflected in the mitigating factors scorecards (cf. next slide) 83 Mitigating factors scorecard This scorecard is used to assess the effectiveness of mitigating measures applied within each of the sub-sectors analysed in the context of the NRA exercise 84 Residual risk assessment National ML risk assessment 2025 85 Residual risk assessment 86 Residual risk assessment 87 Residual risk assessment 88 Residual risk assessment 89 Conclusion The NRA plays a central role in the national AML/CFT framework and may assist AML/CFT obliged entities in conducting their own risk assessment and in the application of a risk-based approach https://mj.gouvernement.lu/en/doss iers/2020/lutte-blanchiment.html 90