CSSF ¦ FAQ regarding International Financial Sanctions (updated 30 Sept 2025)

FAQ to Applying International Financial Sanctions: Key Duties, Reporting and Operational Expectations

This article explains the main obligations for financial sector professionals operating under Luxembourg law when confronted with international financial sanctions. It translates legal and supervisory requirements into practical steps firms must adopt to remain compliant, avoid enforcement action and limit operational disruption.

Legal and regulatory framework

The primary domestic instrument is the Law of 19 December 2020 implementing restrictive measures in financial matters, together with the Grand‑ducal Regulation of 14 November 2022 and CSSF Regulation 12‑02 (AML/CFT). Professionals must also apply UN and EU sanctions directly applicable in Luxembourg. The Ministry of Finance publishes guidance and forms; the CSSF provides supervisory guidance and maintains a sanctions hub and related AML/CFT material on its website. Firms must treat the combination of EU/UN acts, the national law and the CSSF rules as the framework that governs freezing, prohibitions and reporting duties.

What counts as a reportable restrictive measure

Only formal restrictive measures in financial matters require immediate reporting. Those are:

• prohibitions or restrictions on financial activities;
• prohibitions or restrictions on provision of financial services, technical assistance, training or advice; and
• freezing of funds, assets or other economic resources owned or controlled — directly or indirectly — by a designated person, entity, group or State.

Internal compliance steps (systems, tools, internal escalations) are not themselves the reportable acts; the report must document the actual restrictive action taken, with complete and precise information.

Where and how to send notifications

When a firm applies a restrictive measure it must inform the Ministry of Finance without delay. Notifications should be sent to sanctions@fi.etat.lu (postal alternatives exist) and a copy must be sent simultaneously to the CSSF at adm_jurcc@cssf.lu clearly indicating “Financial sanctions” in the subject. The Ministry provides a specific form for notifying frozen funds (available on its site and via CSSF Forms); use of that form is recommended to ensure completeness.

Bastian Schwind-Wagner_Follow "Luxembourg requires financial firms to act immediately when international sanctions apply: freeze affected assets, report the action to the Ministry of Finance and simultaneously copy the CSSF, and file a goAML report to the FIU if suspicion of money laundering or terrorist financing arises. Firms must assess ownership and control beyond simple share thresholds and document identity checks, especially in homonym cases, to prevent wrongful freezes and ensure timely compliance."

CSSF role and supervisory powers

The CSSF supervises entities under its remit for compliance with the Law of 19 December 2020 and related rules. It has investigation, inspection and enforcement powers equivalent to those used in AML/CFT supervision:

• document access and copying,
• information requests,
• on‑site inspections and seizures,
• hearings, and
• administrative sanctions (warnings, reprimands, public statements, fines).

Firms should expect the CSSF to review both the substance of restrictive measures applied and whether internal processes enable timely and accurate compliance.

Interaction with FIU and suspicious activity reporting

If the circumstances that trigger a sanctions measure also give rise to a suspicion of money laundering, terrorist financing, a predicate offence, or attempted circumvention of sanctions, the firm must submit a suspicious transaction report to Luxembourg’s FIU (CRF) via the goAML platform without delay, following Article 5(1)(a) of the Law of 12 November 2004. Sanctions reporting to the Ministry of Finance/CSSF is not a substitute for FIU reporting when suspicion arises; both obligations can coexist and must be fulfilled as required.

Handling OFAC and third‑jurisdiction listings

When a counterparty appears on a third‑jurisdiction list such as OFAC’s, firms should apply their sanctions screening, sanctions‑specific due diligence and reporting workflows as set out in their policies and in relevant CSSF/MoF guidance. The CSSF FAQ cross‑references AML/CFT guidance for details on dealing with non‑EU lists and related risk assessment steps.

Ownership, control and the 50% threshold

Firms must go beyond simplistic shareholding checks. While the Commission’s consolidated guidance often cites 50% ownership as a clear benchmark for control, EU law and court decisions recognize that effective control can exist below that threshold where decision‑making powers, veto rights, appointment powers, contractual arrangements or other indicators demonstrate de facto control. The General Court confirmed in January 2025 (T-1106/23) that control can be found below 50% when the facts show the designated person effectively directs the entity. Consequently, firms must assess beneficial ownership and actual control, including indirect holdings and layered structures, and treat an entity as subject to sanctions where control — direct or indirect — is established.

Reporting responsibilities across contractual chains

When multiple regulated professionals are involved in the same activity chain (for example, transfer agent, depositary, fund administrator), each remains individually responsible for reporting restrictive measures. Even if one party has already notified the authorities, other parties must send their own notifications “without delay” to both the Ministry of Finance and the CSSF. This redundancy ensures the authorities receive independent, complete information and helps the CSSF identify reporting gaps or inconsistencies across the sector. Contracts and operational playbooks should make clear who executes which operational steps but cannot replace the individual legal reporting duty.

Dealing with homonyms and mistaken identity risk

Where names match a designated person but identity is otherwise inconsistent, firms must perform enhanced verification to rule out mistaken identity. Use unique identifiers — dates and place of birth, national ID or passport details, addresses, nationality and other distinguishing information — document the checks and retain written records. If doubt persists, freeze the transaction or account and contact the Ministry of Finance (sanctions@fi.etat.lu) for clarification. Firms should suspend relevant activity until the issue is resolved.

Meaning of “without delay”

“Without delay” requires rapid action. For UN Security Council designations the expectation is action ideally within hours; for other designations or when reasonable grounds to suspect terrorist financing or related offences exist, firms must act as soon as they have a reasonable basis to do so. Practically, this means internal detection, escalation and execution paths must allow freezing and notification within operationally tight timelines — hours rather than days — so that assets cannot be moved or dissipated. Notification to the Ministry of Finance and the CSSF must be simultaneous and immediate once a restrictive measure is applied or there is a reasonable basis to suspect a sanctions trigger.

Practical steps firms must take now

Firms should ensure policies and records cover:

• screening against consolidated EU/UN and relevant third‑jurisdiction lists;
• escalation criteria and SLAs that map to “without delay”;
• documented decision trees for distinguishing homonyms and for assessing de facto control;
• templates and internal checklists for the Ministry of Finance notification form;
• dual reporting to the Ministry and CSSF;
• mandatory FIU reporting where suspicion arises; and
• audit trails for all actions taken.

Systems should produce timely alerts, enable rapid freezes, lock affected accounts and transactions, and generate complete reports suitable for immediate submission to authorities.

Conclusion

Compliance with international financial sanctions in Luxembourg requires a combination of legal knowledge, robust operational processes and rapid execution. The Law of 19 December 2020, its implementing regulations and CSSF Regulation 12‑02 set the legal baseline; the Ministry of Finance processes enforcement and authorizations; the CSSF enforces and supervises. Firms must implement fast, well‑documented decisioning and notification procedures, perform thorough ownership and control analyses beyond simple share thresholds, treat indirect and minority control as potential triggers, and report without delay to the Ministry of Finance and concurrently to the CSSF. When suspicions of money laundering or terrorism financing exist, a separate goAML report to the FIU is mandatory. Following these steps reduces legal and reputational risk and helps the sector meet Luxembourg’s supervisory expectations.

Dive deeper

• CSSF ¦ FAQ regarding International Financial Sanctions ¦ Link