MoF ¦ Vertical Risk Assessment: PF and TF Targeted Financial Sanctions

Luxembourg maps where targeted financial sanctions can fail

Luxembourg’s Ministry of Finance has published its first vertical risk assessment dedicated to targeted financial sanctions (TFS) against proliferation financing (PF) and terrorist financing (TF). Covering 2018 to 2023, it sets aside the broad question of whether weapons programmes or terrorist groups are financed through Luxembourg and looks instead at where designated persons and entities could breach or evade asset freezes and prohibitions on making funds available, or exploit their non-implementation. Its findings point mainly to the corporate vehicles, trusts and gatekeepers that sit behind banks and payment firms, and much less to the financial institutions themselves.

A deliberately narrow definition of risk

The assessment follows the 2020 revision of FATF Recommendation 1, which defines PF risk “strictly and only” as the potential breach, non-implementation or evasion of the TFS obligations under Recommendation 7. What is measured is compliance risk: the chance that funds reach a designated person, or that frozen assets are used without authorisation.

For PF, the threats are the two UN country regimes, the Democratic People’s Republic of Korea (DPRK) and Iran. The Iran regime has hardened since 27 September 2025, when the UN measures lifted under Resolution 2231 were re-applied in full. For TF, the scope covers the UN regimes against Al-Qaida, ISIL and the Taliban, plus EU regimes for countries that both carry UN or EU sanctions and rank in the top 50 of the Global Terrorism Index. That adds Iraq, Syria, Somalia, Yemen, the Democratic Republic of the Congo, Mali, Libya, the Central African Republic, South Sudan, Myanmar and Sudan.

Direct exposure to these countries is small. Luxembourg’s exports to all in-scope countries together were worth roughly USD 18 million in 2021, and the assessment found no evidence of direct DPRK or Iranian associates operating in the country. The exposure comes from Luxembourg’s position at the “moving funds” stage of both the PF and TF value chains, where designated actors need legal entities, accounts and intermediaries to hide who they are.

Bastian Schwind-Wagner _Follow

"Luxembourg’s first dedicated risk assessment on proliferation and terrorist financing sanctions confirms what many practitioners suspected: the real exposure lies less in the banks than in the fiducies, trusts, companies and non-profit organisations behind them. Only these structures remain at high or very high risk after every control has been counted.

The supervisory cases are the more uncomfortable reading. Stale lists, unscreened client segments and freezes that wait for investigations to close are basic failures, and with sanctions breaches now a predicate offence under the all-crimes regime, they can quickly turn into a money laundering problem."

Why sanctions evasion now looks like money laundering

DPRK networks rely on layers of front and shell companies, often registered in China or Hong Kong, with stated business lines in textiles, fisheries or seafood and funds cycled through accounts before going dormant. Payments are split into smaller amounts to stay below alert thresholds. Iranian schemes have used front companies in Turkey and the United Arab Emirates, illicit gold sales and money remitters. Both states have also turned to cybercrime: a UN Panel of Experts report counted 58 suspected DPRK attacks on crypto companies between 2017 and 2023, worth about USD 3 billion.

The assessment says openly that a well-built evasion scheme can resemble a conventional laundering case more than anything connected to proliferation. Luxembourg’s criminal law reflects this. Since July 2022, breaching restrictive measures under article 10 of the Law of 19 December 2020 has been a predicate offence to money laundering. With the Law of 12 December 2025, Luxembourg moved to an all-crimes approach, so the proceeds of any crime or misdemeanour can be laundered, including export control offences under the Law of 27 June 2018, which carry five to ten years’ imprisonment.

Legal structures carry the highest residual risk

Domestic fiducies, foreign trusts, and ASBLs and fondations that fall within the FATF definition of non-profit organisations and operate abroad all start at a very high inherent risk and stay there after mitigating factors are applied. Sociétés commerciales move from very high to high. Nothing else in the economy ends the exercise rated above medium.

Scale and opacity drive these ratings. Luxembourg had 146,373 legal persons registered with the RCS at the end of 2023, and 2,378 active fiducies and trusts in the dedicated register. Direct links are thin: 49 beneficial owners resident in an in-scope country appeared in 64 entities, mostly in the financial sector. The assessment warns, though, that front and shell companies can create indirect exposure that statistics on direct links will miss.

For non-profit organisations the concern is TF rather than PF. NPOs running humanitarian and development projects abroad may work close to territories controlled by terrorist groups, where funds can be diverted or forcibly rerouted. Luxembourg has not detected the globally observed typologies among its own NPOs, but the geography of their work keeps the rating high.

Gatekeepers remain the weak link

The professions that create and maintain these structures form the second tier of concern. Notaries, chartered professional accountants, accountants and TCSPs acting as professional directors or business centres are all rated high before mitigation and medium after it.

Notaries stand out because they file company information with the RCS and, on request, the RBE, which makes them gatekeepers to the registers themselves. One notary reported a falsified signature attestation in 2020. Chartered professional accountants are numerous and fragmented, with around 1,232 professionals across some 560 entities and more than 111,000 clients, 811 of them offshore companies. Among Specialised PFSs supervised by the CSSF, 85 of 100 performed TCSP activities in 2023.

Lawyers fare better. Only 101 members of the Luxembourg Bar still provided TCSP services at the end of 2023, 38.5% fewer than a year earlier, and the clients from in-scope countries identified by the Bar turned out to be refugee status and legal aid cases.

Banks, funds and payment firms: exposed, but well controlled

Most financial sub-sectors move from medium inherent risk to low residual risk. Wholesale, corporate and investment banking is the exception: it starts high and ends medium because of correspondent banking and trade finance. A handful of Luxembourg banks hold more than 85% of all correspondent relationships, and no VOSTRO account is held by a respondent bank established in an in-scope country. Trade finance is not a core activity for most banks.

The fund industry held EUR 5,285 billion in net assets at the end of 2023, yet distribution to in-scope countries amounted to less than 0.003% of assets under management. Payment and e-money institutions processed 4 billion inflow and 1.07 billion outflow transactions in 2023, with around 30% of flows involving non-EU countries. The assessment adds that limited direct exposure does not remove the risk, because evasion routes increasingly run through third countries, including neighbours of sanctioned states.

Virtual asset service providers carry a medium inherent risk, driven by online onboarding, irreversible transfers and their role as a bridge between crypto and fiat. Eleven VASPs were registered at the end of 2023, 99% of their clients were natural persons resident in the EEA, the UK or Switzerland, and no breaches were identified.

Maritime, dual-use goods and high-value goods

Landlocked Luxembourg still has a maritime footprint. About 200 ships fly its flag, and three P&I clubs based in the country underwrite about two-thirds of its marine insurance business. Marine lines account for around 6% of non-life premiums. The clubs screen members before admission, track vessels through AIS data and generally terminate cover when they suspect a sanctions breach.

Exposure to dual-use goods is modest because Luxembourg has little manufacturing. OCEIT granted 56 individual dual-use export licences for third countries in 2023, and none to higher-risk in-scope countries since 2018. The more plausible risk is indirect, through corporate services provided to a company that belongs to a procurement network.

Among dealers in high-value goods, car dealers are rated high before mitigation, while art, antiques and luxury goods dealers stay at medium after it, with no reduction at all. The Freeport at Findel is rated medium inherent and low residual, thanks to beneficial ownership identification, customs clearance of every movement and restricted access.

What the supervisors actually found

Luxembourg’s framework rests on the Law of 19 December 2020. UN designations apply automatically, and national designations can cover the gap for 60 days pending UN or EU action. Operators must freeze without delay and without prior notice, then report to the Ministry of Finance with a copy to their supervisor. Frozen assets linked to in-scope regimes stood at EUR 4.44 billion in 2023.

The CSSF’s supervisory record shows where firms fall short. Its most frequent findings concern incomplete procedures, screening lists that are not updated, parts of the customer database left unscreened, insufficient screening frequency and poor integration of screening tools. One bank screened manually twice a month and did not even keep to that schedule. Another screened daily against lists it had not updated for a year. An e-money institution left a significant share of active and blocked clients out of its daily screening. All three cases ended in administrative fines. In 2024, two credit institutions were reprimanded for late freezing and late reporting under the EU’s Russia regime, including a transfer agent that stopped ongoing screening of fund investors for months.

The CSSF also notes that alert investigations are less mature for PF than for money laundering, particularly at smaller firms. In September 2023 it told banks that the freeze must happen without delay even when investigating an alert takes several days, and that the Ministry of Finance must be notified before the investigation is complete.

The self-regulated professions show similar gaps. In 2023, 95% of chartered professional accountants screened against mandatory lists, but only 60% did so often enough. At the Bar, every firm screened, but only 30% used an automated tool.

Two reporting channels, two different freezes

The assessment separates the roles of the two authorities involved. A true sanctions match goes to the Ministry of Finance. A report to the Cellule de Renseignement Financier (CRF) follows only where there is a suspicion of money laundering, a predicate offence, terrorist financing or a breach of restrictive measures. A designation on its own is not a suspicion, though it is an indicator that should trigger a full review of the relationship.

The freezes differ in the same way. A sanctions freeze is automatic and immediate. A CRF freezing order is discretionary, decided case by case, and usually holds assets until a judicial authority can seize them. The CSSF had earlier found banks sending sanctions matches to the CRF instead of the Ministry, and reports that professionals’ understanding of the two channels has since improved.

To date, there has been no prosecution in Luxembourg related to PF or TF sanctions.

The practical message for obliged entities

Effective sanctions compliance in Luxembourg depends on knowing who stands behind a fiducie, a trust, a société commerciale or an NPO working abroad, and on gatekeepers who treat company formation, domiciliation and directorships as sanctions controls in their own right. Matching names against lists is only the starting point.

The supervisory findings translate into concrete requirements. Screening has to cover the whole customer base, including beneficial owners, proxies and fund investors, against lists updated the moment they change, and a freeze cannot wait for an investigation to finish. Because sanctions evasion is now a predicate offence under an all-crimes regime, a sanctions alert that reveals layered ownership, unexplained third-party payments or circuitous routing should be handled as a potential money laundering case as well.

Dive deeper

• Ministère des Finances (MoF) ¦ Press release on the vertical risk assessment of PF and TF targeted financial sanctions (French) ¦ Link