12 October 2026
MoJ ¦ 2026 National Risk Assessment of Terrorist Financing
Luxembourg’s 2026 terrorist financing risk assessment: small sums through a large payment hub
Luxembourg has published its 2026 National Risk Assessment of Terrorist Financing, covering the observation period 2021 to 2024 and following the FATF’s 2019 guidance for jurisdictions that combine a large financial centre with a low domestic terrorism threat. The realistic exposure it identifies lies with lone actors, small cells and foreign terrorist fighters who move small amounts of mostly legitimate money through ordinary retail banking, payment and e-money products – many of them offered EU-wide by institutions headquartered in the Grand Duchy. International terrorist organisations parking large sums in Luxembourg structures remain a theoretical scenario with no observed cases.
A financial centre without a domestic terror threat
Luxembourg has never experienced a completed terrorist attack, and no established terrorist group operates on its territory. One right-wing attack was foiled in 2023. The national threat level has stood at level 2 (“medium”) since the 2015 Paris attacks, meaning the threat is real but abstract. The first terrorism conviction followed in 2021, when a resident couple was sentenced for spreading Islamic State propaganda; further convictions in 2025 concerned the planning of an attack inspired by extreme-right ideology and a resident who travelled to Syria. Up to 2024 there was no prosecution or conviction for terrorist financing itself.
As the 19th-ranked global financial centre and Europe’s largest fund domicile, Luxembourg still has to assess its terrorist financing vulnerabilities independently of the domestic terrorism level. Geography adds to that. France, Germany and Belgium accounted for 57% of reported EU terrorist attacks between 2021 and 2024, and 44 of the 55 jihadist attacks in the EU over that period took place in a country bordering Luxembourg. More than 220 000 cross-border commuters link the Luxembourg payment surface to those regions every day.
Two threat scenarios, two very different ratings
The assessment separates two threat categories. Small-value financiers – decentralised networks, small cells, lone actors and foreign terrorist fighters – are rated “medium”. They need little money, spent in small pieces on travel, online services, minor operational outlays and modest cross-border donations. Funds come mainly from salaries, social benefits and small loans, sometimes topped up with proceeds of petty crime such as drug dealing. Because the money is legitimate and the spending rarely departs from ordinary consumer behaviour, detection relies on ideological indicators and weak transactional signals, and classic source-of-funds analysis has little to work with.
High-value financiers, meaning international terrorist organisations, state sponsors and “corporate” terrorist groups that operate like organised crime, are rated “low”. To test this scenario, the authorities built a list of 56 targeted jurisdictions from the Global Terrorism Index and FATF and FSRB effectiveness ratings on immediate outcome 9, and sorted them into six tiers. Flows with these jurisdictions represent only 2% to 3% of Luxembourg’s bank deposits, loans, correspondent banking and portfolio positions. Foreign direct investment is the outlier at more than 10%, driven largely by fund-structuring links with a single offshore financial centre. The top three targeted jurisdictions account for 65% to 94% of each flow category, and the links can be explained by fund structuring, wealth management, Islamic finance and trade. No materialised terrorist financing risk was found in these channels.
The assessment still treats the second scenario as possible through corporate vehicles, NPO abuse, correspondent banking and trade finance. A sophisticated financier would need the same techniques known from money laundering schemes: opaque ownership chains, forged documents and the misuse of charities and crowdfunding. That is why the gatekeeper sectors keep elevated ratings.
What the CRF actually sees
The Cellule de Renseignement Financier received between 220 and 321 terrorist financing reports per year during the period (321 in 2021, 230 in 2024). For 2023 and 2024, around 70% related to Islamism in the broad sense, 10% to the extreme right, 6% to separatism and 2% to left-wing terrorism. Only 7% of the 2024 reports concerned Luxembourg residents. Most were filed by large online payment and e-money institutions serving customers across the EU, where the business relationship is often the only link to Luxembourg.
Donations, usually below EUR 100, go to foreign NPOs suspected of links to extremist organisations, often solicited through social media and crowdfunding campaigns. Peer-to-peer transfers between unrelated individuals are presented as support for widows, orphans, prisoners and families of killed fighters. Extremist merchandise such as clothing, music, books and flags changes hands, and weapons or suspicious goods are acquired, mostly by lone actors and foreign separatists. Another pattern is a shift in spending behaviour: unusual expenses in higher-risk jurisdictions, remittances to unrelated persons there, or repeated flight bookings to transit hubs. For the extreme right, around half of all reports were triggered by sales or purchases of weapons and extremist goods.
Almost a third of the reports filed in 2023 and 2024 were based on open-source information, typically adverse media or sanctions hits from name screening. The CRF considers report quality generally good, but notes that reporting entities do not systematically check whether a screening hit is actually connected to the relationship or the funds before they file.
Retail banks, payment and e-money institutions carry the load
The vulnerability assessment covers every sub-sector within the 2004 AML/CFT Law across six dimensions: size and structure, ownership, products, geography, clients and channels. Retail and business banks and entities operating online are rated “high” inherently and “medium” after mitigation. The nine retail and business banks hold more than one million client accounts; the five entities operating online serve around 93 million active accounts and can issue virtual IBANs. Their products are no riskier than those offered in other countries, so the rating reflects volume, card and online banking reach and a largely EU cross-border clientele.
Payment institutions and e-money institutions follow the same pattern, “high” inherent and “medium” residual. The 15 payment institutions served about 16 million clients and processed roughly 1.5 billion inbound transactions worth EUR 101 billion in 2024. The 11 e-money institutions served around 110 million clients. High velocity, low denominations and non-face-to-face onboarding suit small-scale financing, while customer files rarely carry high-risk flags. No Luxembourg bank or e-money institution offered anonymous prepaid cards during the period. Agents and distributors acting for PIs and EMIs established in other Member States are few (21 agents for five institutions), yet more than 80% of their flows are cash-based and over 12% of their clients were linked to a tier 2 jurisdiction. They stay at “medium” even after mitigation.
Wholesale, corporate and investment banking, private banking, custodians, investment firms and collective investment schemes come out “medium” inherent and “low” residual. Long-term discretionary mandates, high entry thresholds, depositary banks acting as a second monitoring layer and institutional client bases make them unattractive for small-value financing. Their theoretical exposure is to wealthy sponsors investing funds that might later serve terrorist purposes. Trade finance, offered by 23 credit institutions, is flagged for over- and under-invoicing, forged documents and routing through conflict corridors, though its volume in Luxembourg is limited.
Crypto-assets: high inherent risk, limited volumes
VASPs are rated “high” inherently and “medium” residually. Exchange activity at the 15 registered providers grew to around 30 million transactions worth almost EUR 50 billion in 2024, heavily concentrated on one entity. Terrorist groups share wallet addresses openly on social media, increasingly in USDT, and use self-hosted wallets, mixers and chain-hopping before cashing out through crypto ATMs or unlicensed exchanges. The authorities see crypto use for terrorist financing growing, but it remains limited compared with cash and bank transfers. The move from VASP registration to CASP authorisation under MiCAR, with a Luxembourg grandfathering period that ran until 30 June 2026, should tighten market entry and ICT controls; the services themselves carry the same inherent exposure as before.
Gatekeepers, legal persons and fiducies
Among non-financial sectors, car dealers stand out with a “high” inherent rating driven by turnover, transaction volume and potential cash payments, dropping to “medium” after mitigation. Notaries, accountants, professional directors and business centres and chartered professional accountants are all “high” inherent and “medium” residual because of their role in company formation, domiciliation and real estate. Lone actors living on wages have little use for these services. A sophisticated financier trying to obscure ownership or the destination of funds would need them.
Legal persons follow the same logic. Sociétés commerciales move from “high” to “medium”. Domestic fiducies and foreign trusts remain “high” even after mitigation, one of only three sub-sectors where residual risk stays at the top of the scale. The trust and fiducie register held 2 894 active arrangements at the end of 2024, with around 6% of registered beneficial owners resident in targeted jurisdictions. In the register of beneficial owners, residents of such jurisdictions account for about 4% of registrations.
NPOs: the risk sits at the point of distribution
Luxembourg counts about 1 000 ASBLs and fondations within the FATF NPO definition, less than 11% of all registered non-profit entities. Around 400 of them operate primarily abroad, a third of those with a statutory focus on sub-Saharan Africa, including Cameroon, Senegal, the Democratic Republic of the Congo and Burkina Faso. Management and beneficial owner links to targeted jurisdictions are negligible. The vulnerability lies in operations, where funds may be diverted at the point of distribution in countries that combine high terrorism impact with weak CFT regimes.
The highest-risk group is internationally active ASBLs that hold neither public-utility status nor development NGO accreditation. They remain “high” after mitigation because they lack the extra oversight attached to those statuses. Accredited development NGOs, which received around EUR 72 million in co-financing for projects abroad in 2024, undergo an annual terrorist financing risk assessment by the Ministry of Foreign Affairs and fall to “medium”. The CRF has not yet identified a terrorist financing case involving a Luxembourg NPO, although diversion of donations, sham charities, abuse of broad statutory purposes and inter-NPO transfers are well documented internationally.
Cash, hawala and informal payment networks
Cash remains the dominant instrument worldwide: deposits followed by ATM withdrawals abroad, couriers carrying amounts below the EUR 10 000 declaration threshold, cash-intensive front businesses and prepaid card loading. Underground banking and hawala and other similar service providers pose a growing challenge because their flows leave little trace. The assessment notes indications that unregistered money-transfer operations linked to high-risk third countries are active in and through Luxembourg. One investigation concerns an association registered for cultural and student purposes that allegedly ran private Telegram groups to organise currency exchange and transfers with a high-risk third country, bypassing banks, AML/CFT controls and international sanctions.
Emerging vectors: vIBANs, instant payments, AI forgery and minors
Virtual IBANs can stretch the chain between master account and end user across several PIs and EMIs, which makes origin and destination harder to trace. Instant payments under Regulation (EU) 2024/886 must be executed within ten seconds around the clock and leave almost no time to intervene, although payment service providers must screen their customer base against restrictive measures at least daily. Donation-based crowdfunding platforms stay outside the supervisory perimeter until the AMLR applies on 10 July 2027, and AI-generated identity documents threaten remote onboarding at VASPs, PIs and EMIs.
Age is a newer factor. Almost 30% of the people arrested for terrorism offences in the EU in 2024 were aged 12 to 20, and the youngest, aged 12, was charged with planning an attack. In Luxembourg, nearly every 12- to 16-year-old owns a smartphone, and alerts on terrorist content to the BEE SECURE Stopline rose from 34 in 2022/2023 to 136 in 2023/2024. Minors usually depend on other people’s money and handle digital payment tools with ease, and existing CFT controls are not calibrated to catch them.
Mitigation and where residual risk remains high
Mitigation rests on five pillars: national strategy and coordination, prevention and supervision, detection, prosecution and asset recovery, and international cooperation. The 2025–2026 national AML/CFT strategy, adopted in February 2025, includes reforming the supervisory architecture through a new public authority. The CSSF set up an internal Counter-Terrorism Financing Task Force in 2023, screens licence holders and key persons daily against terrorist lists and has added terrorist financing questions to its annual financial crime survey, which more than 1 500 professionals complete each year. According to that survey, all entities have assessed their terrorist financing risk, but only 11% in a dedicated assessment and 43% in a separate section of their business-wide risk assessment. The CSSF recommends assessing terrorist financing separately from money laundering because the patterns differ: money laundering analysis asks where funds come from, while counter-terrorist financing has to follow where they are going.
On detection and enforcement, the CRF disseminated the extended professional version of the 2022 terrorist financing vertical risk assessment via goAML in May 2024, and its magistrates can freeze funds on suspicion for an unlimited period. Five terrorist financing cases involving six Luxembourg residents were assigned to the judicial police during the period; bank transfers were the main channel, followed by credit cards, e-money and cash. Prosecutors apply a low-threshold, preventive approach and examine the financial side of every terrorism case.
After mitigation, residual risk is low to medium across most sectors. It stays “high” only for domestic fiducies, foreign trusts and internationally active ASBLs without public-utility status or development accreditation. Retail and online banks, PIs, EMIs, VASPs, real estate agents and developers, car dealers and the gatekeeper professions remain at “medium”.
What obliged entities should take from it
For retail banks, payment and e-money institutions and crypto-asset service providers, the work lies in transaction monitoring calibrated for small, frequent transfers to foreign NPOs and unrelated individuals, P2P patterns, merchandise purchases and travel-related spending. A screening hit should lead to an actual analysis of how the adverse information relates to the relationship before a report is filed.
Gatekeepers, fund administrators and trustees face a different task. The wealthy sponsor using Luxembourg structures has not appeared in the data, yet the residual “high” rating for fiducies and trusts and the “medium” ratings for notaries, accountants and corporate service providers show that beneficial ownership transparency and the documented purpose of each structure remain the decisive controls. Entities that still fold terrorist financing into their money laundering risk assessment should follow the CSSF’s recommendation and document it as a risk of its own.
Dive deeper
EU Sanctions Helpdesk
The EU Sanctions Helpdesk platform supports European operators in complying with European Union restrictive measures (also known as sanctions) imposed worldwide.
Aimed primarily at Small and Medium-sized Enterprises (SMEs), the Helpdesk offers resources and personalised help to companies performing sanctions due diligence checks.