05 November 2026
AED ¦ Circulaire N° 768-37bis
AED circular 768-37bis carries the October 2026 FATF lists into Luxembourg practice
The Luxembourg Administration de l’enregistrement, des domaines et de la TVA (AED) has issued Circular No. 768-37bis, dated 4 November 2026, to the professionals it supervises for anti-money laundering and counter-terrorist financing (AML/CFT) purposes. It translates the statements of the October 2026 FATF Plenary into supervisory expectations: countermeasures against the Democratic People’s Republic of Korea (DPRK) and Iran, enhanced due diligence for Myanmar, and an updated list of jurisdictions under increased monitoring from which Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco have been removed. The circular replaces the June 2026 version and the circular of 2 November 2026.
Who has to act on the circular
The addressees are the professionals under AED supervision, a population made up largely of designated non-financial businesses and professions: real estate agents and developers, dealers in high-value goods, business and domiciliation service providers and others outside the perimeter of the CSSF and the CAA. Smaller firms in this group often maintain their country lists by hand, so the circular is in effect their reference for country risk. When it changes, the internal list of high-risk jurisdictions, the onboarding questionnaire and the monitoring rules have to change with it.
The structure follows the FATF’s own three categories. Jurisdictions subject to a call for countermeasures come first, then jurisdictions subject to a call for enhanced due diligence, and finally the jurisdictions under increased monitoring, commonly called the grey list. Each category carries a different level of expectation, and the circular spells out what the AED wants in each case.
The DPRK: countermeasures and a direct line to the AED
The FATF remains concerned about the DPRK’s persistent failure to address significant deficiencies in its AML/CFT regime and about the serious threats posed by its illicit activities linked to the proliferation of weapons of mass destruction and their financing. Since 2011 the FATF has called on all countries to implement the targeted financial sanctions required by UN Security Council resolutions and to apply three countermeasures: terminate correspondent relationships with DPRK banks, close any subsidiaries or branches of DPRK banks in their territory, and limit business relationships and financial transactions with DPRK nationals.
Despite these calls, the DPRK has increased its connectivity with the international financial system, a development the FATF flagged in February 2024 as raising proliferation financing risks. The AED therefore asks professionals to keep taking account of the risks arising from the DPRK’s deficiencies, including in countering proliferation financing, and to pay particular attention to business relationships and transactions with the jurisdiction, with companies and financial institutions from it and with anyone acting on their behalf.
Professionals are asked to inform the AED’s Service de la criminalité financière where they have a suspicion about transactions involving the DPRK, and separately to maintain reinforced mechanisms for filing suspicious transaction reports with the Cellule de Renseignement Financier (CRF). The notification to the AED does not replace the statutory report to the CRF, so both are needed.
Iran: fundamental deficiencies and virtual assets in scope
Iran’s history with the FATF runs from its high-level political commitment in June 2016 to the October 2019 call for enhanced supervisory examination of branches and subsidiaries, reinforced reporting and enhanced external audit requirements for financial groups with a presence in the country. In September 2026 Iran provided the FATF with an update on its efforts to address several items of its action plan. The FATF took note of the submission but found that fundamental deficiencies remain.
The countermeasures the FATF asks for are broad. Jurisdictions should refuse the establishment of subsidiaries, branches or representative offices of financial institutions and virtual asset service providers from Iran, or otherwise take into account that they come from a country without adequate AML/CFT systems. They should prohibit their own financial institutions and VASPs from setting up branches or representative offices in Iran, limit business relationships and financial transactions with the country on a risk basis, including virtual asset transactions, and prohibit new correspondent relationships while reviewing existing ones. Iran stays on the list of high-risk jurisdictions subject to a call for action until its full action plan is completed.
For AED-supervised professionals, relationships with natural and legal persons from Iran call for enhanced due diligence and monitoring, more frequent and more numerous controls, the selection of transaction types that need closer examination, and information on the reasons behind envisaged transactions. Reinforced suspicious transaction reporting to the CRF applies here too. Because virtual asset transactions are named explicitly, firms whose clients pay, invest or receive funds in crypto-assets should check that their monitoring covers those flows too.
Myanmar: enhanced due diligence with a February 2027 deadline
Myanmar committed to address its strategic deficiencies in February 2020, and its action plan expired in September 2021. In October 2022 the FATF decided that further action was needed and called for enhanced due diligence proportionate to the risks arising from the country. If no further progress is made by February 2027, the FATF will consider countermeasures, and Myanmar stays on the call-for-action list until its plan is completed.
The AED attaches the same operational expectations as for Iran: particular attention to relationships with natural and legal persons from Myanmar, enhanced due diligence and monitoring, more frequent controls, targeted review of transaction types and information on the purpose of envisaged transactions, together with reinforced reporting to the CRF. The FATF has repeatedly pointed to extensive fraud and cyber scam activity in Myanmar, so the risk assessment for Myanmar-connected funds should cover the likely predicate offences, particularly fraud, human trafficking and the laundering of scam proceeds.
What enhanced vigilance means in practice
The circular lists a short set of measures that translate fairly directly into procedures. Increasing the number and frequency of controls means shorter review cycles and lower thresholds for manual review. Selecting transaction types for deeper examination means deciding in advance which payment patterns, products or counterparties trigger an alert when a listed jurisdiction is involved. Obtaining information on the reasons for envisaged transactions means documented answers on economic purpose, source of funds and the role of each party, collected before execution.
A real estate professional might hold back a purchase until the origin of funds routed through an Iranian or Myanmar-linked counterparty is documented. A dealer in high-value goods would look at who pays, from where and in what form, especially where cash, third-party payers or virtual assets appear. Domiciliation providers face a different exposure and need to check whether a client company’s shareholders, directors or main counterparties connect to a listed jurisdiction, even where the company itself is registered elsewhere.
The grey list after October 2026
The jurisdictions with strategic AML/CFT deficiencies that have agreed action plans with the FATF are Angola, Bolivia, Bosnia and Herzegovina, Cameroon, Haiti, the British Virgin Islands, Iraq, Kenya, Kuwait, Lao PDR, Lebanon, Nepal, Papua New Guinea, South Sudan, Syria, Venezuela, Vietnam and Yemen. The AED asks professionals to take into account, where relevant, the deficiencies the FATF has highlighted and the risks they create for business relationships and transactions with these jurisdictions.
The wording is deliberately softer than for the call-for-action jurisdictions. The FATF does not call for enhanced due diligence on grey-listed jurisdictions, and the AED does not impose it either. Listing is one risk factor among others, which the professional weighs in its own risk-based assessment. The British Virgin Islands deserve particular attention in Luxembourg, given how often BVI vehicles appear in ownership chains of clients of business service providers and real estate transactions.
Four exits, and why risk ratings should not drop overnight
Bulgaria, Côte d’Ivoire, the Democratic Republic of the Congo and Monaco are no longer subject to the FATF’s increased monitoring process after demonstrating substantial progress. Monaco is the most relevant exit for Luxembourg professionals, given the private wealth, real estate and corporate links between the two financial centres.
Removal from the grey list does not oblige a firm to lower its country rating at once. The FATF assessment concerns the jurisdiction’s AML/CFT framework, while the professional’s own risk analysis also covers corruption levels, tax risks, sanctions exposure and the specific client profile. The EU list of high-risk third countries is updated separately by the European Commission and carries its own legal consequences under EU law, so firms should track both lists and record why a rating changes or stays the same.
Reporting to the CRF and the predicate offence angle
Each of the three call-for-action jurisdictions comes with the request to maintain reinforced mechanisms for suspicious transaction reporting to the CRF. In practice this means a lower internal threshold for escalation, faster handling by the compliance officer and a documented decision for every alert involving these countries, whether or not a report is filed.
A report that rests on a country connection alone gives the CRF little to work with. It is more useful when it names the possible predicate offence or typology: proliferation financing and sanctions evasion for the DPRK, sanctions circumvention and the use of front companies for Iran, fraud and scam proceeds for Myanmar. Under Luxembourg’s all-crime approach, any offence can be the source of laundered funds, and the jurisdiction is often the first visible sign of it.
Updating procedures without delay
Because the circular replaces both earlier versions, the June 2026 lists and the circular of 2 November 2026 should no longer be used. Professionals should update their country risk list, rescreen existing clients and counterparties against the revised grey list and the call-for-action jurisdictions, and adjust onboarding forms that reference outdated lists. They should also brief staff on the separate notification to the AED for DPRK-related suspicions and on the continued expectation of reinforced reporting to the CRF, and keep a record of the update for supervisory inspections.
Dive deeper
EU Sanctions Helpdesk
The EU Sanctions Helpdesk platform supports European operators in complying with European Union restrictive measures (also known as sanctions) imposed worldwide.
Aimed primarily at Small and Medium-sized Enterprises (SMEs), the Helpdesk offers resources and personalised help to companies performing sanctions due diligence checks.