This consolidated text was drawn up by the CSSF for information purposes only. In case of

discrepancies between the French and the English consolidated texts, the texts published in the

Journal officiel du Grand-Duché de Luxembourg are the sole authoritative and universally valid

versions.

Grand-ducal Regulation of 1 February 2010 providing details on certain

provisions of the Law of 12 November 2004 on the fight against money

laundering and terrorist financing, as amended,

(Mém. A 2010, No 15)

as amended by:

-

Grand-ducal Regulation of 5 August 2015 amending Grand-ducal Regulation of 1

February 2010 providing details on certain provisions of the law of 12 November

2004 on the fight against money laundering and terrorist financing, as amended;

(Mém. A 2015, No 156)

Grand-ducal Regulation of 14 August 2020 amending Grand-ducal Regulation of 1

February 2010 providing details on certain provisions of the Law of 12 November

2004 on the fight against money laundering and terrorist financing, as amended.

(Mém. A 2020, No 694)

Grand-ducal Regulation of 25 October 2022 amending Grand-ducal Regulation of 1

February 2010 providing details on certain provisions of the Law of 12 November

2004 on the fight against money laundering and terrorist financing, as amended.

(Mém. A 2022, No 537)

Art. 1. Customer due diligence

(…)¹

(3) (…)²“For the purposes of Article 3(7) of the Law of 12 November 2004 on the fight

against money laundering and terrorist financing, as amended (hereinafter the “Law”), special”³

attention shall notably be paid to: significant transactions relative to a business relationship,

transactions that exceed certain limits, very high account turnover inconsistent with the size of

the balance, or transactions which fall out of the regular pattern of the account's activity.

Professionals shall scrutinise, as far as possible, the background and purpose of such

transactions, set forth their findings in writing and keep these documents in accordance with

Article 3(6)(b) of the Law and to keep them available for the “Luxembourg” authorities

“responsible for the fight against money laundering and terrorist financing”⁴and auditors for at

least five years, without prejudice to longer record-keeping periods prescribed by other laws.

“(4) In order to apply due diligence measures to customers, "appropriate times on a

risk-sensitive basis" within the meaning of Article 3(5) of the Law shall notably mean one of the

following situations:

− a transaction of significance takes place;

− customer documentation standards change substantially;

1

Grand-ducal Regulation of 14 August 2020

2

3

4

1

− as regards banking business, a material change in the way that a customer's account

is operated;

− the professional becomes aware that it lacks sufficient information about an existing

customer.

The professionals shall be able to prove to the supervisory authorities or self-regulatory

bodies that the extent and frequency of customer due diligence measures is appropriate in view

of the money laundering and terrorist financing risks.

The customer due diligence measures shall be carried out at least every seven years,

without prejudice to higher frequency depending on the risk assessment.”⁵

(5) The record-keeping obligation of documents “, data”⁶and information as provided

in Article 3(6) of the Law shall include the obligation to maintain records of the identification

data, account files and of the business correspondence “, as well as the results of any analysis

carried out”⁷, for at least five years following the termination of an account or business

relationship, without prejudice to any longer record-keeping periods prescribed by other laws.

If a “supervisory”⁸authority requests, in specific cases and for the fulfilment of its mandate, to

apply a longer record-keeping period than the minimum period provided above, the professional

shall comply with this request.

Transaction records shall be sufficient to allow reconstruction of various transactions so

as to provide, if necessary, evidence for prosecution of criminal activity.

Together, the different components of an “individual”⁹transaction record shall thus

provide, in particular, the following information: name of the customer and beneficiary “of the

transaction”¹⁰, address or other identifying information“()”¹¹, the nature and date of the

transaction, the type and amount of currency involved, and the type and identifying number of

any account involved in the transaction.

Professionals shall ensure that all the above-mentioned transaction records and

information are available to the “Luxembourg”¹²authorities “responsible for the fight against

money laundering and terrorist financing”¹³, when acting in the context of their mandate, so

that professionals may respond “without delay”¹⁴to information requests by such authorities.

(6) Both customer due diligence in general and the assessment of the extent of the

measures to be applied on a risk-sensitive basis in particular, shall be consistent with the

guidelines issued by the “supervisory”¹⁵authorities “and self-regulatory bodies”¹⁶, for instance

in the form of circulars.

(Grand-ducal Regulation of 14 August 2020)

5

Grand-ducal Regulation of 14 August 2020

6

7

8

9

10

11

12

13

14

15

16

2

“(7) The threshold of EUR 1,000 as laid down in Article 3(1)(b)(ii) of the Law shall also

apply to occasional operations carried out by virtual asset service providers as defined in Article

7-1 of the Law.”

Art. 2. Simplified customer due diligence

It is not mandatory to apply the simplified customer due diligence regime as set out in

Article 3-1 of the Law and is therefore not imposed on professionals.

The obligation to gather sufficient information in any circumstances so as to establish

whether the customer meets the necessary conditions for Article 3-1 of the Law to apply, shall

at least include customer identification and monitoring of the business relationship so that the

necessary conditions for Article 3-1 of the Law are always met and the verification that there is

no suspicion of money laundering or terrorist financing. This obligation also applies to the

situations referred to in Article 3-1(4) of the Law.

(Grand-ducal Regulation of 5 August 2015)

“The professionals may reduce the identification measures and need not verify the

identity of their customer and, where applicable, the beneficial owner of the business

relationship when they carry out online payment services fulfilling each of the following

conditions:

1. the transaction concerns the provision of payment services listed under number

3, second and third indents, number 4, second and third indent, number 5 and

number 7 of the Annex to the law of 10 November 2009 on payment services,

as amended;

2. the transaction is executed via accounts held with payment service providers

located in the EU or in a third country which imposes equivalent requirements

relating to the fight against money laundering and terrorist financing;

3. the transaction does not exceed a unit amount of EUR 250;

4. the total amount of the transactions executed for the customer during the 12

months preceding the transaction does not exceed EUR 2,500.

The possibility not to verify the identity of the customer and, where applicable,

of the beneficial owner of the business relationship, also applies to professionals

with respect to electronic money referred to in Article 3-1(4)(…)¹⁷of the Law.”

The simplified customer due diligence regime is excluded when there is a suspicion of

money laundering or terrorist financing, when there are doubts about the veracity or adequacy

of previously obtained data or in specific circumstances which carry a higher risk.

Art. 3. Enhanced customer due diligence

“(1) Business relationships and transactions involving notably high-risk countries

constitute higher-risk situations within the meaning of Article 3-2(2) of the Law which require

particular attention and the application of enhanced due diligence measures.”¹⁸

17

Grand-ducal Regulation of 14 August 2020

18

3

“Supervisory authorities”¹⁹and, where applicable, self-regulatory bodies of the different

professionals shall inform the professionals of concerns about country-specific loopholes in the

relevant provisions for the fight against money laundering and terrorist financing of the countries

referred to above.

Where such a country continues not to apply or insufficiently applies measures for the

fight against money laundering and terrorist financing, these authorities and bodies shall warn

the professionals about the risks of money laundering and terrorist financing in transactions with

natural or legal persons of that country. They may set out “counter-measures”²⁰based on a

case-by-case approach which professionals must implement in view of the risk identified.

“The authorisation procedure requiring the approval of senior management shall also

include the anti-money laundering and counter-terrorist financing compliance officer.”²¹

(2) For non-face-to-face transactions “and where the professional has not put in place

electronic identification means, relevant trust services within the meaning of Regulation (EU)

No 910/2014 or any other secure, electronic or remote identification process which is regulated,

recognised, approved or accepted by the relevant national authorities”²², the professionals shall

have policies and procedures in place to address any specific risks associated with such business

relationships or transactions. These policies and procedures shall apply when establishing

customer relationships and when conducting ongoing due diligence.

(…)²³

(3) In relation to cross-border correspondent (…)²⁴relationships referred to in Article 3-

2(3) of the Law, credit institutions“, financial institutions and other institutions concerned by

this provision”²⁵shall also:

− determine from publicly available information the reputation of the respondent

institution and the quality of its supervision, including whether the institution

concerned has been subject to a money laundering or terrorist financing investigation

or regulatory action;

− assess the respondent institution's controls against money laundering and terrorist

financing and ascertain that they are adequate and effective;

− “clearly understand and”²⁶document the respective responsibilities “as regards”²⁷

the fight against money laundering and terrorist financing of each institution.

(…)²⁸

19

Grand-ducal Regulation of 14 August 2020

20

21

22

23

24

25

26

27

Grand-ducal Regulation of 14 August 2020

28

4

Where a correspondent (…)²⁹relationship involves the maintenance of "payable-

through" accounts, credit institutions“, financial institutions and other institutions concerned by

such relationships”³⁰shall be satisfied that:

(a) their customer (the respondent (…)³¹institution) has performed all the (…)³²

customer due diligence obligations set out in Article 3 of the Law on those of its

customers that have direct access to the accounts of the correspondent institution;

and

(b) the respondent (…)³³institution is able to provide relevant customer identification

data “and information”³⁴upon request to the correspondent institution. A

Luxembourg credit institution is authorised to provide such “data and”³⁵information

within the framework of a correspondent (…)³⁶relationship.

To the extent that other institutions which are not credit institutions are involved in

correspondent banking relationships, these rules shall equally apply to these institutions.

(4) Enhanced customer due diligence for politically exposed persons shall also apply

when this person carries out a prominent public function in another Member State or in a third

country or on behalf of the Member State or the third country.

Professionals shall put in place appropriate risk management systems“, including risk-

based procedures,”³⁷to determine whether a potential customer, a customer or the beneficial

owner is a politically exposed person.

Where a customer has been accepted and the customer or beneficial owner is

subsequently found to be, or subsequently becomes a politically exposed person, professionals

shall obtain approval to continue the business relationship from the senior management.

The authorisation procedure requiring approval from the senior management shall “also

involve”³⁸the “anti-money laundering and counter-terrorist financing compliance officer”³⁹.

Professionals shall take reasonable measures to establish the source of wealth and the

source of funds of customers and beneficial owners identified as politically exposed persons.

Where professionals are in a business relationship with a politically exposed person, they

shall be required to conduct enhanced ongoing monitoring on that relationship.

29

Grand-ducal Regulation of 14 August 2020

30

31

32

33

34

35

36

37

Grand-ducal Regulation of 14 August 2020

38

39

5

Art. 4. Obligations of branches and subsidiaries in foreign countries

The customer due diligence requirements laid down in “Article 4-1(3)”⁴⁰of the Law that

the branches and “majority-owned”⁴¹subsidiaries in third countries shall comply with include all

of the requirements listed in Article 3 of the Law and particularly those set out in paragraph 2

of this article.

“Professionals”⁴²shall pay particular attention that this principle is observed with respect

to their branches and subsidiaries in “high-risk”⁴³countries (…)⁴⁴.

Where the minimum requirements for the fight against money laundering and terrorist

financing of host countries differ from those applicable in Luxembourg, branches and subsidiaries

in host countries shall apply the higher standard, to the extent that host country laws and

regulations permit.

Art. 5. Prohibition of accounts and passbooks in fictitious names

Customer due diligence procedures and requirements for the recording and the keeping

of documents prohibit that accounts and passbooks be kept in fictitious names.

(…)⁴⁵

(…)⁴⁶

(Grand-ducal Regulation of 25 October 2022)

“Art. 6. Performance of customer due diligence by third parties

For the purpose of applying Article 3-3 of the Law, each professional shall apply a risk-

based approach which takes into account the information available on the risk level relating to

the countries in which the third parties are based.”

Art. 7. Appropriate internal management requirements

(1) Appropriate internal management requirements shall include the obligation to

establish and maintain internal procedures, policies and controls“, including risk management

methods,”⁴⁷to prevent money laundering and terrorist financing and to communicate these to

employees. These procedures, policies and controls shall cover, inter alia, customer due

diligence, record -keeping, the detection of unusual or suspicious transactions and the obligation

to report suspicious transactions.

(…)⁴⁸

40

Grand-ducal Regulation of 14 August 2020

Grand-ducal Regulation of 25 October 2022

Grand-ducal Regulation of 14 August 2020

41

42

43

44

45

46

47

48

Grand-ducal Regulation of 14 August 2020

6

Art. 8. Cooperation requirements with the authorities

(1) The obligation to communicate information referred to in Article 5(1)(b) of the Law

shall include the communication of existing documents on which this information is based.

(2) Pursuant to Article 5(1)(a) of the Law, the obligation to report suspicious

transactions shall apply for each fact which might be an indication of money laundering “, an

associated predicate offence”⁴⁹or terrorist financing due, in particular for reasons relating to

the person concerned, to his development, to the source of the funds, to the nature, the purpose

or procedures of the transactions, without the reporting person classifying the underlying

offence.

Particularly in the fight against terrorist financing, this reporting obligation shall also

apply to funds for which there are reasonable grounds to suspect or they are suspected to be

linked or related to, or to be used for terrorism, terrorist acts or by “a terrorist”⁵⁰“or a terrorist

group”⁵¹or by those who finance terrorism, without limiting this obligation solely to funds of

persons listed by the United Nations or by the European Union in the context of the fight against

terrorism.

(3) An information request relating to the fight against money laundering and terrorist

financing pursuant to Article 5(1)(b) of the Law or an instruction “not to execute transactions

pursuant to”⁵²paragraph 3 of this article does not presuppose a prior information according to

paragraph (1)(a) of this article but these measures may also be taken by “the Financial

Intelligence Unit (hereinafter the “FIU”)”⁵³, in the absence of a “prior”⁵⁴suspicious transaction

report (…)⁵⁵.

(Grand-ducal Regulation of 14 August 2020)

“A request for information from the FIU may be transmitted electronically or, where the

professional is not registered with the FIU, by mail.”

“An instruction by the FIU not to execute a transaction may be transmitted either

electronically”⁵⁶“or by mail”⁵⁷“or through verbal instruction”⁵⁸. “In case of verbal instruction,

this communication”⁵⁹must be followed by a written confirmation within 3 “working”⁶⁰days.

(…)⁶¹

(4) The adequate and appropriate procedure regarding the communication referred to

in Article 4(1) of the Law shall include procedures enabling professionals to respond rapidly and

fully to any information request from the Luxembourg authorities responsible for the fight

against money laundering and terrorist financing. “These procedures aim, in particular with

respect to the obligation to cooperate with the FIU, at the prior registration in the data

49

Grand-ducal Regulation of 14 August 2020

50

51

52

53

54

55

56

57

58

59

60

61

Grand-ducal Regulation of 14 August 2020

7

processing system of the FIU in order to report suspicious transactions or to respond to an

information request of the FIU.”⁶²

(5) The protection for disclosures made in good faith under Article 5(4) of the Law shall

apply even “in circumstances where the reporting person was not precisely aware of the

associated predicate offence, regardless of whether illegal activity actually occurred”⁶³.

Art. 9. Sanctions

Any person breaching the professional obligations as specified in this grand-ducal

regulation shall incur a fine or sanctions in accordance “with Articles 8-4, 8-10 or”⁶⁴9 of the

Law“, where applicable”⁶⁵.

Art. 10. Our Minister of Finance shall execute this regulation, which shall be published

in the Mémorial.

62

Grand-ducal Regulation of 14 August 2020

63

64

65

8