informaꢀon are transformed into a raꢀng against each criterion, which were formalised in the previous
step. During this stage, analyses and findings are draſted into an NRA text narraꢀve.
Third and final, the results of the analyses in the second step are aggregated to form a conclusion regarding
the overall threat level, a sector’s overall vulnerability or the combined effecꢀveness of miꢀgaꢀng factors.
The analyses are also finalised in text narraꢀves, which are presented in separate secꢀons in the NRA
below.
4.4. Inputs used
This sub-secꢀon describes in detail what data and informaꢀon were used to conduct the NRA. The sources
of data and informaꢀon leveraged can be broadly categorised into five groups: quanꢀtaꢀve data from
stakeholders, publicly available quanꢀtaꢀve data, documents describing miꢀgaꢀng factors, expert inputs
and judgement from stakeholders, case studies and typologies.
Quanꢀtaꢀve data from stakeholders was collected through standardised data requests and through follow-
up requests for specific data points. Standardised data requests were sent to different supervisors to
collect data on vulnerabiliꢀes and miꢀgaꢀng factors and to prosecuꢀon authoriꢀes to collect data on
threats and miꢀgaꢀng factors. Each data point in the data request could be mapped against a scorecard
criterion for threats, vulnerabiliꢀes or miꢀgaꢀng factors. In some cases, addiꢀonal data was requested, for
example, to further develop the understanding of parꢀcular higher-risk factors.
Publicly available quanꢀtaꢀve data included both internaꢀonal and domesꢀcally available data sets. For
example, internaꢀonal datasets from various sources were used, such as internaꢀonal insꢀtuꢀons
(UNODC, OECD, European Commission, European Central Bank, Eurostat), and academia (including
Organised Crime Porꢃolio). Domesꢀc data sources were used to complete internaꢀonal data sets (e.g. data
provided by Parquet Général Staꢀsꢀcal Service, CRF Annual Reports, Grand-Ducal Police Annual Reports,
STATEC datasets, BCL datasets, data from LBR).
Documents describing miꢀgaꢀng factors were provided by stakeholders for the miꢀgaꢀng factors secꢀon
in the NRA. Those documents included internal memoranda, describing AML/CFT supervisory frameworks,
risk assessment policies, and other internal processes. Agencies also provided informaꢀon on published
circulars, guidance, FAQs and other published materials.
Expert inputs and judgements were used to enhance the analyses of threats, vulnerabiliꢀes and miꢀgaꢀng
factors. For the threats assessment, interviews and dedicated workshops were used to receive expert
inputs on high-risk predicate offences, understand any developments and determine where addiꢀonal
data was needed. Similarly, for the vulnerability assessments, interviews were used to receive inputs on
high-risk dimensions of different sub-sectors, understand the sub-sectoral developments over the past
four years and idenꢀfy addiꢀonal data points to be collected. For the miꢀgaꢀng factors, interviews were
used to collect addiꢀonal informaꢀon on miꢀgaꢀng factors in place, idenꢀfy key changes in the miꢀgaꢀng
factors over the past four years and key future development areas.
Case studies and typologies were collected from different agencies and public sources to enhance the
vulnerability assessment of sub-sectors further. Typologies from public sources (e.g. FATF) were used to
18
