Fine [LUX] ¦ CSSF Reprimands a Transfer Agent for Late, Missing and Unmonitored Suspicious Activity Reports

A reprimand for a transfer agent that reported too late, too little and then stopped watching

On 17 July 2026 the Commission de Surveillance du Secteur Financier (CSSF) imposed a reprimand on a specialised professional of the financial sector (PFS) acting as transfer agent for investment funds, for failing to cooperate properly with Luxembourg’s Financial Intelligence Unit. The decision, published on 15 October 2026, follows an on-site AML/CFT inspection and identifies four reporting failures, all of them familiar weak points in fund-sector reporting: a suspicious activity report filed nine months after a fraud alert, two suspicions that were never reported, and inadequate monitoring after a report, which let a transaction the firm had refused go through by a detour.

The inspection and the sanction

The CSSF inspected the firm between the second quarter of 2023 and the fourth quarter of 2024. The inspection covered the AML/CFT framework with a focus on the transfer agent activity, in particular customer and investor due diligence, name matching controls – the screening that identifies persons subject to financial sanctions, politically exposed persons (PEPs) and individuals with adverse media – and cooperation with the authorities. The breaches it found concerned mainly that last area.

The reprimand rests on Article 2-1(1) of the Law of 12 November 2004 (the AML/CFT Law), read with Article 8-4(1) and (2)(b). In choosing the sanction, the CSSF considered the number and severity of the breaches at the time of the inspection under Article 8-5(1). It also took into account that the firm acknowledged the breaches and observations, submitted a general action plan and started corrective measures after the inspection. The breaches concern the AML/CFT Law and CSSF Regulation No 12-02 in the versions applicable at the time. The CSSF published the decision on a nominative basis under Article 8-6(1), finding that none of the legal exceptions applied.

Bastian Schwind-Wagner _Follow

"None of the four failures in this decision is exotic, which is exactly why it deserves attention. A screening hit left for nine months, an investor who disappears after a source-of-wealth question, a PEP whose tax trial everyone waited out while dividends were paid, and a refused share transfer that went through via a third party: every transfer agent will recognise at least one of these situations.

The common thread is a misunderstanding of when the reporting duty arises and when it ends. It starts with a reasonable suspicion, not with a conviction or a completed relationship, and filing a SAR opens a period of closer monitoring instead of closing the file. Firms that measure the time from alert to report and flag refused transactions on the register will be much better placed than this one was."

Nine months from alert to report

In May 2022, the firm’s name matching controls produced a positive hit that revealed suspicious elements linked to a fraud case involving an investor. The firm filed a suspicious activity report (SAR) with the FIU only in February 2023, roughly nine months later.

The CSSF treats this as a breach of Article 5(1)(a) of the AML/CFT Law, which requires professionals to inform the FIU promptly and on their own initiative when they know, suspect or have reasonable grounds to suspect money laundering, an associated predicate offence or terrorist financing. The regulator points to what the delay can cost: it may undermine measures the FIU might take, such as seizing potentially fraudulent assets that have been invested. Where fraud proceeds sit in fund units, a late report gives the investor time to redeem or transfer them.

A prospective investor who walked away

In the second case, the firm identified close links between a prospective investor and a PEP who was under investigation for fraud and corruption. When the firm asked for more information on the source of funds and source of wealth, the prospective investor backed out. Because no business relationship was established, the firm filed no report.

According to the CSSF, a SAR should have been filed. The information on the source of funds and wealth could give rise to reasonable grounds to suspect attempted money laundering, all the more so because the prospective investor withdrew in response to the additional questions. Declining to enter into a relationship leaves the reporting obligation intact where a suspicion exists. Besides Article 5(1)(a) of the AML/CFT Law, the firm breached Article 48(1) of CSSF Regulation No 12-02, which extends the duty to inform the FIU to contacts with persons or legal arrangements where no business relationship is established and no transaction is carried out.

A PEP, a tax case and dividends that kept flowing

In the third case, the firm found press reports in 2017 and 2018 about legal proceedings against an investor identified as a PEP, for acts that could amount to a predicate tax offence. It placed the relationship under enhanced monitoring until the end of the investor’s trial.

The CSSF found that the information was already sufficient to give rise to a suspicion of money laundering derived from a tax offence, since it could not be excluded that the invested funds were proceeds of that offence. That suspicion existed regardless of how the criminal proceedings would end and should have led to a SAR without delay. The FIU can use such information in its own analysis and share it with competent authorities, including foreign ones, to support an ongoing investigation or judicial proceedings. Waiting for a verdict keeps the information from those proceedings.

The firm also kept paying dividends to the investor. The CSSF treats that as a breach of Article 5(3) of the AML/CFT Law, which requires professionals to refrain from carrying out transactions they know, suspect or have reasonable grounds to suspect are linked to money laundering, an associated predicate offence or terrorist financing until they have informed the FIU.

A refused transfer completed through a third party

The fourth case concerns monitoring after a report. An investor tried to transfer fund shares to a family member. The firm refused the transfer, suspecting an attempt to conceal ownership of the shares in the context of a divorce settlement, and filed a SAR. Eight months later, the investor transferred the shares to a third party, who then passed them on to the same family member, so the transaction the firm had blocked was completed in two steps.

The CSSF found that the firm had not applied sufficient enhanced due diligence to the investor after the SAR and therefore missed the later suspicious transactions. That breaches Article 48(3) of CSSF Regulation No 12-02, under which a business relationship reported to the FIU must be monitored with enhanced due diligence, where appropriate in line with FIU instructions, and any new indications must lead to a further report.

What fund administrators should take from it

A screening hit on an investor linked to fraud has to move through escalation and reporting promptly, and nine months is far outside anything that word allows. Firms should measure and review the time between alert and report. An investor who disappears when asked about source of funds or source of wealth is a reporting trigger in itself, and Article 48(1) of CSSF Regulation No 12-02 says so explicitly.

Tax offences are predicate offences for money laundering in Luxembourg, and a reportable suspicion does not depend on a conviction or the end of a trial. Enhanced monitoring cannot replace a SAR, and once a suspicion exists, distributions and redemptions in favour of the investor have to wait until the FIU has been informed.

Filing a SAR also opens a period of enhanced monitoring. Refused transactions should be flagged so that a later transfer to a third party, or onward to the originally intended recipient, is caught. Transfer agents keep the register and can therefore link transfers between investors, provided their controls look for that pattern.

Dive deeper

• CSSF ¦ Administrative sanction of 17 July 2026 ¦ Link