Technology & Cyber in Luxembourg

What Changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Suggested Considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

Key Dates

References

• [1] mayerbrown.com/en/insights/publications/2025/08/fatf-revi...
• [2] moodys.com/web/en/us/kyc/resources/insights/fatf-recommen...
• [3] innreg.com/blog/fatf-travel-rule-crypto-fintech-complianc...
• [4] vaspnet.com/articles/how-the-eus-travel-rule-goes-above-a...
• [5] sumsub.com/blog/what-is-the-fatf-travel-rule/

What Changed

• - Enhanced validation checks for the 2026 RoI submission: Applies ESA-defined checks (last updated April 2025) to more data fields to improve data quality, compared to prior cycles.
• Specific error resolutions detailed, including requirements for LEI code communication to CSSF beforehand, correct reference date ('2025-12-31') in file naming, plain-CSV files in predefined .zip...
• Mandatory inclusion of all tables (even empty) in FilingIndicators.csv set to 'true', with matching identification codes across parent-child records.
• Builds on prior CSSF guides, emphasizing eDesk role "DORA Reporting" assignment and ESAs' technical standards. No new regulatory requirements under DORA itself; this refines technical submission...

Suggested Considerations

• Assign "DORA Reporting" role in eDesk to dedicated employee(s) per user guide.
• Communicate LEI code to CSSF line supervisor prior to first submission to enable upload.
• Prepare RoI in plain-CSV files within .zip following ESAs' folder structure/file naming (reference date '2025-12-31'); include all tables in FilingIndicators.csv (even empty, set to 'true').
• Test submissions against listed error codes (e.g., ICTO007 for LEI, identification mismatches); resolve per guidance sections (e.g., Sections 3.2.2, 5.1.2, 6).
• Consult ESAs' EBA resources (data point model, validation rules, FAQs) and CSSF guides (e.g., submission guide, guidance tables).

Key Dates

References

• [1] cssf.lu/en/2025/04/dora-submission-timeframe-for-register...
• [2] cssf.lu/en/ict-and-cyber-risk-for-dora-entities/
• [3] cssf.lu/wp-content/uploads/Guidance-for-interpretation-an...
• [4] arendt.com/our-expertise/regulatory-consulting/regulatory...
• [5] cssf.lu/en/Document/guidance-for-interpretation-and-resol...
• [6] thomasmurray.com/compliance-digest/dora-register-informat...
• [7] deloitte.com/lu/en/our-thinking/future-of-advice/after-do...