Circular CSSF 26/914

What Changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level “high‑risk and cross‑border” perimeter defined under
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML Regulation and revised AMLD, by mapping AMLA’s selection
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of entities for direct supervision.
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA becomes the lead AML/CFT supervisor and the CSSF as
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business, high‑risk customers, products, distribution channels, and g
• The CSSF aligns its supervisory framework with AMLA’s risk‑based methodology, signposting that entities in scope may be subject to more intensive on‑site inspections, thematic reviews, and requests for information, coordinated at EU level.

Suggested Considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.
• Review group‑wide AML/CFT policies, intra‑group data‑sharing arrangements and centralised functions to ensure they are consistent with AMLA’s future role as potential group‑level supervisor and that any legal or data‑protection constraints are identified and mitigated.

Key Dates

Who is Affected