This illustrative scenario examines how a Luxembourg-authorised payment institution approached a full overhaul of its anti-money laundering and counter-terrorist financing programme in response to escalating regulatory expectations from the CSSF and the broader reshaping of the EU AML/CFT architecture. The matter is presented as a representative scenario based on typical mandates handled by firms practising in Luxembourg's regulated-services sector; no specific client details, transaction amounts or case outcomes are described as real. The scenario traces the strategic rationale, key milestones, complications encountered and transferable lessons for comparable institutions navigating the same environment.
Client Profile and the Regulatory Pressure Point
The institution at the centre of this scenario was a mid-sized payment institution licensed under Luxembourg law and supervised by the Commission de Surveillance du Secteur Financier (CSSF). Its business combined domestic payment processing with cross-border remittance corridors, and it had recently expanded its product scope to include services that brought it into the perimeter of crypto-asset activity – making a future CASP licence under MiCA a live strategic consideration.
The immediate pressure originated from a CSSF on-site inspection that identified material weaknesses across three dimensions: the written AML/CFT policy framework lacked granularity on beneficial owner identification and verification; transaction monitoring thresholds had not been recalibrated following a change in the institution's product mix; and governance documentation did not clearly assign responsibility for emerging obligations under the incoming EU regulatory package.
Simultaneously, the institution's board was aware that the EU's structural reform of AML/CFT supervision was not a distant prospect. AMLA became operational in Frankfurt on 1 July 2025, and AML/CFT mandates were formally transferred from the EBA to AMLA on 1 January 2026. The Single Programming Document for 2026–2028, published on 4 February 2026, signalled the direction and pace of change. With the deadline for most of the 23 AMLA regulatory and implementing technical standards falling on 10 July 2026, and with AMLR (EU Regulation 2024/1624) and AMLD6 (Directive 2024/1640) set to apply from 10 July 2027, the institution faced a narrowing window to restructure its compliance architecture before those standards acquired direct binding force.
If you are advising a regulated entity in a similar position, our team can help you map current-state gaps against incoming obligations. Please contact us at info@ferrazwhitmore.com or visit our contacts page to arrange an initial discussion.
Strategy and Rationale
Legal counsel's first recommendation was to treat the CSSF inspection findings not as an isolated remediation task but as the entry point for a comprehensive programme that would simultaneously satisfy the immediate supervisory concern and position the institution for the 2026–2027 transition. This dual-horizon framing shaped every subsequent decision.
The strategic pillars were as follows:
- Policy architecture rebuild. The institution's AML/CFT policies were restructured around the risk-based approach requirements embedded in the AMLR, even though that regulation would not yet apply directly. Because the AMLR sets the beneficial ownership threshold at 25% or more, aligning internal definitions to that standard immediately removed the risk of having to re-engineer procedures a second time at the point of application.
- Beneficial ownership mapping. For corporate counterparties and group entities – some structured as SOPARFI vehicles registered at the RCS Luxembourg and incorporated through the Tribunal d'arrondissement – the team conducted a systematic review of ownership chains. Where registrations disclosed indirect holdings approaching or exceeding the AMLR threshold, enhanced due diligence protocols were introduced prospectively.
- MiCA and CASP readiness lane. Given the institution's expanding product scope, a discrete workstream assessed the additional AML/CFT obligations that would apply if and when a crypto-asset service provider authorisation were sought. The MiCA framework imposes its own governance and compliance expectations on CASPs, and integrating those requirements into a single compliance framework – rather than layering them on later – was identified as the more efficient approach.
- AMLA horizon scanning. Counsel reviewed AMLA's Single Programming Document and the schedule of technical standards to identify which incoming rules would require changes to systems or contracts before the 10 July 2026 deadline for most AMLA RTS/ITS. Areas flagged for early action included correspondent relationships, transaction monitoring calibration and internal reporting lines to the competent authority.
Our AML compliance practice in Luxembourg works with payment institutions and other regulated entities on precisely this type of multi-horizon programme design. We would be glad to discuss your institution's specific profile.
Key Milestones
The programme was structured in three phases, each with defined deliverables and governance checkpoints.
Phase 1 – Diagnostic and Immediate Remediation. A gap analysis was completed mapping existing policies against CSSF supervisory expectations and the requirements of the AMLR as published. This produced a prioritised remediation register. Policies on beneficial ownership identification were redrafted, and the compliance officer's mandate was formally extended to cover the CASP perimeter. Updated procedures were filed with the CSSF as part of the institution's formal response to the inspection findings.
Phase 2 – Framework Rebuild and System Alignment. Transaction monitoring rules were recalibrated to reflect the revised product mix. Beneficial ownership registers for the institution's key counterparties were audited, with particular attention to holdings that could aggregate to the 25% or more threshold under the AMLR. Training was redesigned to reflect both current CSSF expectations and the changes expected to flow from AMLD6 as transposed into national law – noting that the precise national implementing measures were, at the time of the programme, still subject to Luxembourg's legislative process.
Phase 3 – AMLA Transition Planning. A forward-looking workstream documented which aspects of the programme would need to be revisited once the 23 AMLA RTS/ITS were finalised by 10 July 2026 and once direct AMLA supervision of selected entities began in 2028. This included a preliminary assessment of whether the institution's profile and cross-border activity could bring it within AMLA's direct supervisory perimeter. The workstream also produced a review calendar, ensuring that governance bodies would receive updated horizon assessments at defined intervals rather than on an ad hoc basis.
Complications Encountered
Several complications arose during the programme that illustrate the practical difficulty of overhauling AML/CFT frameworks in a transitional regulatory environment.
Regulatory uncertainty around national transposition. AMLD6 requires Member States to transpose its provisions into national law, and certain details of Luxembourg's implementing legislation were not yet settled during the programme. This created genuine ambiguity about the future structure of the beneficial ownership register regime and the precise supervisory allocation between the CSSF and other competent authorities. Counsel advised the institution to design its procedures around the floor established by the AMLR – which as an EU regulation applies directly and does not require transposition – rather than anticipating national rules that had not yet been enacted.
CASP perimeter uncertainty. The institution had not yet determined whether it would seek a formal CASP licence under MiCA. The resulting ambiguity made it difficult to decide how deeply to invest in CASP-specific compliance infrastructure at that stage. The resolution was to adopt a modular policy design that could accommodate the CASP layer without requiring a complete rebuild, while deferring expenditure on systems until the licensing decision was made.
Beneficial ownership chains through SOPARFI structures. Several counterparties used SOPARFI holding vehicles registered through the RCS Luxembourg, with layered ownership structures. Verifying the ultimate beneficial owner required engagement with information filed at the RCS and, in some cases, requests for additional documentation from counterparties. The process was resource-intensive and underscored the importance of embedding ongoing due diligence obligations into commercial onboarding agreements rather than treating them as a one-time exercise.
Internal governance alignment. Securing board-level engagement with the compliance programme – as distinct from delegating it entirely to the compliance function – required structured reporting formats and clear framing of the regulatory risk in terms the board could assess. Counsel assisted in drafting board-level summaries that translated technical regulatory developments into governance-relevant risk language.
Outcome Category
As an illustrative scenario, this matter is presented without specific outcomes. The outcome category that programmes of this nature typically pursue is: resolution of supervisory concerns without formal enforcement action, combined with a documented and defensible compliance framework that demonstrates good-faith engagement with incoming regulatory change. No guarantee of any particular regulatory outcome is implied or suggested.
For institutions facing active supervisory scrutiny, the ability to demonstrate that a structured, board-approved remediation programme is under way – and that it is calibrated to both current and incoming obligations – is itself a material factor in the regulatory dialogue. The programme documented in this scenario was designed with that consideration in mind.
For further information on the evolving AMLA supervisory architecture and what direct supervision from 2028 may mean for Luxembourg-based entities, see our analytical note on AMLA direct supervision from 2028.
Three Transferable Lessons
Practitioners advising regulated institutions in Luxembourg and comparable EU jurisdictions can draw the following lessons from this scenario.
Lesson 1: Treat CSSF inspection findings as a strategic trigger, not merely a remediation task. Institutions that respond to supervisory findings by addressing only the specific points raised – without examining whether the underlying architecture is fit for the incoming regulatory environment – often find themselves in a second remediation cycle within a short period. The cost and reputational exposure of a second cycle typically exceed those of investing in a comprehensive overhaul at the first opportunity.
Lesson 2: Anchor current-state design to the AMLR threshold and definitions, even before the regulation applies directly. The beneficial ownership threshold of 25% or more in the AMLR (EU Regulation 2024/1624) will apply directly across the EU from 10 July 2027. Institutions that align their internal definitions and procedures to that standard now avoid the cost and operational disruption of re-engineering policies at the point of application. Where national transposition of AMLD6 introduces additional requirements, those can be layered on top of a foundation that is already AMLR-compliant.
Lesson 3: Build modular compliance architecture when the regulatory perimeter is uncertain. Payment institutions considering MiCA authorisation as a crypto-asset service provider face genuine uncertainty about the timing and scope of that expansion. Designing AML/CFT policies in a modular format – where a CASP layer can be added without rebuilding core procedures – preserves optionality and reduces the risk of compliance infrastructure becoming a bottleneck to business development. The same principle applies to the AMLA transition: institutions that build review triggers into their governance calendars are better positioned to absorb new technical standards as they are finalised.
For institutions and advisers navigating the intersection of payment regulation, AML/CFT compliance and crypto-asset law in Luxembourg, our team is available to discuss mandate-specific strategy. Please reach out at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.