The European Union's new anti-money laundering architecture – anchored by the AML Regulation (EU) 2024/1624 (AMLR) and the Sixth Anti-Money Laundering Directive (EU) 2024/1640 (AMLD6) – will apply directly from 10 July 2027, fundamentally reshaping compliance obligations for Luxembourg fund managers, SOPARFIs and crypto-asset service providers alike. The new Anti-Money Laundering Authority (AMLA), operational in Frankfurt since 1 July 2025, is already publishing binding technical standards that will determine how these rules are implemented in practice, with a key deadline for most regulatory and implementing technical standards falling on 10 July 2026. Firms operating in Luxembourg's fund industry that do not begin adapting their AML/CFT frameworks now risk facing material gaps at the point of direct application.
The Legislative Architecture: What Has Changed and Why It Matters
For decades, EU anti-money laundering law operated through directives that required national transposition, producing a patchwork of divergent standards across member states. The new framework deliberately breaks from that model. The AMLR is a directly applicable regulation, meaning its provisions will take effect uniformly across all EU jurisdictions on 10 July 2027 without the need for domestic implementing legislation. Luxembourg's existing AML law will therefore need to be reconciled with those directly effective rules, and any inconsistencies will be resolved in favour of the regulation.
AMLD6, by contrast, retains the directive structure, governing the architecture of beneficial ownership registers and the organisation of national supervisory systems. Luxembourg's CSSF, as the principal financial-sector AML supervisor, will need to align its supervisory methodology with AMLD6's requirements. The interaction between these two instruments – one directly effective, one requiring national transposition – creates interpretive complexity that fund managers should not underestimate.
A third layer is added by MiCA (Regulation (EU) 2023/1114) and its intersection with the AMLR. Crypto-asset service providers holding a CASP licence under MiCA are expressly within the scope of the new AML regime. For Luxembourg fund managers with exposure to digital assets – whether through direct investment, tokenised fund structures or service relationships with CASPs – the convergence of MiCA and the AMLR creates a dual compliance obligation that is still being worked through at the regulatory technical standard level.
AMLA: From Institution to Active Regulator
AMLA became operational on 1 July 2025. From 1 January 2026, the anti-money laundering and counter-terrorist financing mandates previously held by the European Banking Authority were transferred to AMLA, including the maintenance of the risk-factor guidelines that most Luxembourg firms currently use as their primary reference for customer due diligence calibration. AMLA published its Single Programming Document for 2026–2028 on 4 February 2026, setting out the authority's supervisory and regulatory priorities across that period.
The most operationally significant near-term milestone is the 10 July 2026 deadline for the majority of AMLA's 23 regulatory technical standards (RTS) and implementing technical standards (ITS). These standards will specify, among other things:
- the methodology for identifying high-risk third countries and applying enhanced due diligence;
- the technical criteria for identifying politically exposed persons and their family members and close associates;
- the format and content requirements for suspicious transaction reports;
- the minimum standards for internal AML/CFT policies, procedures and controls; and
- the approach to group-wide AML/CFT programmes, which is particularly relevant for Luxembourg structures that sit within larger international groups.
From 2028, AMLA will assume direct supervisory responsibility over a selected group of obliged entities – primarily the largest cross-border financial institutions. For most Luxembourg fund managers, indirect supervision through CSSF will remain the operative model, but the standards AMLA applies to directly supervised entities will set the de facto benchmark for the market as a whole.
If your firm is assessing how these timelines interact with your existing compliance calendar, the team at Ferraz & Whitmore is available to assist. Please contact us at info@ferrazwhitmore.com or visit our contacts page.
Beneficial Ownership: New Threshold Rules and Register Obligations
The AMLR establishes a beneficial ownership threshold of 25% or more of shares, voting rights or other ownership interests. This threshold is directly applicable and supersedes any divergent national rules. For Luxembourg fund managers, SOPARFIs and fund vehicles registered at the Registre de Commerce et des Sociétés (RCS Luxembourg), the practical implications are significant: the definition of who must be identified, verified and registered as a beneficial owner will be determined by the AMLR rather than by national law alone.
AMLD6 governs the structure and accessibility of beneficial ownership registers. While the detailed national implementation rules for Luxembourg's registers remain subject to domestic transposition of AMLD6 – and the precise national rules are therefore still pending – fund managers should anticipate that registers will need to contain more granular information and that access rights will be broadened for competent authorities and, in certain circumstances, persons with a legitimate interest.
The interaction between the register obligations under AMLD6 and the customer due diligence obligations under the AMLR also raises practical questions for Luxembourg fund structures with layered ownership. Where a SOPARFI sits within a multi-tier chain that includes trusts, foundations or structures governed by laws of third countries, the task of identifying, verifying and documenting beneficial ownership to the standard required by the AMLR will require careful legal analysis. Disputes about the adequacy of beneficial ownership information that cannot be resolved administratively may ultimately be referred to the Tribunal d'arrondissement, Luxembourg's competent civil and commercial court at first instance.
Customer Due Diligence: Risk-Based Calibration Under the AMLR
The AMLR preserves the risk-based approach to AML/CFT that has characterised EU law since the Fourth Directive, but it codifies that approach in greater detail and at a higher level of prescription than previously. Fund managers must maintain documented risk assessments at the entity level and apply simplified, standard or enhanced due diligence based on the risk profile of each business relationship and transaction.
Key open questions that the forthcoming AMLA RTS/ITS will need to resolve include:
- The treatment of fund investors as customers: the extent to which subscription-based relationships trigger ongoing CDD obligations comparable to those applied to banking customers remains a significant interpretive issue for alternative investment fund managers.
- Reliance on third parties: the conditions under which a fund manager may rely on CDD performed by a depositary, registrar or transfer agent – and the liability consequences of such reliance – will be addressed in forthcoming standards but are not yet fully settled.
- Digital identity verification: the AMLR opens the door to digital and remote verification methods, but the specific technical requirements for their use in Luxembourg are subject to both national rules and AMLA guidance that is still being finalised.
For managers of alternative investment funds with non-EU investors, the interaction between the AMLR's due diligence requirements and the third-country correspondent relationship provisions merits particular attention. Where an investor is based in a jurisdiction identified by AMLA as high-risk, enhanced due diligence will be mandatory and the procedural requirements will be set out in binding technical standards.
Group-Wide Programmes and Cross-Border Implications
One of the more complex dimensions of the new framework for Luxembourg-based managers is the requirement for group-wide AML/CFT programmes. Where a Luxembourg fund manager is part of a group – whether the parent is in another EU member state or in a third country – the AMLR imposes obligations to ensure that all entities in the group apply consistent policies and that information relevant to AML/CFT can be shared within the group in a manner consistent with data protection rules.
For groups whose ultimate parent is outside the EU, the question of which standards prevail – EU standards or those of the parent jurisdiction – is addressed in the AMLR through a principle of applying EU standards where they are stricter. The practical implementation of a group-wide programme that satisfies CSSF as well as supervisors in other jurisdictions requires careful coordination, particularly where the group includes CASPs operating under a MiCA CASP licence or entities in jurisdictions with divergent beneficial owner threshold rules.
Luxembourg's position as a hub for cross-border fund distribution through structures registered at the RCS Luxembourg and passported across the EU means that fund managers based here are disproportionately exposed to the group programme requirements. A fund manager distributing into multiple EU markets through branches or tied agents must ensure that its AML/CFT programme extends coherently across all distribution channels.
Our AML/CFT practice works with Luxembourg fund managers on precisely these cross-border programme design challenges. Further detail on our approach is available at our Luxembourg AML compliance service page. To discuss your specific situation, write to info@ferrazwhitmore.com.
Tax Transparency, SOPARFIs and the Interaction With AML Obligations
Luxembourg SOPARFIs and other holding structures sit at the intersection of AML/CFT and tax transparency obligations. While these are legally distinct regimes, they interact in practice: beneficial ownership information collected for AML/CFT purposes informs tax reporting obligations under the Common Reporting Standard and DAC frameworks, and discrepancies between information held in AML files and that reported for tax purposes can trigger regulatory scrutiny from multiple directions simultaneously.
The AMLR does not alter the tax transparency framework directly, but the heightened precision it requires in beneficial ownership identification and documentation raises the standard against which existing structures will be measured. Luxembourg fund managers and SOPARFI administrators who have not recently reviewed the alignment between their AML beneficial ownership files and their tax reporting positions should consider doing so before the July 2027 application date. Guidance on the tax law dimensions of this review is available through our Luxembourg tax law practice.
Practical Risks for Luxembourg Fund Managers: A Forward Assessment
The transition to the new framework carries several categories of practical risk that are worth articulating clearly:
- Gap risk: firms that map their current AML/CFT programme against existing national rules rather than the forthcoming AMLR may find that gaps only become visible after the July 2027 application date, at which point remediation timelines are compressed.
- Standard-setting uncertainty: with most AMLA RTS/ITS due by 10 July 2026 but not yet published in final form, firms designing new systems and controls now must build in flexibility to accommodate standards that may differ from consultation drafts.
- Supervisory transition: CSSF's supervisory methodology will itself need to adapt to reflect AMLD6 requirements and AMLA's peer review expectations. There is a period of methodological adjustment ahead during which supervisory expectations may not be fully predictable.
- Third-country equivalence: the list of high-risk third countries and the concept of equivalence will be managed by AMLA rather than individual member states. Fund managers with investor bases or group entities in affected jurisdictions need to monitor AMLA's evolving determinations carefully.
- Crypto-asset exposure: fund managers with even indirect exposure to crypto-assets – through portfolio companies, tokenised instruments or CASP service relationships – should assess whether that exposure brings them within the ambit of the AMLR's enhanced provisions or creates AML/CFT obligations not previously considered.
A structured gap analysis, benchmarked against the AMLR's directly effective provisions and the AMLA standards published to date, is one of the most practical steps a Luxembourg fund manager can take now. We have documented our experience with this process in a case study on AML programme overhaul in Luxembourg.
Strategic Recommendations
Given the timeline and the volume of regulatory change, the following strategic priorities are worth considering for fund managers operating in or through Luxembourg:
- Begin AMLR gap analysis now, using the regulation's directly effective text as the primary reference rather than waiting for full AMLA standard-setting to be complete. The core obligations are clear; the technical detail will refine rather than fundamentally alter them.
- Monitor AMLA's RTS/ITS pipeline actively. With a 10 July 2026 deadline for most standards, the window between finalisation and the July 2027 application date will be short. Firms that track consultation papers as they are published will be better positioned to implement changes promptly.
- Review group programme architecture to ensure it can accommodate directly effective AMLR obligations and that information-sharing mechanisms within the group are legally sound under both AML and data protection frameworks.
- Assess beneficial ownership documentation against the 25% threshold in the AMLR, particularly for complex fund structures, SOPARFIs with non-EU shareholders, and vehicles with nominee arrangements.
- Engage with CSSF supervisory guidance as it evolves in response to AMLD6 transposition and AMLA expectations. The period between now and July 2027 is also a period of supervisory methodology development, and early engagement can help firms understand evolving expectations.
- Consider the MiCA/CASP intersection if the fund's investment strategy involves digital assets, and take advice on whether the firm's activities or service relationships bring it within the scope of CASP-specific AML obligations.
If you would like to discuss how the new EU AML framework applies to your fund structure, management company or SOPARFI, Ferraz & Whitmore's Luxembourg practice is available for a detailed review. Please reach out at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.