From 10 July 2027, Regulation (EU) 2024/1624 (AMLR) and Directive (EU) 2024/1640 (AMLD6) will apply directly across the EU, replacing the fragmented national AML/CFT frameworks that obliged entities in Luxembourg have operated under until now. Businesses registered in Luxembourg – from SOPARFIs and alternative investment fund managers to crypto-asset service providers (CASPs) seeking a MiCA licence – must complete a structured compliance overhaul well before that date, because the CSSF has consistently enforced AML/CFT obligations with supervisory intensity that leaves little margin for reactive preparation. This guide sets out the Luxembourg-specific steps, realistic timelines and the most common errors that international clients make when approaching this transition.
Why Luxembourg Deserves a Separate Reading of the New Rules
Luxembourg is not simply a passive recipient of EU AML reform. As home to the largest investment fund domicile in Europe, a growing CASP and fintech cluster, and a deep market for holding structures such as the SOPARFI, the jurisdiction sits at the intersection of almost every obliged-entity category the AMLR defines. The CSSF, as the principal financial-sector competent authority, has already aligned much of its existing AML/CFT circulars with the forthcoming regulation, and its supervisory approach is expected to mirror the new single rulebook closely once AMLA in Frankfurt assumes direct oversight of selected high-risk entities from 2028.
Luxembourg's transposition of AMLD6 into national law is pending at the time of writing. Certain procedural matters – in particular the rules governing the Registre de commerce et des sociétés (RCS Luxembourg), the Tribunal d'arrondissement responsible for beneficial ownership disputes, and the national definition of the competent authority for non-financial sectors – will be shaped by national implementing measures that have not yet been finalised. Where this guide refers to those areas, it describes the mechanism rather than invented specifics.
The Regulatory Architecture: Key Milestones at a Glance
Understanding the sequencing is essential for planning. The new framework is being built in stages:
- 1 July 2025: AMLA became operational in Frankfurt.
- 1 January 2026: AML/CFT mandates transferred from the EBA to AMLA.
- 4 February 2026: AMLA published its Single Programming Document 2026–2028, setting out supervisory priorities and resource allocation.
- 10 July 2026: Deadline for the majority of AMLA's 23 regulatory and implementing technical standards (RTS/ITS). These standards will define granular requirements on customer due diligence (CDD), internal controls, data reporting and beneficial ownership verification.
- 10 July 2027: AMLR and AMLD6 apply. All obliged entities must be fully compliant on day one – there is no grace period built into the regulation.
- From 2028: AMLA assumes direct supervisory responsibility over a selected cohort of high-risk obliged entities. Others remain under CSSF supervision but within the harmonised rulebook.
The practical implication for entities in Luxembourg is that internal compliance programmes must be operational by mid-2027, which means project initiation no later than the first quarter of 2026 for organisations of any complexity.
Who Is an Obliged Entity Under the AMLR?
The AMLR's scope is broad. In the Luxembourg context, the categories most likely to require immediate action include:
- Credit institutions and payment institutions supervised by the CSSF.
- Alternative investment fund managers (AIFMs) and UCITS management companies.
- Crypto-asset service providers (CASPs) authorised or seeking authorisation under MiCA. The MiCA framework and AML/CFT obligations are now effectively interlocked: a CASP licence application to the CSSF will be assessed against both regimes simultaneously.
- Holding companies and pure equity structures, including SOPARFIs, where they qualify as obliged entities under the expanded scope – a point that remains subject to national transposition of AMLD6 and should be assessed individually.
- Trust and company service providers, real estate professionals, tax advisers and auditors.
Entities uncertain about their classification should obtain a formal legal opinion before the RTS/ITS deadline of 10 July 2026, because that date will effectively crystallise the compliance standards against which they will be assessed.
Step-by-Step Compliance Procedure for Luxembourg Entities
Step 1 – Gap Analysis Against the AMLR and Existing CSSF Circulars
The starting point is a documented gap analysis comparing your current AML/CFT framework – policies, procedures, technology and staffing – against the requirements of Regulation (EU) 2024/1624 and the CSSF's existing AML/CFT circulars. This analysis should be completed before the AMLA RTS/ITS are finalised in July 2026, because the technical standards will add granularity but the core obligations are already clear from the regulation's text.
Step 2 – Beneficial Ownership Mapping and Register Compliance
The AMLR sets a beneficial ownership threshold of 25% or more. For Luxembourg entities, this must be reflected accurately in the RCS Luxembourg beneficial ownership register, maintained pursuant to AMLD6 and the applicable national transposition rules. The Tribunal d'arrondissement de et à Luxembourg handles disputes and enforcement matters relating to these obligations. Common errors at this stage include failure to update the register after share transfers, use of outdated shareholder resolutions and incomplete mapping of indirect ownership chains through tiered holding structures – a structural feature that is particularly prevalent among internationally owned SOPARFIs.
Step 3 – Customer Due Diligence Framework Redesign
The AMLR introduces harmonised CDD requirements that override divergent national approaches. Luxembourg entities must review and where necessary rebuild their CDD procedures to align with the forthcoming AMLA RTS on CDD, the risk-factor guidelines and the single rulebook. For CASPs operating under or preparing for a MiCA licence, the CDD obligations will apply to crypto-asset transactions in addition to fiat operations, requiring technology integration across both environments.
Step 4 – Internal Governance and Compliance Officer Appointment
The AMLR reinforces requirements for a senior-management-level AML officer and a designated compliance function with documented reporting lines. For entities supervised by the CSSF, these requirements must satisfy both the existing circular framework and the forthcoming harmonised standards. Training records, escalation procedures and documented management decisions form part of the supervisory file that the CSSF may review.
Step 5 – Technology, Data and Reporting Readiness
AMLA's ITS on data reporting formats are among the 23 standards due by 10 July 2026. Entities that rely on legacy compliance technology should begin vendor assessments and procurement processes in parallel with the legal framework review, because implementation and testing cycles for AML/CFT software typically extend over several months.
Step 6 – Documentation and Audit Trail
Every step above must generate a contemporaneous audit trail. The CSSF's supervisory practice places significant weight on the quality of documented decision-making, not only on the outcome. Records of risk assessments, CDD decisions, escalations and management sign-offs should be retained in a form that can be produced to the competent authority on request.
If your organisation is at an early stage of this process, our team can assist with a structured scoping review. Please reach out at info@ferrazwhitmore.com or visit our contacts page.
Key Documents Required
- Board-approved AML/CFT policy aligned to the AMLR.
- Business-wide risk assessment (BWRA) updated for the new risk-factor framework.
- Customer risk classification matrix reflecting AMLA risk-factor guidelines.
- CDD procedures for standard, simplified and enhanced due diligence.
- Beneficial ownership register extract from RCS Luxembourg (current and accurate).
- Compliance officer appointment letter and terms of reference.
- Staff training records covering the AMLR requirements.
- Technology vendor contracts and system testing documentation.
- Board minutes evidencing management engagement with the compliance programme.
Realistic Timelines and Cost Drivers
A well-resourced entity beginning work now should allow for the following indicative timeline, subject to its size and complexity:
- Q1–Q2 2026: Gap analysis, legal mapping and engagement of external counsel and technology vendors.
- Q3 2026: Review of finalised AMLA RTS/ITS and integration into updated policies.
- Q4 2026 – Q1 2027: Implementation of revised procedures, system upgrades and staff training.
- Q2 2027: Internal audit, dry run of CSSF-facing documentation and sign-off by senior management before the 10 July 2027 application date.
The principal cost drivers are the scope of the CDD technology rebuild, the complexity of the beneficial ownership chain (particularly for multi-layered SOPARFI structures), and whether the entity requires new specialist staff or can rely on upskilling existing personnel. External legal fees are a function of the complexity of the gap analysis and the extent of structural advice required. We do not discuss specific fees in this publication.
Common Errors by Foreign Clients Operating Through Luxembourg
International groups frequently make a set of avoidable mistakes when managing AML/CFT compliance for their Luxembourg vehicles from a foreign headquarters:
- Treating Luxembourg as a sub-function of a group programme: The CSSF expects the Luxembourg entity to have a locally implemented, locally documented compliance programme. A group policy issued from London or Singapore does not satisfy this requirement without proper local adaptation and management sign-off.
- Underestimating the RCS Luxembourg beneficial ownership obligation: Register filings are publicly accessible and the CSSF cross-references them during on-site inspections. Inconsistencies between the register and internal ownership records are a red flag.
- Delaying CASP/MiCA and AML/CFT work in sequence: Entities pursuing a MiCA CASP licence from the CSSF should treat AML/CFT compliance as a parallel workstream, not a subsequent one. The two authorisation tracks are interconnected.
- Assuming national transposition will soften the AMLR: The AMLR is a directly applicable regulation. For the obligations it contains, there is no national gold-plating or softening option available to Luxembourg. AMLD6 transposition will govern procedural and supervisory matters, but the substantive CDD and beneficial ownership rules derive directly from EU law.
- Leaving governance changes to the last quarter before July 2027: Senior management appointments, board resolutions and governance amendments require lead time. Last-minute changes attract additional scrutiny from the CSSF.
Interaction with Tax Law and Holding Structures
For Luxembourg holding companies and investment vehicles, AML/CFT compliance and tax structuring are increasingly examined together, both by the CSSF during AML supervision and by the Luxembourg tax administration when assessing substance requirements. Ensuring that your beneficial ownership disclosures are consistent across AML registers, tax filings and transfer pricing documentation is a practical necessity, not merely good housekeeping. Our tax law practice in Luxembourg works alongside our AML team to identify and resolve any inconsistencies before they become regulatory findings.
The CSSF as Competent Authority: What to Expect in Practice
The CSSF has for several years operated a risk-based supervisory cycle that includes on-site inspections, off-site document reviews and thematic questionnaires directed at specific sectors. From 2028, AMLA will take over direct supervision of the highest-risk obliged entities at EU level, but the CSSF will retain responsibility for the broader Luxembourg-supervised population and will apply AMLA's harmonised methodologies and standards. Entities that have already experienced a CSSF AML on-site should anticipate that the scrutiny will intensify rather than diminish under the new framework, given the reduced scope for national supervisory discretion.
Our dedicated service offering for this preparation process is set out at AML compliance in Luxembourg, where you can find more detail on how we approach the gap analysis and implementation phases. For fund managers, additional analysis specific to the new rulebook is available at AML Rulebook for Fund Managers in Luxembourg.
Decision Checklist Before 10 July 2027
- Has the entity confirmed its obliged-entity status under the AMLR?
- Has a gap analysis been completed against the AMLR text and CSSF circulars?
- Have all AMLA RTS/ITS (due 10 July 2026) been reviewed and incorporated into updated policies?
- Is the beneficial ownership register at RCS Luxembourg accurate, complete and consistent with internal records?
- Have CDD procedures been redesigned for harmonised EU standards, including MiCA/CASP requirements where applicable?
- Has a compliant compliance officer been appointed with documented authority and reporting lines?
- Has the technology infrastructure been assessed and, where necessary, upgraded?
- Has staff training been delivered and documented?
- Has internal audit reviewed the programme and produced a formal sign-off report?
- Are AML/CFT disclosures consistent with tax filings and transfer pricing documentation?
If any of the above items remains open and your target completion date is mid-2027, the window for comfortable preparation is narrowing. We welcome enquiries from entities at any stage of the process. Please contact us at info@ferrazwhitmore.com or through our contacts page.
Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.