AML Compliance and AMLA Readiness in Luxembourg

Luxembourg-based entities and international groups operating through Luxembourg structures face a significant regulatory transition: the EU Anti-Money Laundering Regulation (AMLR) and the Sixth Anti-Money Laundering Directive (AMLD6) become directly applicable from 10 July 2027, while the new EU Anti-Money Laundering Authority (AMLA) assumed operational status in July 2025 and will commence direct supervision from 2028. Meeting these deadlines requires structured preparation now, not in the months immediately preceding entry into force. Ferraz & Whitmore advises funds, SOPARFIs, payment institutions and other regulated entities on building compliant AML frameworks under Luxembourg law and the incoming EU regime.

Why This Matters Now: The Regulatory Shift Underway

The EU has restructured its entire AML/CFT architecture. Rather than relying solely on directives transposed at national level, the new framework introduces the AMLR as a directly applicable regulation across all Member States. For Luxembourg entities, this means that requirements around customer due diligence (CDD), beneficial ownership verification, transaction monitoring and politically exposed persons (PEPs) will no longer be subject to interpretation at national level alone – they will apply uniformly, enforced in part by a new supranational authority.

The CSSF, Luxembourg's principal financial supervisor, will continue to supervise the majority of obliged entities. However, AMLA will exercise direct supervision over the highest-risk financial institutions from 2028, and its regulatory technical standards (RTS) and implementing technical standards (ITS) must be finalised by 10 July 2026. These standards will define in precise operational terms what compliance programmes must deliver. Entities that wait for those standards before beginning preparation risk being structurally unable to implement them in time.

If your group has entities in Luxembourg – whether a SOPARFI holding vehicle, an investment fund, a payment institution or a corporate treasury – and has not yet reviewed its AML framework against the incoming AMLR requirements, we would welcome a preliminary discussion. Contact us at info@ferrazwhitmore.com or visit our contacts page.

Who Needs AML Compliance Advice in Luxembourg

The scope of Luxembourg obliged entities is broad and is expected to widen under AMLD6. The following categories are particularly affected:

• SOPARFIs and holding structures: Luxembourg holding companies that engage in financial activities – particularly those acting as intermediaries in ownership chains with third-country beneficial owners – are subject to AML obligations and must maintain documented beneficial ownership registers filed with the Registre de Commerce et des Sociétés (RCS Luxembourg).
• Investment funds and management companies: AIFs, SICAVs, SIFs and their authorised managers face CDD and transaction monitoring requirements enforced by the CSSF. The interaction between fund-level and manager-level obligations requires careful mapping.
• Payment institutions and crypto-asset service providers: With MiCA now operative and the AMLR extending specific obligations to crypto-asset service providers, entities operating at the intersection of traditional finance and digital assets face layered compliance requirements. Our separate guidance on MiCA licensing in Luxembourg addresses this dimension in detail.
• Professional obliged entities: Lawyers, notaries, accountants, auditors and trust and company service providers (TCSPs) performing certain functions are subject to AML rules both under current Luxembourg law and the incoming regulation.
• Corporate treasury and intra-group financing: Luxembourg entities used for treasury management within multinational groups may qualify as obliged entities depending on the activities they perform.

Core Compliance Obligations Under the AMLR Framework

The AMLR consolidates and standardises obligations that were previously implemented with variation across Member States. For Luxembourg entities, the principal areas requiring review and, in most cases, updated documentation are:

• Customer due diligence (CDD) and enhanced due diligence (EDD): The regulation specifies the triggers, content and documentation standards for both standard and enhanced CDD. The thresholds and risk factors that justify enhanced measures will be further defined in AMLA's RTS, due by 10 July 2026.
• Beneficial ownership identification and verification: Entities must identify ultimate beneficial owners (UBOs) with precision and verify that information against the RCS Luxembourg register and other reliable sources. Cross-border structures with beneficial owners in non-EU jurisdictions attract particular scrutiny.
• Transaction monitoring: Automated or procedural monitoring systems must be calibrated to detect unusual patterns. The AMLR will set baseline standards; the adequacy of existing systems must be assessed against those standards.
• Risk assessment: Both entity-level business risk assessments and customer risk assessments must be documented, periodically reviewed and capable of demonstrating to the CSSF – or eventually AMLA – that the entity's risk appetite and controls are proportionate and effective.
• Internal governance: Designated AML compliance officer (MLRO), clear escalation procedures, staff training records and board-level accountability are structural requirements, not optional enhancements.
• Suspicious transaction reporting: Reporting obligations to the Luxembourg Financial Intelligence Unit (CRF) will continue under AMLD6, with procedural alignment to the AMLR.

The Regulatory Timeline: Key Dates and What They Require

Planning an AMLA-readiness programme requires aligning internal workstreams with external regulatory milestones. The confirmed dates from the EU legislative framework are:

• July 2025: AMLA became operational. Its standard-setting and supervisory preparation work is now underway.
• 10 July 2026: Deadline for AMLA to finalise and publish the RTS and ITS under the AMLR. These standards will define the technical content of compliance obligations in detail. Entities should monitor these publications and begin gap analyses against draft standards as they are released.
• 10 July 2027: The AMLR and AMLD6 become applicable. From this date, non-compliance with the regulation's directly applicable provisions is an enforcement risk across all Member States, including Luxembourg and the CSSF.
• 2028: AMLA begins direct supervision of selected high-risk obliged entities. Entities that may fall within AMLA's direct supervisory perimeter should prepare for a different supervisory relationship than they have with the CSSF today.

For a structured, step-by-step readiness guide covering gap analysis methodology, documentation frameworks and supervisory engagement strategies, we have prepared a dedicated technical resource: EU AMLR 2027 Readiness – Luxembourg Guide.

Common Pitfalls in Luxembourg AML Compliance

Based on our experience advising international groups with Luxembourg structures, the following issues recur most frequently and carry the highest risk of regulatory sanction or operational disruption:

• Outdated beneficial ownership documentation: UBO records that have not been refreshed following corporate restructurings, share transfers or changes in controlling interests represent a compliance gap that regulators identify quickly.
• Fragmented group-level CDD: Groups that conduct CDD at parent level and rely on that analysis for Luxembourg subsidiary compliance often find that the Luxembourg entity has no standalone documentation to present to the CSSF.
• Inadequate risk assessment methodology: Qualitative risk assessments without documented scoring criteria or without adequate evidence of how risk factors were weighted are routinely criticised in CSSF supervisory reviews.
• Technology gaps in transaction monitoring: Smaller entities that rely on manual review processes face scalability issues as the AMLR raises baseline standards and AMLA publishes more prescriptive technical expectations.
• Ignoring the AMLD6 national transposition dimension: AMLD6 must be transposed into Luxembourg national law. While the AMLR is directly applicable, AMLD6 provisions – including those relating to criminal liability and access to beneficial ownership information – will be implemented through Luxembourg legislative changes that are pending national confirmation. Entities should track the transposition process and ensure their legal frameworks adapt accordingly.
• Failing to prepare for AMLA direct supervision: Entities that might fall within AMLA's 2028 direct supervisory scope should not assume that CSSF compliance alone will satisfy the new authority. AMLA's supervisory methodology is still being developed, and early engagement with available guidance is advisable.

Cross-Border Dimension: Luxembourg Structures in International Groups

Luxembourg is frequently used as a holding, financing or fund domicile by international groups with operations across multiple jurisdictions. This creates a specific AML challenge: the Luxembourg entity's obligations under the AMLR are self-standing, yet the risk assessment of that entity is inevitably connected to the group's wider activities, client base and geographic reach.

Where a Luxembourg entity receives funds from or makes payments to entities in third countries – particularly jurisdictions identified on the FATF greylist or the EU's list of high-risk third countries – enhanced due diligence obligations apply. The AMLR introduces harmonised criteria for applying these measures, but the practical implementation in a group structure requires clear policies on information sharing, group-wide CDD reliance and the limits of that reliance.

Luxembourg's position within the EU single market also means that AML compliance must be consistent with requirements in other Member States where group entities are established. The AMLR's harmonisation objective reduces – but does not eliminate – the complexity of managing multi-jurisdictional compliance programmes. Our corporate law services in Luxembourg are often engaged alongside AML advisory work precisely because structural questions and compliance questions are intertwined in complex group arrangements.

If your group has a cross-border compliance challenge involving Luxembourg structures, our team is available to discuss the specific configuration and applicable requirements. Reach us at info@ferrazwhitmore.com or through our contacts page.

How Ferraz & Whitmore Approaches AML Compliance Mandates

Our approach to AML compliance mandates in Luxembourg is structured around the specific regulatory exposure of the entity and the group, rather than generic policy templates. A typical engagement involves the following phases:

• Regulatory mapping: Identifying which obligations under current Luxembourg law, the AMLR and AMLD6 apply to the specific entity, given its activities, client profile and group structure.
• Gap analysis: Reviewing existing policies, procedures, controls and documentation against the regulatory requirements – and against AMLA's draft technical standards where available.
• Remediation support: Drafting or updating AML policies, CDD procedures, risk assessment frameworks and internal reporting lines to meet identified gaps.
• CSSF engagement: Where a supervisory review or enforcement matter is involved, advising on engagement strategy and representing the entity's position, including, where necessary, before the Tribunal d'arrondissement in Luxembourg in contentious administrative or regulatory proceedings.
• Ongoing advisory: Monitoring AMLA's publication of RTS and ITS as the 10 July 2026 deadline approaches, and advising on implementation as the regulatory content becomes final.

Self-Assessment: Is Your Luxembourg Entity Ready?

The following questions are a starting point for internal review. They are not exhaustive, but they reflect the areas most commonly deficient in CSSF supervisory findings and likely to be scrutinised under the AMLR framework from 2027:

• Does your entity have a documented, current business-wide risk assessment that reflects the AMLR risk factor categories?
• Are UBO records complete, verified and consistent with the RCS Luxembourg register, with a documented review schedule?
• Do your CDD procedures differentiate between standard and enhanced due diligence with clear, documented triggers?
• Is your transaction monitoring system – whether automated or procedural – calibrated to the entity's specific risk profile and documented as such?
• Does your MLRO have a clear mandate, adequate resources and direct board-level access?
• Have staff received AML training in the past twelve months that covers both current Luxembourg obligations and the incoming AMLR requirements?
• If your entity is part of a group, is there a documented group AML policy, and does the Luxembourg entity have its own compliant standalone procedures?
• Have you assessed whether your entity is likely to fall within AMLA's direct supervisory perimeter from 2028?

If the answer to any of these questions is uncertain, this is a productive moment to conduct a structured review. Our team can assist with that process. To arrange an initial conversation, please write to info@ferrazwhitmore.com or visit our contacts page.

Disclaimer: This publication is provided for informational purposes only and does not constitute legal advice. The information herein should not be relied upon as a substitute for professional legal counsel tailored to your specific circumstances. Ferraz & Whitmore assumes no liability for actions taken or not taken based on the contents of this material. For advice regarding your particular situation, please contact info@ferrazwhitmore.com.