Financial Integrity Monitor

Luxembourg LU

Domains (D1–D6)
2
Sources
12
Role actions
8
Horizon <90d
1
Jurisdiction profile
Largely CompliantTier ARisk: StableMixed

Luxembourg's AML/CFT regime rests on the 2004 AML/CFT Law as amended to transpose EU AMLD4/5, supervised by the CSSF (financial sector, VASPs) and the CRF-FIU (prosecutor's office).

MoreFATF's 2023 MER found a solid technical framework and good financial-intelligence use, but weak domestic ML investigation/prosecution, asset recovery, and non-financial-sector supervision.

Key deficiencies
  • Very low number of domestic money-laundering investigations, prosecutions and convictions relative to Luxembourg's risk profile as a global financial centre
  • Weak domestic asset recovery capacity, despite effective handling of foreign confiscation requests
  • Risk-based supervision of TCSPs, real estate, notaries and professional directors still in early implementation stages, with some high-risk DNFBP inspections not yet started
  • Beneficial ownership register (RBE) public access closed since the 2022 CJEU Sovim ruling, reversing 2019 transparency gains
  • Poor non-profit-organisation sector understanding of terrorist-financing risk despite Luxembourg's exposure as an international financial centre
Recent developments (18m)
  • Luxembourg's 2025 National Risk Assessment on money laundering published by the Ministry of Justice (May 2025)
  • FATF follow-up monitoring of Luxembourg's 2023 Mutual Evaluation updated December 2025
  • EU AML Package (AMLR, AMLA Regulation, 6AMLD) entered into force with a phased 2027-2028 implementation horizon directly affecting Luxembourg's supervisory architecture
  • EU high-risk third country list updated via Delegated Regulations (EU) 2026/46 and (EU) 2026/83 (Dec 2025), altering enhanced due-diligence obligations for Luxembourg obliged entities
  • Russian Central Bank litigation against EU Council sanctions regulation filed at the EU General Court, seated in Luxembourg (March 2026)
  • Luxembourg Recovery and Resilience Plan AML supervision-reform milestone due August 2026

Law made at European Economic Area level that applies in Luxembourg is covered once, on the European Economic Area page. This page covers Luxembourg’s own layer: implementation, national authorities, national options and local enforcement.

Brief

Lead signal

Lead Signal

Read full brief

Lead Signal

Luxembourg occupies an unusually central position in the EU sanctions-renewal architecture this cycle. Luxembourg has linked a French and Slovak demand to delist Alisher Usmanov to its own position on Mikhail Fridman, who is separately arbitrating against Luxembourg over frozen assets, a manoeuvre that deepens an EU sanctions-renewal delisting deadlock ahead of the sanctions list's scheduled renewal. This is a structural signal about how designation-criteria divergence pressure among member states can operate through a single jurisdiction's negotiating leverage, rather than an isolated bilateral dispute. Separately, the Bank of Russia filed a claim in a Luxembourg court on 15 September 2026 seeking to protect a Moscow Arbitration Court award against Euroclear over an estimated USD 230 billion in frozen assets, following the EU's indefinite extension of the sovereign-asset freeze under Council Regulation (EU) 2025/2600. Both developments are probable-to-uncertain in evidentiary terms, each resting on a single quality-press or specialist-legal source without independent confirmation of a Council document or court filing, but together they mark Luxembourg as a jurisdiction where sanctions-architecture contestation is now actively litigated and negotiated, not merely administered.

Other Developments

The MiCAR transitional-period expiry on 1 July 2026 closed the authorisation gap for Luxembourg virtual-asset service providers under MiCAR Article 143(3). The CSSF has confirmed directly that unauthorised crypto-asset service provision in Luxembourg is now unlawful, a Tier 1 primary-source-confirmed development. This is a structural hardening of the supervisory perimeter, not an incident: it converts a population of previously-tolerated legacy operators into either fully-authorised or unlawful actors overnight, with no intermediate category remaining.

CSSF enforcement activity in the banking sector surfaced two fines this cycle bearing on sanctions-screening and AML/CFT compliance. Stonehage Fleming Luxembourg S.A. was fined EUR 56,000 for AML/CFT compliance failings, including hundreds of delayed sanctions-screening alerts and 42 unnoticed alerts, breaching AML/CFT Law Article 3(2)(d) and CSSF Regulation 12-02 Article 33(1). Separately, Rakuten Europe Bank S.A. was fined EUR 185,000, announced 6 January 2026, for AML/CFT deficiencies identified in 2023, including delayed restrictive-measures screening and an outdated transaction-monitoring system. Both cases point to a live sanctions-screening enforcement gap in Luxembourg's banking sector that the CSSF is actively working through.

Cross-Monitor Connections

The Bank of Russia litigation against Euroclear-adjacent settlement infrastructure in Luxembourg courts has a direct world-payments dimension, given Euroclear's role in cross-border settlement, and readers tracking correspondent-banking and settlement-access risk should note the overlap between this sanctions-architecture development and payment-infrastructure exposure. The MiCAR transitional-period expiry similarly connects to the crypto monitor's licensing coverage of the same CSSF action, viewed here through the sanctions-evasion and unauthorised-provision enforcement lens rather than the licensing-taxonomy lens.

Outlook

The EU sanctions list's scheduled renewal is the key date to watch, given Luxembourg's now-confirmed role in the Usmanov/Fridman delisting linkage; a renewal that resolves or entrenches this deadlock would be a significant signal for designation-criteria divergence pressure across the EU more broadly. On the crypto-asset front, watch for the CSSF's first enforcement action against an entity operating without CASP authorisation post-1 July 2026, which would be the first live test of the newly-hardened perimeter. On the banking-sector AML/CFT front, continued CSSF fining activity focused on sanctions-screening delays would confirm this cycle's two cases as part of a broader supervisory sweep rather than isolated incidents.

weekly_brief_draft · JID LU
Domain intelligence (D1–D6)

D1 Sanctions Architecture and Evasion

Sanctions Architecture and Evasion

Continue reading

Luxembourg's sanctions-architecture footprint this cycle rests on two developments, each significant in a different way. The first is structural and negotiating-posture in nature: Luxembourg has linked a French and Slovak demand to delist Alisher Usmanov to its own position on Mikhail Fridman, who is separately arbitrating against Luxembourg over frozen assets. This tying of two unrelated delisting demands together deepens an EU sanctions-renewal delisting deadlock and represents a concrete instance of intra-EU designation-criteria divergence pressure ahead of the sanctions list's scheduled renewal. It is a signal that member-state negotiating leverage, not just Council-level consensus, now shapes the pace and content of EU sanctions-list maintenance. This claim rests on a single quality-press source (Euronews), and no Council document independently confirming Luxembourg's formal negotiating position was retrieved this cycle; it is carried as probable rather than confirmed.

The second development is litigation-based: the Bank of Russia filed a claim in a Luxembourg court on 15 September 2026 seeking to protect a Moscow Arbitration Court award against Euroclear over an estimated USD 230 billion in frozen assets. This follows the EU's indefinite extension of the sovereign-asset freeze under Council Regulation (EU) 2025/2600, and the litigation appears aimed at intervening in parallel Belgian proceedings involving Euroclear. This claim is sourced from a single law-firm client-alert blog, and no court filing or Council text was independently retrieved to corroborate it this cycle; it is carried as uncertain.

Taken together, these two developments position Luxembourg as a jurisdiction where sanctions-architecture contestation is being actively fought on two fronts simultaneously: at the political-negotiating level over delisting criteria, and at the judicial level over frozen-asset enforcement against settlement infrastructure. Luxembourg's dual role elevates its systemic significance in sanctions-evasion contestation this cycle beyond what either development would suggest alone.

Outlook

The EU sanctions list's scheduled renewal is the critical date to watch; how the Usmanov/Fridman delisting linkage resolves will be an early indicator of whether member-state negotiating leverage of this kind becomes a recurring feature of EU sanctions-list maintenance. On the litigation front, watch for any ruling or procedural development in the Luxembourg court proceedings brought by the Bank of Russia, and for independent confirmation of the claim's existence and content beyond the single law-firm source currently available.

D2 Beneficial Ownership

Not covered

Beneficial Ownership is not yet covered for this jurisdiction in this report.

D3 Enabler Jurisdictions

Not covered

Enabler Jurisdictions is not yet covered for this jurisdiction in this report.

D4 Conflict Finance

Not covered

Conflict Finance is not yet covered for this jurisdiction in this report.

D5 Crypto / Digital Assets / Financial Innovation

Crypto / Digital Assets / Financial Innovation

Continue reading

The defining development in Luxembourg's crypto and digital-asset landscape this cycle is the expiry, on 1 July 2026, of the MiCAR Article 143(3) transitional period for Luxembourg virtual-asset service providers. This 18-month transitional window had permitted entities already providing crypto-asset services under prior national law to continue operating pending CASP authorisation; its expiry means that unauthorised crypto-asset service provision in Luxembourg is now unlawful, a fact confirmed directly by the CSSF on its own website, a Tier 1 primary-source confirmation with no ambiguity about its legal effect.

From a financial-integrity perspective, this is a structural architecture shift rather than an incident: it converts what had been a supervised grey zone of tolerated legacy operators into a binary compliance state, where an entity is either fully CASP-authorised or operating unlawfully, with no intermediate category. This sharpens the enforcement theory available to Luxembourg's supervisor against any unauthorised actor, because the underlying conduct is now a standalone authorisation breach independent of whatever AML/CFT or sanctions-screening failing might separately be found.

A further signal, reported but not independently corroborated this cycle, is that Luxembourg's 2025 National Risk Assessment classified the crypto sector as high risk. This is a single-source report and is not treated as confirmed, but if accurate it would indicate that Luxembourg's own risk-assessment apparatus views the crypto sector's illicit-finance exposure as elevated at precisely the moment the authorisation perimeter has hardened, a combination that would typically precede intensified supervisory attention.

Outlook

The item to watch is whether the CSSF brings its first enforcement action against an entity operating without CASP authorisation following the 1 July 2026 transitional-period expiry, which would be the first live test of the newly-hardened perimeter. Independent confirmation of the reported high-risk National Risk Assessment classification of the crypto sector, from a primary source, would also materially sharpen the financial-integrity picture for this domain.

D6 Compliance Technology & Active Defence

Not covered

Compliance Technology & Active Defence is not yet covered for this jurisdiction in this report.

D7 AML/CTF Regime

Not covered

AML/CTF Regime is not yet covered for this jurisdiction in this report.

D8 Commercial Activity

Not covered

Commercial Activity is not yet covered for this jurisdiction in this report.

Regulatory horizon
Adopted2027-Q3 · ±year

EU AML Package (AMLR/6AMLD/AMLA) full application

AMLR CDD/EDD provisions and BO-register core provisions become directly applicable in Luxembourg independent of national 6AMLD transposition pace.
source not collected
1 dated · 4 pending date · baseline fim-2026-07-05
Role action cards
MLRO

CSSF fined two Luxembourg-linked banks this cycle for delayed sanctions-screening alerts, and the MiCAR authorisation perimeter for crypto-asset service providers hardened on 1 July 2026.

The Stonehage Fleming and Rakuten Europe Bank fines both centre on delayed restrictive-measures screening, indicating a live enforcement focus on sanctions-screening timeliness in the banking sector that MLROs at Luxembourg-supervised entities should note. Separately, the expiry of the MiCAR transitional period means unauthorised crypto-asset service provision is now unlawful, converting the authorisation question into a binary compliance state.

3 evidence refs
Compliance

Two CSSF enforcement actions this cycle target AML/CFT and sanctions-screening deficiencies at Luxembourg banks.

Stonehage Fleming Luxembourg S.A. and Rakuten Europe Bank S.A. were both fined for AML/CFT and sanctions-screening failings, breaching AML/CFT Law Art. 3(2)(d) and CSSF Regulation 12-02 Art. 33(1) in the former case. Compliance functions should note the specific control failures cited: delayed alert processing and outdated transaction-monitoring systems.

2 evidence refs
Legal

Luxembourg is now the venue for Bank of Russia litigation against Euroclear-adjacent settlement infrastructure, and is entangled in the EU's Usmanov/Fridman sanctions-delisting deadlock.

Legal counsel advising entities with Luxembourg or Euroclear exposure should note the Bank of Russia's 15 September 2026 court filing seeking to protect a Moscow arbitral award over roughly USD 230bn in frozen assets. Separately, Luxembourg's negotiating posture linking the Usmanov and Fridman delisting questions signals unresolved sanctions-list renewal dynamics with potential designation-criteria implications.

2 evidence refs
Board

Luxembourg's dual exposure to sanctions-architecture litigation and a hardened crypto-asset authorisation perimeter raises the jurisdiction's systemic significance this cycle.

Boards overseeing entities with Luxembourg operations should be aware that the jurisdiction now sits at the centre of both an EU sanctions-renewal delisting deadlock and high-value Euroclear-adjacent litigation, alongside a newly-hardened crypto-asset compliance perimeter and two banking-sector AML/CFT fines this cycle.

3 evidence refs
CTO

The MiCAR authorisation perimeter for Luxembourg crypto-asset service providers hardened into a binary compliance state on 1 July 2026.

Technology functions supporting crypto-asset infrastructure with a Luxembourg nexus should confirm CASP authorisation status is current, as the expiry of the Article 143(3) transitional period removes any legacy operating allowance; unauthorised provision is now a standalone compliance breach.

1 evidence refs
Risk

Luxembourg's risk profile this cycle is shaped by a convergence of sanctions-litigation exposure, MiCA supervisory-perimeter activation, and banking-sector AML/CFT enforcement.

Risk functions should note the mixed enforcement-vs-enablement and structural-vs-episodic signal for Luxembourg: primary domains this cycle are sanctions architecture, crypto/digital assets, and the AML/CFT regime, with the crypto sector separately reported (uncorroborated) as classified high risk in Luxembourg's 2025 National Risk Assessment.

5 evidence refs
Operations

No material change for this persona this cycle.

No material change for this persona this cycle

Audit

Two CSSF enforcement actions this cycle document specific control failures in sanctions-screening and transaction-monitoring at Luxembourg banks.

Internal audit functions should note the specific documented failures: hundreds of delayed sanctions-screening alerts and 42 unnoticed alerts at Stonehage Fleming, and an outdated transaction-monitoring system at Rakuten Europe Bank identified in 2023 findings. These provide a concrete benchmark for control-testing scope at comparable institutions.

2 evidence refs
Decision lens
MLRO

CSSF fined two Luxembourg-linked banks this cycle for delayed sanctions-screening alerts, and the MiCAR authorisation perimeter for crypto-asset service providers hardened on 1 July 2026.

Compliance

Two CSSF enforcement actions this cycle target AML/CFT and sanctions-screening deficiencies at Luxembourg banks.

Legal

Luxembourg is now the venue for Bank of Russia litigation against Euroclear-adjacent settlement infrastructure, and is entangled in the EU's Usmanov/Fridman sanctions-delisting deadlock.

Board

Luxembourg's dual exposure to sanctions-architecture litigation and a hardened crypto-asset authorisation perimeter raises the jurisdiction's systemic significance this cycle.

CTO

The MiCAR authorisation perimeter for Luxembourg crypto-asset service providers hardened into a binary compliance state on 1 July 2026.

Risk

Luxembourg's risk profile this cycle is shaped by a convergence of sanctions-litigation exposure, MiCA supervisory-perimeter activation, and banking-sector AML/CFT enforcement.

Operations

No material change for this persona this cycle.

Audit

Two CSSF enforcement actions this cycle document specific control failures in sanctions-screening and transaction-monitoring at Luxembourg banks.

Shared evidence: 5 refs
Scenario sketches

AMLA direct-supervision transition and cross-border obliged-entity onboarding

Illustrative orientation only: as the EU AML Package moves toward full application, cross-border obliged entities with a Luxembourg nexus could see their AML supervision gradually shift from purely national CSSF oversight toward a hybrid model involving AMLA direct or indirect supervision under the AMLA Regulation (Reg (EU) 2024/1620), alongside the directly-applicable AMLR (Reg 2024/1624) and per-state 6AMLD transposition. This could reshape how evasion typologies routed through Luxembourg-domiciled entities are detected and reported, as supervisory data and escalation channels realign around the new EU-level authority. This is architecture-over-incident framing: it describes a possible structural mechanism, not an observed fact or a prediction of how Luxembourg's supervision will actually evolve.

Illustrative scenario for analytical orientation only. Not compliance advice, not a prediction, and not a statement of observed fact.

Standing trackers (T1–T6)
TrackerStatusNote
T1 · Russian Sanctions-Evasion Architecturematerial_changeLuxembourg-seated litigation (Bank of Russia v. Euroclear-linked proceedings; Fridman v. Luxembourg PCA arbitration) and Luxembourg's delisting-leverage stance in the EU sanctions-renewal deadlock both materially engage this tracker.
T2 · EU AML Package / AMLAstableGeneral EU-level staggered transposition clock (BO-register provisions due 10 Jul 2026; full AMLR/AMLA application 10 Jul 2027) continues to run; no Luxembourg-specific transposition instrument identified this cycle.
T3 · FATF Grey Listno_changeLuxembourg is not FATF grey-listed; most recent mutual evaluation (adopted 2024) describes a solid AML/CFT framework.
T4 · Beneficial-Ownership Register Statusno_changeNo Luxembourg-specific BO-register development identified this cycle; general EEA-level harmonisation dates tracked under T2.
T5 · Crypto & Digital-Asset Integritymaterial_changeMiCAR transitional period for Luxembourg VASPs expired 1 July 2026; Ripple received full MiCA CASP authorisation from CSSF in July 2026; Luxembourg's 2025 NRA reportedly classified crypto sector as high risk.
T6 · Sanctions Regime Divergencematerial_changeLuxembourg's tying of its Fridman-delisting position to France/Slovakia's Usmanov-delisting demand is a concrete instance of intra-EU designation-criteria divergence pressure ahead of sanctions-list renewal.
Registers

Enforcement actions

  • FATF continued regular follow-up monitoring of Luxembourg's 2023 Mutual Evaluation Report, with the published assessment page updated as of December 2025, tracking Luxembourg's progress on flagged deficiencies in ML investigations, asset recovery and non-financial-sector supervision. 1 Dec 2025
  • Council Regulation 2025/2600 (adopted 12 December 2025, using Article 122 TFEU) prohibits, on a durable basis, transfers of immobilised Central Bank of Russia assets held by EU central securities depositories back to Russia, formalising obligations first imposed in February 2024 on CSDs holding more than €1 million of such assets. 12 Dec 2025
  • Russia's central bank filed a legal claim with the EU's General Court in Luxembourg contesting the Council's December 2025 regulation restricting transfers of immobilised Russian sovereign assets, following a related Moscow Arbitration Court suit against Euroclear over the same asset freeze. 3 Mar 2026

Sanctions changes

  • The EU's 20th sanctions package against Russia (adopted 23 April 2026) added 120 additional listings (33 individuals, 83 entities), including oligarchs, persons involved in the abduction of Ukrainian children, propagandists and persons responsible for looting cultural heritage, all enforceable within Luxembourg as an EU member state. 23 Apr 2026
  • Council Regulation 2025/2600 (12 December 2025) durably prohibits transfers of immobilised Central Bank of Russia assets held by EU CSDs (including Luxembourg-based entities) back to Russia, formalising the extraordinary-revenue mechanism that has already channelled four windfall-profit tranches (including a €1.4bn transfer in April 2026) to Ukraine. 12 Dec 2025
  • The European Commission adopted Delegated Regulations (EU) 2026/46 and (EU) 2026/83 (3-4 December 2025), amending Delegated Regulation 2016/1675 to update the EU list of high-risk third countries with strategic AML/CFT deficiencies, directly changing the enhanced-due-diligence obligations of Luxembourg-domiciled obliged entities dealing with counterparties in newly listed jurisdictions. 4 Dec 2025

Regulatory horizon (register)

  • EU AML Regulation (AMLR) becomes directly applicable in Luxembourg
  • AMLA begins direct supervision of selected cross-border entities
  • 6th AML Directive transposition deadline for Luxembourg
  • Luxembourg Recovery and Resilience Plan AML supervision-reform milestone

Active schemes

  • [HIGH] Post-CJEU closure of Luxembourg's beneficial ownership register
  • [HIGH] Luxembourg financial-market infrastructure in Russian asset-freeze architecture
  • VASP sector DPRK/ransomware exposure via Luxembourg registration
  • International financial centre as latent TF conduit
Sources
  1. FATF (multilateral first-party assessment of Luxembourg)
  2. FATF
  3. FATF
  4. Ministry of Justice, Grand Duchy of Luxembourg
  5. Council of the European Union
  6. European Commission
  7. European Commission Representation in Luxembourg
  8. Bloomberg
  9. OCCRP
  10. European Commission
  11. Elliptic (vendor analytics)
  12. European Commission
Coverage gaps
FATF's 2023 MER found Luxembourg needs to focus considerably…
FATF's 2023 MER found Luxembourg needs to focus considerably more on domestic money-laundering investigations, prosecutions and asset recovery, despite good use of financial intelligence and strong international cooperation on foreign confiscation requests.
Since the 2022 CJEU Sovim ruling, Luxembourg's beneficial-ow…
Since the 2022 CJEU Sovim ruling, Luxembourg's beneficial-ownership register (RBE) requires journalists and civil-society researchers to submit national ID, press credentials, proof of residence and a body of work before access is granted, a restriction still in force per 2025 civil-society tracking.
FATF's 2023 MER found risk-based supervision of TCSPs, real …
FATF's 2023 MER found risk-based supervision of TCSPs, real estate agents and notaries to be in early stages, with inspections of some high-risk DNFBP sectors — including professional directors supervised by the AED — not having started at the time of assessment.
This baseline could not locate a granular, named-entity CSSF…
This baseline could not locate a granular, named-entity CSSF administrative-sanctions register comparable in public detail to OFAC's civil-penalties disclosures for the 18-month window, despite the FATF MER noting historically 'diverging application of sanctions' among Luxembourg's AML/CFT supervisors.

Evidence

Confidence-tiered claims

EUR 56,000 administrative sanction on Stonehage Fleming Luxembourg S.A. for AML compliance failings including delayed sanctions-screening alert resolution SRC-fim-LU-002
Probable · 1 source
Sanctions-circumvention via a 2022 bond-exchange scheme alleged to have profited former executives by over EUR 9 million; referred by Finance Ministry to public prosecutor and CSSF SRC-fim-LU-003
Probable · 1 source
Circular 26/914 (25 June 2026) identifying obliged entities eligible for AMLA direct supervision from 2028 SRC-fim-LU-001
Confirmed · 1 source
Luxembourg on 2026-10-12 to consider a new Russia sanctions package targeting the military while delisting certain individuals SRC-fim-GLOBAL-001
Probable · 1 source
Internal-governance breaches but did not establish a sanctions breach or impose a fine SRC-fim-LU-004
Probable · 1 source