Luxembourg -- AML/CFT Compliance Regulatory Overview

Luxembourg has proactively incorporated virtual asset service providers (VASPs) into its anti-money laundering (AML) and counter-terrorist financing (CFT) framework, aligning with European Union directives. The Commission de Surveillance du Secteur Financier (CSSF) is the primary supervisory authority.

Here's a breakdown of the AML/KYC requirements for cryptocurrency/virtual asset service providers in Luxembourg:

1. AML/CFT Legislation

Luxembourg's AML/CFT framework for VASPs is primarily based on the transposition of EU Directives into national law.

• EU Directives:
  • Directive (EU) 2015/849 (4th AML Directive): Laid the groundwork for strengthening AML/CFT rules across the EU.
  • Directive (EU) 2018/843 (5th AML Directive): Critically, this directive extended the scope of AML/CFT rules to include virtual asset service providers, bringing them under the regulatory purview.
• Luxembourg National Law:
  • Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the "AML Law"): This is the cornerstone legislation. It was significantly amended by the Law of 25 March 2020 to transpose the 5th AML Directive, explicitly including virtual asset service providers as "professionals" subject to AML/CFT obligations.
  • CSSF Regulation N° 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing: This regulation, though predating the full VASP inclusion, sets out general professional obligations and is complemented by specific CSSF guidance.
  • CSSF Circular 20/747 (as amended by Circular 22/815): This circular is crucial for VASPs as it consolidates and specifies the AML/CFT professional obligations under the amended AML Law for all entities subject to CSSF supervision, including VASPs. It provides detailed guidance on risk assessment, customer due diligence, internal organisation, and reporting requirements.

2. Definition of Virtual Asset Service Providers (VASPs)

Under Luxembourg law, a "virtual asset service provider" is defined broadly to include entities that provide services relating to virtual assets (cryptocurrencies) on behalf of third parties. This typically encompasses:

• Exchange services: Exchanging virtual assets for fiat currencies or other virtual assets.
• Custodial wallet providers: Entities that provide services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual assets.
• Transfer of virtual assets: Services involving the movement of virtual assets between addresses or accounts.
• Issuance of virtual assets: Services related to the offering or sale of new virtual assets.

These entities are required to register with the CSSF to operate legally in Luxembourg.

3. Customer Due Diligence (CDD) Requirements

VASPs in Luxembourg must apply a risk-based approach to CDD, meaning the intensity of the due diligence should be proportionate to the assessed money laundering and terrorist financing risk.

• Identification and Verification:
  • Natural Persons:
    • Obtain and verify the customer's name, residential address, date and place of birth, nationality, and a unique identification number (e.g., from a passport or national ID card).
    • Verify identity using reliable, independent source documents, data, or information (e.g., government-issued photo ID, proof of address utility bill).
  • Legal Entities (Companies, Foundations, etc.):
    • Obtain and verify the company's name, legal form, registered address, articles of association, list of directors, and proof of incorporation.
    • Identify and verify the identity of individuals who hold senior management positions.
    • Beneficial Ownership (UBO): Identify and take reasonable measures to verify the identity of the beneficial owner(s) (any natural person who directly or indirectly owns or controls 25% or more of the shares or voting rights, or otherwise exercises control over the entity). For trusts or similar legal arrangements, identify the settlors, trustees, beneficiaries, and any other person exercising ultimate control.
    • Consult relevant registers (e.g., the Luxembourg Register of Beneficial Owners - RBE).
• Purpose and Intended Nature of the Business Relationship: Understand the rationale behind the customer's use of virtual asset services.
• Ongoing Monitoring:
  • Scrutinize transactions undertaken throughout the course of the relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.
  • Regularly review and update customer identification data, especially for high-risk clients.
• Enhanced Due Diligence (EDD): Required for situations posing a higher ML/TF risk, including:
  • Politically Exposed Persons (PEPs), their family members, and close associates.
  • Transactions involving high-risk jurisdictions.
  • Complex or unusually large transactions, and all unusual patterns of transactions, that have no apparent economic or lawful purpose.
  • Business relationships or transactions conducted with customers from countries identified by FATF as having strategic AML/CFT deficiencies.
  • Specific virtual asset types or transaction patterns deemed high-risk (e.g., anonymity-enhanced cryptocurrencies, mixing services).
• Simplified Due Diligence (SDD): May be applied in limited, specifically defined low-risk situations, but generally very restricted in the virtual asset sector due to inherent risks.

4. Suspicious Transaction Reporting (STR)

VASPs are obligated to report any suspicion or reasonable grounds to suspect money laundering or terrorist financing to the relevant authorities.

• Reporting Authority: The Cellule de Renseignement Financier (CRF), Luxembourg's Financial Intelligence Unit (FIU).
• Reporting Obligation: Reports must be made promptly when a suspicion arises.
• No Tipping-Off: VASPs and their employees are prohibited from disclosing to the customer concerned, or to third parties, that an STR has been or will be made, or that an investigation is being or may be carried out.

5. Record-Keeping Obligations

VASPs must maintain comprehensive records to enable the reconstruction of transactions and demonstrate compliance with AML/CFT requirements.

• Retention Period: Generally five years after:
  • The end of a business relationship with a customer.
  • The date of an occasional transaction.
• Types of Records to Keep:
  • Copies of all documents obtained for CDD (identification, verification).
  • Records of all transactions, including amounts, types of virtual assets, dates, parties involved (including wallet addresses or transaction IDs), and the means of payment.
  • Records of correspondence relating to the customer relationship.
  • Records of any analysis undertaken concerning suspicious transactions.
  • Copies of all suspicious transaction reports made to the CRF.
  • Records of internal risk assessments, policies, procedures, and staff training.

6. Oversight Authority

• Commission de Surveillance du Secteur Financier (CSSF):
  • The CSSF is the primary financial supervisory authority in Luxembourg responsible for the prudential supervision of banks, investment firms, payment institutions, electronic money institutions, and since the 5th AML Directive, virtual asset service providers.
  • It is responsible for granting registration to VASPs, supervising their AML/CFT compliance, issuing specific regulations and guidance, and enforcing compliance through sanctions if necessary.

Regulatory Body URLs:

• Commission de Surveillance du Secteur Financier (CSSF):
  • Website: https://www.cssf.lu/
  • Relevant Section for Virtual Assets/Fintech: https://www.cssf.lu/en/fintech/
• Cellule de Renseignement Financier (CRF - Luxembourg FIU):
  • Website: https://crf.gouvernement.lu/en.html

Disclaimer: The regulatory landscape for virtual assets is constantly evolving. It is crucial for VASPs operating in Luxembourg to consult the latest legislation, CSSF circulars, and professional guidance, and seek legal advice to ensure ongoing compliance.