The Luxembourg government and the CSSF recently have taken a number of measures to combat money laundering and terrorist financing. In other developments: the current Luxembourg Brexit laws will be rendered inapplicable by ratification of the agreement for the UK to withdraw from the EU; the CSSF has entered into a partnership with the University of Luxembourg pertaining to the use of digital technologies to review fund documents; the CSSF has published a Circular implementing IOSCO’s principles on liquidity management into Luxembourg regulation; and the second Anti-Tax Avoidance Directive has been implemented into Luxembourg law.

Update on Luxembourg Anti-Money Laundering and Combatting Terrorist Financing Activities

The implementation of anti-money laundering (AML) and combatting terrorist financing (CFT) measures has continuously been high on the agenda of the Luxembourg government and, in particular, the Luxembourg supervisory authority, the Commission de Surveillance du Secteur Financier (CSSF). The following is a discussion of related developments.

Publication of Circulars

The CSSF has published two new circulars in relation to the prevention of money laundering and terrorist financing: Circular 19/730 on 6 November 2019; and Circular 19/732 on 20 December 2019:

Circular 19/730¹ relates to statements of the financial action task force (FATF)² published at its plenary session in October 2019 concerning: jurisdictions whose respective AML and CFT regimes have substantial and strategic deficiencies or are otherwise “not satisfactory”; or jurisdictions for which (i) increased supervision must be implemented with respect to subsidiaries and branches of financial institutions based in Iran, (ii) enhanced control measures must be applied (including enhanced mechanisms for reporting suspicious transactions or systematic reporting of financial transactions), and (iii) an increased external audit is required with respect to financial group subsidiaries and branches located in Iran.

The purpose of Circular CSSF 19/732³ is to provide guidance to professionals subject to the CSSF’s AML/CFT supervision in relation to the legal requirements applicable to identifying and verifying the ultimate beneficial owner (UBO) of the customer, with a view to enhancing financial transparency. The Circular is divided in three parts: Part I describes the UBO identification requirements for customers that are natural persons, legal persons or legal arrangements; Part II describes the verification of identity requirements; and Part III summarises a July 2018 FATF report, providing useful indicators to detect the potential concealment of beneficial ownership information.

CSSF Further Expands and Clarifies AML/CFT Measures and Reporting Duties

As a member country of the FATF, Luxembourg in the past quarter has undertaken or published a variety of AML/CFT-related measures in line with the FATF Recommendations⁴, as well as in light of the upcoming on-site visit to Luxembourg by FATF peer member countries⁵. These measures are summarised below.

National Risk Assessment is Made Available to Interested Parties

In accordance with FATF Recommendation 1, Luxembourg conducted a national risk assessment (NRA)⁶, the findings of which continue to shape Luxembourg’s AML/CFT measures framework. The NRA has identified the investment fund and private banking sectors as sectors with high inherent money laundering and terrorist financing risks.

Measures in Relation to the Investment Fund Sector

The CSSF has issued the following publications in the last calendar quarter:

• Update to AML/CFT investment market entry forms for funds and investment fund managers (IFMs) on 7 November 2019. This is an update to a form first published in May of this year, which aimed to collect standardised key information in relation to money laundering and terrorist financing risks for the fund vehicles that are set up under Luxembourg law and regulated by the CSSF (i.e., UCITS, Part II UCIs, SIFs, SICARs, ELTIFs, EUSEFs, EUVECAs and money market funds (collectively, Funds)).
  
  In addition, the CSSF has introduced a new form in relation to IFMs under its supervision. This form is required for alternative investment fund managers (AIFMs) that are authorised and supervised by the CSSF, as well as those that are below the threshold for authorisation but are neverthless registered with the CSSF.
  
  Both forms must be: provided for any new application by a Fund or an IFM; and renewed for any modification to an existing application by a Fund or an IFM (e.g., launch of a new sub-fund, addition/extension of a license, or change of an IFM’s shareholder structure).
• New frequently asked questions (FAQs) in relation to persons involved in AML/CFT for a Fund or an IFM supervised by the CSSF. The FAQs provide guidance for: those appointed as members of the management bodies responsible for AML/CFT compliance (RRs); and certain high-level compliance officers (RCs).
  
  The CSSF has taken the position that every Luxembourg Fund and IFM subject to its AML/CFT supervision is legally required to appoint both an RR and an RC, in light of: the results of the NRA regarding AML/CFT risk exposure of the Collective Investments sector (i.e., Funds); and the fact that this the NRA considers this sector to be high-risk.

In the CSSF’s view, this means for Funds that:

• The RR can be the board of directors (or other governing body) acting as a collegial body. Alternatively, the board may appoint one of its members as the RR.
• The RC must be mandated intuitu personae by the board of directors (or other governing body) of the Fund. The RC may be a member of the board with relevant appropriate experience. There are further requirements for RCs, including with respect to third-party RCs.

For IFMs supervised by the CSSF for AML/CFT purposes, the following rules apply:

• The RR can be: the entire board of directors (or other governing body) of the IFM acting as a collegial body; or a member of the board of directors (or other governing body).
• The RC must be a high-level compliance officer in charge of AML/CFT matters for the IFM.

FAQs Regarding AML/CFT for Individuals/Investors

The CSSF has further updated its FAQs with an (almost) complete restatement dated 15 November 2019⁷.

CSSF and ABBL Publish Luxembourg’s First AML/CFT Risk Analysis of the Private Banking Sector

Building on the findings of the NRA, the CSSF and the Luxembourg bankers’ association (association de banques et banquiers, Luxembourg, ABBL) published a risk assessment⁸, which takes a closer look at: AML/CFT inherent risks; risk-mitigating factors applied by banks and competent authorities; the related impact on inherent risk; and the resulting residual risk level. The CSSF expects supervised entities engaging in private banking activities to reflect the findings and conclusions from this sub-sector risk assessment in their frameworks to ensure that such frameworks continue to effectively mitigate AML/CFT risks.

Press Release: Survey Related to the Fight against Money Laundering and Terrorist Financing

In press release 19/57 dated 28 November 2019 (AML/CFT Press Release)⁹, the CSSF reminded market participants of the 3 February 2020 launch of its annual online survey for the collection of standardised key information for 2019 concerning AML/CFT risks to which professionals under CSSF supervision are exposed¹⁰. The CSSF’s implementation of related risk mitigation and targeted financial sanctions measures also will be launched on this date.

The self-assessment AML/CFT risk survey must be initiated and submitted via the CSSF eDesk portal¹¹ by a member of the management body of the entity (preferably the individual who is responsible for AML/CFT compliance). However, completion of this survey may be delegated to another employee of the entity. Note that the CSSF has imposed fines for improper completion of the survey¹².

Brexit: Postponement of Deadline for CSSF Notifications

In light of the further postponement of the deadline for the withdrawal of the UK from the European Union, the CSSF issued a press release on 6 November 2019 (Brexit Press Release)¹³ to adapt the reference date for a “no-deal” Brexit in its previously published communications; the reference date now should be read as 31 January 2020. The Brexit Press Release further provides 15 January 2020 as new deadline for submitting to the CSSF Brexit-related authorisation requests, notifications or other required information.

Luxembourg’s Brexit laws¹⁴ authorise the CSSF to grant a transitional period¹⁵ for (inter alia) investment firms, AIFMs and UCITS management companies established in the UK (UK Firms) to continue to provide their services to Luxembourg clients, AIFs and UCITS after the withdrawal of the UK from the EU without a withdrawal agreement¹⁶. As it is currently likely that the withdrawal agreement will be ratified by 31 January 2020, the Luxembourg Brexit laws will not be applied. Instead, the withdrawal agreement provides a transitional period, whereby EU law (and consequently the relevant passports) will continue to be applied in the UK through 31 December 2020¹⁷.

CSSF Concludes Partnership to Prepare for the Use of New Digital Technologies in Reviewing Fund Documents

The CSSF and the University of Luxembourg’s Centre for Security, Reliability and Trust entered into a partnership agreement on 24 October 2019, designed to enable Luxembourg to serve as a European centre of excellence and innovation in the field of artificial intelligence (AI). Within the context of the CSSF’s “4.0 strategy” ²², the CSSF will consider making extensive use of new digital technologies (e.g., AI, machine learning and other tools commonly applied throughout the fintech sector). The first project to be undertaken by the partnership will be to develop an automated system to check fund documents, using AI to extract data from documents submitted to the CSSF to verify regulatory compliance. The project is designed to enable the CSSF to rapidly distinguish between passages of prospectuses that may require in-depth review and those that can be approved as a routine matter.

CSSF Publishes Circular to Implement IOSCO Principles on Liquidity Risk Management

The CSSF published a Circular on 20 December 2019²³, which implements into Luxembourg regulation IOSCO’s principles on liquidity risk management dated February 2018. The Circular is applicable to any IFM (or branch) in Luxembourg or that manages open-ended UCIs (as well as self-managed SIFs). Consequently, IFMs should take the IOSCO recommendations into account, as early as possible in the design process of a given fund, and should put in place an adequate liquidity management process and contingency plans.

ATAD 2 implementation

The Luxembourg Parliament has implemented the second Anti-Tax Avoidance Directive²⁴ (ATAD2) with a law dated 20 December 2019. The law, which covers hybrid mismatches with third countries, extends the scope of existing Luxembourg anti-hybrid rules to additional categories of mismatches and to mismatches with third countries. The law became effective on 1 January 2020 (other than for reverse hybrid provisions applicable as of tax year 2020).

Footnotes