AML/CFT in Luxembourg: What Changed in 2025 and 2026

13 Oct AML/CFT in Luxembourg: What Changed in 2025 and 2026

Last updated: 13 October 2026. Written by the KYC Lookup Team.

Quick answer: Luxembourg’s anti-money laundering and counter-terrorist financing (AML/CFT) rules changed significantly in 2025 and 2026. Since 19 December 2025, an “all-crimes” approach means any crime or misdemeanour can be a predicate offence for money laundering. Access to the Register of Beneficial Owners has been restricted since 1 February 2025. The Law of 16 July 2026 further updated the main AML law. The next big change is the EU AML Regulation, which will apply directly from 10 July 2027.

Why Luxembourg’s AML/CFT rules matter

Luxembourg is one of the world’s leading financial centres, with a globally significant investment fund industry, a large wealth management sector and substantial cross-border flows. That makes it attractive to criminals trying to launder the proceeds of crimes committed elsewhere, such as tax crime, corruption and fraud.

Its framework is built on the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, together with EU requirements and Financial Action Task Force (FATF) standards.

Key changes at a glance

1. The “all-crimes” approach (December 2025)

This is the most important change for compliance teams. Luxembourg previously listed the offences that counted as predicate offences for money laundering. Since 19 December 2025, the money laundering offence in Article 506-1 of the Criminal Code covers the proceeds of any crime or misdemeanour, including offences committed abroad where they are also punishable in that country.

What it means in practice: your duty to detect and report suspicions now extends to the proceeds of all types of crime, not just financial or economic crime. When you file a report, you don’t need to identify the exact underlying offence.

2. Restricted access to the beneficial owner register (February 2025)

Following a 2022 ruling of the Court of Justice of the European Union, Luxembourg ended public access to its Register of Beneficial Owners (RBE). Under the Law of 23 January 2025, access has been limited since 1 February 2025 to national authorities, professionals subject to AML/CFT obligations and persons who can demonstrate a legitimate interest.

What it means in practice: AML/CFT professionals can still use the register as part of customer due diligence. However, it doesn’t replace your own checks, so you must still identify and verify beneficial owners yourself.

3. The Law of 16 July 2026

The most recent amendment to the 2004 AML law gives Luxembourg’s national AML/CFT prevention committee a clearer legal role, introduces a regular cycle for reviewing the national risk assessment, and formalises the collection of AML/CFT statistics.

What it means in practice: keep your firm’s own risk assessment aligned with the latest national risk assessment, and expect supervisors to focus on the risks it identifies.

4. The EU AML package and AMLA

In 2024, the EU adopted a major AML package. The Anti-Money Laundering Authority (AMLA), based in Frankfurt, began operating in 2025. From 10 July 2027, the EU AML Regulation will apply directly in Luxembourg and across the EU, replacing many national rules with a single rulebook.

What it means in practice: start reviewing your policies and procedures now, so you’re ready for the new rulebook in 2027.

What hasn’t changed: your core obligations

Regulated entities in Luxembourg must still:

• Assess their risks and apply a risk-based approach.
• Conduct customer due diligence and identify beneficial owners.
• Monitor business relationships on an ongoing basis.
• Apply enhanced due diligence to higher-risk customers, including politically exposed persons (PEPs).
• Screen against sanctions lists and apply asset freezes without delay.
• Keep records for at least five years after the relationship ends.
• Report suspicious activity to the Cellule de Renseignement Financier (CRF) without delay, through the goAML platform.
• Avoid tipping off the customer.
• Train employees regularly.

Asset freezes and other financial sanctions measures must also be reported in writing to the Ministry of Finance without delay. Professionals supervised by the CSSF must notify the CSSF at the same time.

How Luxembourg performs internationally

In its 2023 mutual evaluation, the FATF rated Luxembourg compliant or largely compliant with 39 of its 40 Recommendations, a significant improvement on its previous evaluation. The FATF also recommended further work in areas including understanding terrorist financing risks and risk-based oversight of non-profit organisations.

Train your team on the latest Luxembourg rules

KYC Lookup’s AML/CFT in Luxembourg course covers the key laws, supervisors, core obligations, money laundering typologies and reporting requirements, all updated for the 2025 and 2026 changes. It’s fully online and self-paced, and can be delivered to whole teams through a learning management system.

FAQs

What is the main AML law in Luxembourg? The Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended. It was most recently amended by the Law of 16 July 2026.

What is the “all-crimes” approach? Since 19 December 2025, any crime or misdemeanour can be a predicate offence for money laundering in Luxembourg, including offences committed abroad where they are also punishable there.

Who is Luxembourg’s Financial Intelligence Unit? The Cellule de Renseignement Financier (CRF). Suspicious transaction reports are submitted to it through the goAML platform.

Who supervises AML/CFT in Luxembourg? The CSSF supervises the financial sector, the CAA supervises insurance, the AED supervises certain non-financial businesses such as real estate agents, and self-regulatory bodies supervise professions such as lawyers, notaries and accountants.

Is the Luxembourg beneficial owner register public? No. Since 1 February 2025, access has been restricted to authorities, AML/CFT professionals and persons with a legitimate interest.

When does the EU AML Regulation apply? From 10 July 2027.