Pillar guide

CSSF Regulation 12-02 explained: what your AML/CFT policy must contain

CSSF Regulation 12-02 article by article: risk-based approach, CDD, RR and RC, monitoring, training, and the policy content list a Luxembourg inspector checks.

Draft — under review by the ComplyKit editorial team.

CSSF Regulation 12-02 is the operational rulebook behind the Law of 12 November 2004. The Law says what a Luxembourg professional must achieve; the Regulation says how, article by article, and it is the text an inspector opens next to your policy. This guide maps its chapters to the sections your AML/CFT policy must contain, as the framework stands in September 2026.

Where 12-02 sits in the hierarchy of sources

The FATF Recommendations set the international standard. The EU turns them into directives, today AMLD4 and AMLD5, and from 10 July 2027 into a directly applicable Regulation, the AMLR. Luxembourg transposes the directives through the Law of 12 November 2004 and the Grand-ducal Regulation of 1 February 2010. CSSF Regulation 12-02, consolidated on 26 August 2020 after its single amendment by CSSF Regulation 20-05, is the layer beneath: it details the obligations for every professional the CSSF supervises for AML/CFT purposes. Circulars, FAQs and the EBA Guidelines the CSSF adopts by circular sit below it again.

A policy that cites the Law and the Regulation together, in that order, and then the circulars relevant to its sector, has its legal framework chapter right.

Who the Regulation applies to

Every professional listed in Art. 2 of the 2004 Law that the CSSF supervises under Art. 2-1(1): credit institutions, investment firms and PFS, UCITS management companies and authorised AIFMs, and the UCIs and SICARs that market their own units. RAIFs and unregulated AIFs are obliged entities under the Law but are supervised by the AED, not the CSSF, so for them the Regulation applies as best practice rather than as a binding text. The distinction matters for the wording of your legal framework chapter; the guide on CSSF versus AED supervision walks through it.

Chapter 3: the risk-based approach (Art. 3–7)

Article 4 requires an overall assessment of the ML/TF risk of the activity that incorporates the supranational, national and sub-sector risk assessments, and it is where the CSSF expects to find your risk appetite. Article 5 requires an individual risk classification for each business relationship, using the factors in Annexes III and IV. Article 6 requires policies, controls and procedures proportionate to that risk, approved by the board. Article 3 adds a specific point for the fund sector: enhanced measures on intermediaries in fund subscriptions.

In the policy this becomes one section, usually the third, that explains how the business-wide risk assessment feeds the customer risk classification and the control intensity. The BWRA itself is a separate document; the policy states its methodology in one paragraph and refers to it.

Chapter 4: customer due diligence (Art. 8–37)

This is the longest chapter and the one policies most often paraphrase without structure. The articles group naturally:

• Acceptance and identification (Art. 8–20). Customer acceptance policy, refusal procedures, no anonymous accounts, the data required for natural and legal persons (Art. 16–17), verification methods including electronic identification (Art. 18–19), and persons acting on behalf of the customer (Art. 20). Occasional transactions of EUR 15,000 or more trigger due diligence under Art. 14; this is a CDD threshold, not a reporting threshold.
• Beneficial owner (Art. 21–23). Information required, verification against customer information, central registers and independent sources, and control below the threshold. Circular 19/732, amended by 24/861, sets the cascade: ownership or control above 25%, control by other means, and only after exhausting all means the senior managing officials.
• Purpose and origin of funds (Art. 24).
• Retention (Art. 25), read with Art. 3(6) of the Law: five years, extendable by up to five further years.
• Enhanced and simplified measures (Art. 26 and 26a). Article 26 lists the enhanced measures; Article 26a, added in 2020, is the simplified regime: verification of regulated customers from official sources, a rebuttable low-risk presumption where the first payment comes from an EEA credit-institution account in the customer's name, and event-driven rather than periodic updating. Art. 35(2) then requires an annual check that the conditions for simplified measures still hold.
• Specific situations (Art. 27–34). Non face-to-face relationships, correspondent relationships, politically exposed persons with six-monthly review and senior management involvement (Art. 30), high-risk countries with RC involvement and authorised management approval (Art. 31), complex and unusual transactions (Art. 32), restrictive measures screened without delay (Art. 33), and activities requiring particular attention (Art. 34).
• Review (Art. 35) and third parties (Art. 36–37). Introducers must be qualified and commit in writing; outsourcing under Art. 37 requires a contract that sets out the CDD measures the delegate applies, immediate transmission of information, a documented selection process covering sub-delegates, ongoing monitoring, and a documented risk assessment of the outsourced function under Art. 37(2bis). Responsibility continues to lie with the professional.

Only the EU list of high-risk third countries, Commission Delegated Regulation (EU) 2016/1675 as amended, triggers the mandatory enhanced measures of Art. 31. The FATF lists inform the risk assessment and are the early warning, but they are not the legal trigger.

Chapter 5: internal management (Art. 38–46)

Article 38 is the article that defines a policy. It requires written AML/CFT policies and procedures proportionate to size, activity and structure, lists their content, requires group-wide coordination, validation by the board or authorised management, and a three-lines-of-defence organisation. Article 39 requires monitoring systems that detect PEPs, funds from high-risk countries, unusual transactions and missing transfer information, with a four-eyes principle on the customer database and written reports to the RC.

Articles 40 to 43 create the two named functions. The RR, at management body level, and the RC, the compliance officer, are appointed under Art. 40 and their names communicated to the CSSF. The RC's duties in Art. 42 include the annual summary report to the CSSF within five months of the financial year end. Article 41 allows the RC to delegate to qualified employees; Art. 43 governs combining the RC function with other roles and protects the independence of the RR.

Article 44 requires internal audit to test the framework independently and report annually to authorised management and the board. Article 45 covers recruitment and professional standing. Article 46 requires ongoing, function-specific, documented training, with basic training for new hires and a named contact person for questions.

What the policy must therefore contain

Read together, Art. 6 and Art. 38 give the content list an inspector expects. In practice a compliant AML/CFT policy has these sections, each carrying its article reference:

1. Purpose, scope and legal framework, including delegated functions and the hierarchy of sources.
2. Governance: board, RR, RC, compliance function, reporting lines, the annual RC report.
3. Risk-based approach and the link to the business-wide risk assessment.
4. Customer due diligence: standard, simplified and enhanced measures, PEPs, high-risk countries, reliance and outsourcing.
5. Sanctions and asset-freezing measures under the Law of 19 December 2020.
6. Suspicious transaction reporting to the CRF through goAML, with the tipping-off prohibition of Art. 5(5) of the Law.
7. Record keeping and data protection.
8. Training, review cycle and version control, with the board approval block.

Two things distinguish a policy that passes from one that is sent back. The first is that every control in the policy has an owner and a procedure behind it; the policy states the rule, the procedure states the workflow and the form. The second is that the risk appetite and the risk classification are the entity's own, derived from its BWRA, not copied from a generic template.

What changes with the AMLR

From 10 July 2027, Regulation (EU) 2024/1624 applies directly and replaces the AMLD4/5 rules that the 2004 Law and Regulation 12-02 transpose. The structure of the policy survives; the references, the beneficial ownership threshold, which moves from more than 25% to 25% or more, several CDD triggers and the record-keeping wording do not. The regulatory update on the AMLR lists what to change and when. As at September 2026 no Luxembourg bill adapting the 2004 Law to the AMLR had been published, so keep the AMLR references in the policy marked as applicable from 10 July 2027.

Implementation checklist

• Legal framework chapter cites the 2004 Law, Regulation 12-02 and the sector circulars, in that order.
• Risk appetite approved by the board and referenced by the BWRA (Art. 4).
• Customer risk classification with the Annex III and IV factors (Art. 5).
• Simplified measures used only where Art. 26a allows, with the annual re-check of Art. 35(2).
• PEP procedure with six-monthly review and senior management involvement (Art. 30).
• EU high-risk country procedure with RC involvement and management approval (Art. 31).
• Screening without delay and list updates documented (Art. 33).
• Outsourcing contracts with the Art. 37 clauses and a documented risk assessment of each outsourced function.
• RR and RC appointed, communicated to the CSSF, with the annual summary report scheduled within five months of year end (Art. 40–42).
• Internal audit coverage and annual report (Art. 44); training programme documented (Art. 46).

This article is general information for compliance practitioners. It is not legal advice.