KYC.IO

Global Regulations and Requirements for KYC Onboarding
(powered by KYC-Chain)

KYC to onboard domestic persons

identity cardpassportnamedate of birthaddressidentity documents

KYC to onboard international persons

identity cardpassport

corporate requirements

Commercial Registerarticles of association

National ID card name

Luxembourgish identity card,

Does the country have Esignature Laws?

EU Regulation No. 910/2014 (2014) (eIDAS); e-Signatures Directive (1999/93/EC)

E-sig law files

What year did the relevant AML laws and regulations become effective?

2015

Further details on AML regime

1993 (amended 2004, 2008, 2010, 2012, 2015). The EU’s fourth AML Directive 2015/849/EC was issued on 20 May 2015. It has not been transposed in Luxembourg law yet. Laws & Regulations in force in Luxembourg for AML: a) Law of 12 Nov 2004 as amended on the fight against money laundering and terrorist financing b) Grand-ducal regulation of 01 Feb 2010 providing details on certain provisions of the amended law of 12 Nov 2004 on the fight against money laundering and terrorist financing c) Law of 27 Oct 2010 enhancing the anti-money laundering and counter terrorist financing legal framework; organising the controls of physical transport of cash entering, transiting through or leaving the Grand Duchy of Luxembourg; implementing United Nations Security Council resolutions as well as acts adopted by the European Union; concerning prohibitions and restrictive measures in d) Grand-ducal regulation of 29 Oct 2010 (co-ordinated version) enforcing the law of 27 Oct 2010 implementing United Nations Security Council resolutions as well as acts adopted by the European Union concerning prohibitions and restrictive measures in financial matters in respect of certain persons, entities and groups in the context of the combat against terrorist financing CSSF(Commission de Surveillance du Secteur Financier) Regulation N°12-02 financial matters in respect of certain persons, entities and groups in the conte e) Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financingxt of the combat against terrorist financing f) Regulation (EU) No 2015/847 of the European Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds

Who is the regulator for AML controls for Banking

CSSF(Commission de Surveillance du Secteur Financie

Link to site

http://www.cssf.lu/en/

Other financial Services

CSSF

Website of Regulator

http://www.cssf.lu/en/

Financial Sector regulator

N/A

Practical Guidance for AML

No, However a practical guide for the funds industry is in discussion and should be published in 2012 on the ALFI website (Association of the Luxembourg Fund industry)

Practical guidance PDF's

www.alfi.lu

Is there a requirement to verify the identity of customers retroactively?

Yes

Retroactive details

Yes

Has the country been the subject of FATF mutal evaluation in the last 3 years?

Yes

PDF of FATF review

mutualevaluationofluxembourg.html

Are there minimum transaction thresholds (Y/N)

Yes

More details on minimum transaction thresholds.

Yes – one-off transactions (single or linked) under EUR 15, 000.

What are the requirements for customer identification information for individuals

A copy (or certified true copy in the case of non face-to-face business) of an official identification document, for example a passport or identity card. Documents need to be reliable and might be provided by the customer but not produced by himself ('independent source'). If no copy is kept, the professional has to state in the account opening form: surname, first name, date of birth, address, profession and identification document number. The account opening form has to be dated and signed by the customer.

Details to be Collected on Corporates

Articles of Association (or equivalent), extract of the Commercial Register (or equivalent), business authorisation if the entity manages funds of third parties, identification of the beneficial owners holding over 25% and of the persons with authorised signatures.

What are the high level requirements around beneficial ownership (identification and verification)?

There is an obligation in the law to verify the identity of beneficial owners. Those who hold 25% or more of a corporate entity have to be identified. Where a principal owner is another corporate entity or trust, the firm should take measures to look behind that company or trust and establish the identities of its beneficial owners or trustees, unless that company is publicly quoted. The firm will then judge which of the beneficial owners exercise effective control, and whose identities should therefore be verified.

What circumstances are enhanced customer due diligence measures required?

Enhanced customer due diligence measures are required in situations which by nature present a higher risk of money laundering or terrorist financing and at least in the cases listed in Article3-2 of the Luxembourg AML Law (for example non face-to-face business, foreign Politically Exposed Persons ('PEPs') and cross-frontier correspondent banking relationships with respondent institutions from non EU countries)

How should FI's deal with Politically exposed persons

Enhanced customer due diligence measures are required for foreign PEPs, including the implementation of an appropriate risk-based procedure to detect such foreign PEPs, involving the senior management in the customer's acceptance, ascertaining the source of wealth/income and ensuring an enhanced ongoing monitoring of the relationship.

What enhanced due diligence must be performed for correspondent banking relationships?

For correspondent banking relationships, the professionals have to: a) gather sufficient information about the respondent institution to understand fully the nature of the respondent's business and to determine from publicly available information the reputation of the institution and the quality of supervision; b) assess the respondent institution's AML and CTF controls; c) obtain approval from senior management before establishing new correspondent banking relationships; d) document the respective responsibilities of each institution; and e) with respect to payable-through accounts, be satisfied that the respondent credit institution has checked the identity of and performed ongoing due diligence on the customers having direct access to the accounts of the correspondent and that it is able to provide relevant customer due diligence data to the correspondent institution upon request.

Are relationships with banks who might be considered a 'shell' and without substance permitted?

No - it is prohibited to enter into, or continue a correspondent banking relationship with a shell bank or with a bank that is known to permit its accounts to be used by a shell bank.

In what circumstances is additional due diligence required for non face-to-face transactions and/or relationships?

Enhanced customer due diligence measures are required for non face-to-face businesses. These include : a) obtaining additional documents, data or information that ensures adequate identification of customers; or b) performing additional measures to verify or certify the identification documents (for example, copies of identification documents certified true by a credit or financial institution or by a competent authority); or c) first payment to be drawn on an account opened in the customer's name with a credit institution.

To whom are SAR's made? (suspicious activity reports)

Financial Intelligence Unit (“FIU”) of the Luxembourg Public Prosecutors

Link to website of SAR reporting

http://www.justice.public.lu/fr/actualites/2010/09/rapport-activitecrf/index.html

Other Suspicious or unusual transactions obligations.

Are there any de-minimis thresholds below which transactions do not need to be reported?

No -all suspicious transactions, regardless of the amount, have to be reported.

Are there any penalties for non compliance with reporting requirements e.g. tipping off?

Offenders who knowingly violate AML/CTF legislation could face a fine up to EUR1.25 million and those guilty of professional negligence could face administrative and disciplinary sanctions.

Are there any requirements (legal or regulatory) to use automated Suspicious Transaction monitoring technology?

No. There is no legal or regulatory obligation to use automated Suspicious Transaction monitoring technology. However, it is highly recommended by the authorities to implement such a tool (CSSF circular 08/387).

Is there a requirement to obtain authority to proceed with a current/ongoing transaction that is identified as suspicious?

Professionals must refrain from carrying out a transaction which they know or suspect to be related to money laundering or terrorist financing before having informed the FIU. The FIU can give instructions not to execute one or more operations relating to the transaction or the customer. Where a transaction is suspected of giving rise to money laundering or terrorist financing and where to refrain in such manner is impossible or is likely to frustrate efforts to pursue the beneficiaries of a suspected money laundering or terrorist financing operation, the professionals concerned shall submit the necessary information immediately afterwards.

Does the local legislation allow transactions to be monitored outside the jurisdiction?

In practice, because of professional confidentiality the monitoring of transactions is not performed outside the jurisdiction. However, credit institutions and professionals of the financial sector forming part of a financial group shall guarantee to the group’s internal control bodies, where necessary, access to information concerning specific business relations, to the extent that this is needed for the global management of legal risks and risks to their reputation in connection with money laundering or the financing of terrorism within the meaning of the laws of Luxembourg.

Is there a legal requirement for a bank’s external auditor/other external organisation to report on the bank’s AML systems and controls?

N/A

If an external report on the bank’s AML systems and controls is required: a) how frequently must the report be provided?

N/A

To whom should the report on AML systems be submitted?

N/A

Is an AML system part of the financial statement audit?

N/A

What are the requirements for the content of this external report on a bank’s AML systems and controls? Does it require: a) sample testing of KYC files? b) sample testing of SAR reports? c) examination of risk assessments?

N/A

Data Protection Laws And Personal Data

N/A

Data Protection for Corporate Data

N/A

Data protection for "sensitive Data" and additional protections.

N/A

Do any restrictions on the transfer of credit reports exist?

N/A

Regulator Acronym

CSSF

Year of last FATF mutual evaluation

2004

Field 67

additional documentsdata or informationidentification of customersidentification documentsfirst payment

National ID card details

Issued at age 15 and only issued to Luxembourg citizens, who are required by law to carry it at all times.

Compulsory?

National ID source

N/A

Passport Photo

Is there a risk based approach

Legal Requirement

Requirement to proceed

Yes

requirement to use automated suspicious transaction tools

Who are SARS made to?

FIU-LPP

shell banks

EDD for correspondent banking

Yes

Minimum transactions

EUR 15, 000.

Min transaction USD

16377

If the AML laws and/or regulations became effective in the last 2 years, what were the requirements of the previous AML regime?

The Law effective 27/10/ 2010 comes as a consequence of the recommendations made by the FATF in early 2010. This Law reinforces and clarifies the previous legislation.

Non financial sector (e.g. casinos, high value goods etc.)

lawyers (barrister of the Bar)

Does the country have a risk based approach?

Yes

Where copies of identification documentation are provided, what are the requirements around independent verification or authentication?

If non face-to-face business is conducted, the copy should be certified as true by a competent authority, for example a consulate, embassy, police station or notary. By law, the customer information needs to be based on documents or data coming from reliable and independent sources.

Is there case law, other constitutional law or any other laws or regulations that may impact upon the transfer of information to this jurisdiction?

N/A

List of case law, constitutional law or any other laws or regulations that may impact upon the transfer of information.

N/A