AML Asset due diligence CSSF regulation 12/02
Since 2020, every professional supervised by the CSSF for AML/CFT purposes must assess the money laundering and terrorist financing risk of the assets it invests in, not only of the investors it accepts. On 13 December 2024 the CSSF published an FAQ that finally says how far that obligation goes: listed securities get a light touch, unlisted assets carry the weight.
This analysis reads the FAQ against the text it interprets, Article 34(2) of CSSF Regulation No 12-02. It then turns to the person who has to make the whole system work: the compliance officer, or RC, whose appointment, profile and duties are set by Articles 40 to 43. It is written for fund boards, investment fund managers, conducting officers, compliance officers (RC) and the persons responsible for compliance (RR).
34(2)
The article of Regulation 12-02 that creates asset due diligence
5
Months after year end to submit the RC’s annual summary report to the CSSF
3
Operations named by the CSSF as triggers: purchase, transfer, sale
0
Exemptions from sanctions screening: the FAQ does not cover it
Two texts, one obligation
Asset due diligence sits on a short paragraph of binding regulation and a short piece of supervisory interpretation. Neither makes sense without the other.
CSSF Regulation No 12-02
Adopted on 14 December 2012, it details the Law of 12 November 2004 on the fight against money laundering and terrorist financing. CSSF Regulation No 20-05 of 14 August 2020 rewrote large parts of it and added Article 34(2), the investment-side obligation. The English coordinated text is for information only: where it differs from the French, the French prevails.
The CSSF FAQ of 13 December 2024
Version 1 of the FAQ on AML/CFT asset due diligence obligations. Three questions on scope and frequency, all tied to Article 34(2). It is not law, but it states what the CSSF expects and what it will accept on inspection, which is what matters in practice.
- 14 December 2012CSSF Regulation No 12-02 adopted (Mémorial A No 5 of 9 January 2013).
- 14 August 2020CSSF Regulation No 20-05 amends it and introduces the asset due diligence obligation in Article 34(2) (Mémorial A No 695 of 20 August 2020).
- 13 December 2024The CSSF publishes its FAQ: risk-based relief for listed securities, a clear trigger list for unlisted assets.
The rule: Article 34(2)
Article 34 sits in the chapter on ongoing due diligence, under “activities requiring particular attention”. Its second paragraph reads:
“In the framework of investment business, the professionals shall carry out an analysis of the ML/TF risk posed by the investment and take due diligence measures adapted to the risk assessed and documented. Such analyses shall be formalised. The risk analysis on investments shall be reviewed annually and when particular events require it.”
CSSF Regulation No 12-02, Article 34(2), as introduced by CSSF Regulation No 20-05
Broken down, the paragraph contains four distinct duties.
- Analyse
- Assess the ML/TF risk posed by each investment. The risk is the asset’s, not the investor’s: who sits behind it, where it is, how its price is formed, how the money flows.
- Adapt
- Calibrate due diligence to the risk found. The same logic as Article 6(2) for customers: the higher the risk, the deeper the measures.
- Formalise
- Write it down. An assessment that exists only in an analyst’s head does not exist for the CSSF or the statutory auditor.
- Review
- Annually, and whenever particular events require it. This is the sentence the FAQ later softens.
Listed vs unlisted: where the line falls
The FAQ’s central contribution is a split. Drawing on its own ML/TF assessments, peer reviews and input from the members of the public-private partnership OPC AML, the CSSF concludes that securities admitted to trading on a regulated market are less exposed to ML/TF risk, because market disclosures and controls already do part of the work.
For those securities, the CSSF considers it sufficient, for the purposes of Article 34(2), that the professional can demonstrate on request that they are actually admitted to trading on a regulated market. Everything else is “unlisted” and keeps the full obligation.
| Admitted to trading on a regulated market | Not admitted (unlisted) | |
|---|---|---|
| CSSF survey label | “Listed assets” | “Unlisted assets” |
| What Article 34(2) requires | Evidence, on request, that the security is admitted to trading on a regulated market | A formalised ML/TF risk assessment and due diligence proportionate to it |
| When due diligence runs | No asset-level due diligence beyond the evidence of admission | On each purchase, transfer or sale, and when a change in the asset raises its risk |
| Review | Keep the evidence current: a delisting moves the asset to the other column | Annual, unless nothing relevant changed during the year |
| Sanctions screening | Still required, outside the FAQ | Still required, outside the FAQ |
Concretely: a UCITS buying a government bond admitted to trading on an EU regulated market files the evidence of admission and moves on. A private equity fund acquiring a stake in a non-listed company runs a documented risk assessment of the target, the seller and the transaction before closing.
What “regulated market” covers, and what it does not
The FAQ does not define the term. In EU law, a regulated market is a specific category of trading venue under MiFID II, and the venues that hold that status are listed in ESMA’s register. That has practical consequences the FAQ leaves to each professional.
- Multilateral trading facilities are not regulated markets. A bond listed only on an MTF, such as the Luxembourg Stock Exchange’s Euro MTF, does not fall within the wording of the relief.
- Third-country exchanges are not addressed. Whether a security traded only on a non-EEA exchange benefits from the same treatment is a question the FAQ does not answer. Decide it in your procedures, justify it, and apply it consistently.
- “Admitted to trading” is a status, not a history. The evidence must show the security is admitted at the time it matters, which is why a delisting or suspension needs to reach the AML team.
- Units of unlisted target funds are unlisted assets. A fund of funds subscribing into a non-listed fund is within the full regime on that operation.
Read the relief narrowly. The FAQ uses “regulated market”, not “exchange” or “listed”. Where your classification goes beyond the strict MiFID II meaning, the burden of justification is yours.
When due diligence is triggered
The FAQ states that the CSSF expects AML/CFT due diligence on assets in two situations, which can occur together.
An operation on an unlisted asset
A purchase, a transfer or a sale of an asset not admitted to trading on a regulated market. The CSSF’s list is introduced by “e.g.”, so treat it as illustrative: a subscription, a capital call into a holding vehicle or a loan disbursement follows the same logic.
A change that raises the risk
A change in the asset that results in a higher ML/TF risk. Examples a procedure should name: a new beneficial owner of the target, a move to a higher-risk jurisdiction, adverse media, a counterparty appearing on a list, or a delisting that turns a listed asset into an unlisted one.
What the due diligence contains is not prescribed by the FAQ. In practice, for an unlisted acquisition, it usually covers the identity and beneficial ownership of the target and of the counterparty, the jurisdictions involved, the origin of the asset and the economic rationale of the deal, and whether the price is plausible against fair value. An unexplained premium or discount is one of the classic warning signs.
Review frequency: annual, but not a re-run
Article 34(2) says the risk analysis on investments “shall be reviewed annually”. The FAQ adds a pragmatic reading: the initial risk assessment sets the depth of due diligence, measures are adapted if the assessment changes, and where no relevant change occurred during the year, a renewal of the annual risk assessment is not required.
The two statements are reconciled if the annual review is understood as a check, not a redo. Our reading, to be validated against your own legal advice:
- Keep an annual, dated confirmation per unlisted asset that no relevant change occurred, with the sources you checked.
- Define in the procedure what counts as a “relevant change”, so the decision not to renew is a rule applied, not an opinion.
- Where a change is found, re-perform the assessment and adapt the due diligence at once, without waiting for the annual cycle.
What the FAQ does not cover: sanctions
The FAQ’s disclaimer is explicit: it does not refer in any way to international financial restrictive measures, the targeted financial sanctions. The relief for listed securities is a relief on ML/TF risk assessment only.
Sanctions obligations come from elsewhere in the regulation and apply in full. Article 33 requires professionals to identify without delay the States, persons, entities and groups subject to restrictive measures involved in a transaction or relationship. Article 39(1a) extends this to the assets the professional manages, with the duty to ensure that funds are not made available to those persons. Article 33(3) requires the screening system, internal or provided externally, to be updated without delay when official lists change.
A listed issuer can still be sanctioned. Admission to trading on a regulated market removes the need for an asset-level ML/TF assessment. It does not remove the need to screen the issuer and the counterparties.
A practical asset due diligence workflow
One way to turn Article 34(2) and the FAQ into a repeatable process, from the investment decision to the annual review.
Classify
Tag every position as admitted or not admitted to trading on a regulated market, by ISIN and venue, using the ESMA register as the reference.
Evidence the listed side
Store the evidence of admission so it can be produced on request, and refresh it when venues or listings change.
Assess the unlisted side
Score each unlisted asset on the target, its owners, the counterparty, the jurisdictions, the structure and the price. Formalise the result.
Scale the measures
Apply due diligence proportionate to the score before each purchase, transfer or sale. Escalate high-risk cases to the compliance officer.
Screen everything
Run sanctions screening on issuers and counterparties for all assets, listed or not, and on every list update.
Monitor and review
Watch for risk-raising changes during the year; confirm annually, in writing, where nothing relevant changed.
Keep the classification consistent with your answers to the CSSF’s annual AML/CFT questionnaire under Article 4(3). The FAQ itself ties “listed” and “unlisted” to the vocabulary of CSSF surveys, so a mismatch between procedure and survey is easy to spot.
The compliance officer: who runs the system
Asset due diligence, like every other AML/CFT obligation, needs an owner. Regulation 12-02 splits that ownership between two people, known in Luxembourg by their French acronyms: the RR (responsable du respect des obligations), who answers for compliance at management level, and the RC (responsable du contrôle du respect des obligations), who implements AML/CFT and controls that it works.
The distinction is not semantic. The RR carries accountability; the RC carries the control function. Confusing the two is one of the most common governance weaknesses in smaller structures.
| Compliance officer (RC) | Person responsible for compliance (RR) | |
|---|---|---|
| Definition (Art. 1) | The person who implements AML/CFT and controls compliance with the professional obligations | The member of the authorised management responsible for AML/CFT; where there is no authorised management, a Board member or the Board as a whole |
| Legal basis of appointment (Art. 40(1)) | Point (a) of the second subparagraph of Article 4(1) of the Law | Fourth subparagraph of Article 4(1) of the Law |
| Place in the organisation | Second line of defence (Art. 39(7)) | Management body; acts as “senior management” for correspondent relationships, PEPs, high-risk countries and group policies (Art. 28(4), 30(2), 31(2), 38(3)) |
| Supervisory system (Art. 39(6)) | Controls it regularly and adapts it | Validates it initially, at least |
| Annual summary report (Art. 42(6)–(7)) | Prepares it | Submits it to the CSSF |
| Independence (Art. 43) | Independence, objectivity and decision-making autonomy; adapted workload | Independence and objectivity |
Article 40: appointment, notification, profile
Article 40 is short, but each of its three paragraphs creates an obligation the CSSF checks. Articles 41, 43 and 45 complete it.
“The compliance officer and the person responsible for compliance shall have the professional experience, knowledge of the Luxembourg legal and regulatory framework relating to AML/CFT, the hierarchy and powers within the entity (including the power to access on a timely basis the identification data of customers and other information and documentation required by the due diligence measures), as well as the availability necessary to the effective and autonomous exercise of their functions.”
CSSF Regulation No 12-02, Article 40(3)
- Appoint
- Article 40(1): every professional appoints an RR at the level of the authorised management or the Board, and an RC in charge of controlling compliance with the AML/CFT obligations.
- Outsource
- Article 40(1): investment fund managers and investment funds subject to AML/CFT supervision by the CSSF may appoint a third party, taking into account CSSF guidance published in circulars or FAQs.
- Notify
- Article 40(2): the names of the RR and the RC, and any information prior to changes regarding these functions, are communicated to the CSSF. The wording is “prior to”: a departure is announced before it happens, not after.
- Qualify
- Article 40(3): experience, knowledge of the Luxembourg framework, real hierarchy and powers, timely access to customer data, and enough time to do the job.
- Delegate
- Article 41: the RC may delegate the exercise of the function to one or more employees connected to the professional, provided they meet the Article 40(3) criteria. The RC’s responsibility is unchanged.
- Combine
- Article 43: holding other functions must not impede the RC’s independence, objectivity and decision-making autonomy, and the workload must leave the AML/CFT framework effective. The same applies to the RR’s independence and objectivity.
- Recruit
- Article 45: recruitment procedures apply to all staff and particularly to the RC and the RR, to ensure adequate professional standing and experience. For members of the management, an extract of the police record or equivalent is required.
The RC can be outsourced; the responsibility cannot. When a fund appoints a third-party RC under Article 40(1), the general rule of Article 37(3) still applies: responsibility for compliance stays with the professional that delegates. In our reading, the Article 40(3) and 43 criteria apply to the third party as much as to an employee, which makes availability the decisive question when one external RC covers many vehicles. The outsourcing contract must set out roles and access rights clearly (Art. 37(4)).
What the RC actually does: Article 42
Article 42 is the job description. Read paragraph by paragraph, it gives the RC eight distinct mandates.
| Paragraph | Mandate | In practice |
|---|---|---|
| 42(1) | Apply the AML/CFT policy and procedures; propose to the authorised management, on own initiative, any useful measure, including the release of required means. | The RC can ask for staff, budget or tools. Put those requests in writing: they show the function was not passive. |
| 42(1a) | Ensure the quality of first-line controls and, as second line, verify compliance with all AML/CFT obligations. | Sample first-line files, including investor KYC and asset assessments, and record the results. |
| 42(2) | Control compliance in branches and majority-owned subsidiaries, in Luxembourg and abroad; ensure compliance with group-wide policies, including data protection and information sharing. | Obtain and analyse the summaries of audit and compliance reports of those entities. |
| 42(3) | Prepare, implement and ensure the realisation of the training programme of Article 46. | A documented plan with content, calendar and attendance, adapted to each population. |
| 42(4) | Act as privileged contact for the Luxembourg AML/CFT authorities and for the authorities competent for financial restrictive measures; transmit information and statements to them. | One named channel to the CSSF, the FIU and the sanctions authorities. |
| 42(5) | Run regular risk-based controls and report in writing, regularly and ad hoc, to the RR, the authorised management and, where appropriate, the Board. | Each report follows up past findings, lists new ones with their risks and seriousness, proposes corrective measures and judges the adequacy of the framework. |
| 42(6) | Prepare, at least once a year, a summary report on the RC’s activities and operation. | Submitted to the RR, the authorised management, the Board and, where appropriate, specialised committees. |
| 42(7) | The RR submits the summary report to the CSSF within five months of financial year end. | Not required for Luxembourg funds that designated a Luxembourg management company submitting this annual report. |
Article 42(5) also sets what the reports must allow: assessing the scale of suspicions or reasonable grounds for suspicion that were identified, and expressing a judgement on the adequacy of the AML/CFT policy, procedures and systems, and on the collaboration between departments. The RC takes into account the internal reports received under Articles 12, 13 and 39(4).
The RC across the regulation
Beyond Articles 40 to 43, the RC appears at every point where a decision must leave the first line.
| Article | When the RC steps in |
|---|---|
| Art. 9(1) | Acceptance of customers with a high-risk profile requires at least the systematic intervention of the RC. |
| Art. 12 and 13 | Where identity cannot be verified within the internal timeframe, an internal report goes to the RC. |
| Art. 25(2) | Reports sent to the RC, the RC’s analyses and the resulting decisions are retained. |
| Art. 31(2) | Relationships linked to high-risk countries require the systematic involvement of the RC in acceptance and written authorisation of the authorised management. |
| Art. 38(4) | AML/CFT procedures are regularly reviewed by the RC and the internal audit function. |
| Art. 39(4)–(5) | Transactions or persons identified by the supervisory system are reported in writing to the RC, who alone decides on the application, scope and termination of the measures, in consultation with management and the RR. |
| Art. 39(6) | The supervisory system is validated initially at least by the RR and controlled regularly by the RC. |
| Art. 48(2) | The RC function analyses reports and decides whether to report to the FIU; the professional registers in the FIU’s tool; analysis and decision are kept in writing. |
Where the RC meets asset due diligence
Article 34(2) does not name the RC. The RC is nonetheless involved at every stage, because asset due diligence is an AML/CFT procedure like any other.
- Methodology. The asset risk methodology and the listed/unlisted classification rule are AML/CFT procedures, reviewed by the RC under Article 38(4).
- Second-line testing. Under Article 42(1a), the RC samples unlisted acquisitions and checks that evidence of admission to trading is on file for listed securities.
- Escalation. A high-risk unlisted asset, an implausible price or an opaque counterparty is reported to the RC under Article 39(4), and may lead to an FIU report under Article 48.
- Sanctions hits. If an issuer or counterparty is listed, restrictive measures apply without delay and the competent authorities are informed, with a copy to the CSSF (Art. 33(2)); the RC is the privileged contact (Art. 42(4)).
- Delegated portfolio managers. Where portfolio management is delegated, the RC verifies how the delegate performs asset due diligence, as part of the Article 37(2a) monitoring.
- Training. Investment teams, not only transfer agency staff, need training on asset due diligence (Art. 42(3) and 46).
- Reporting. Asset due diligence findings and shortcomings belong in the Article 42(5) reports and in the annual summary report.
From the RC’s summary report to the SRRC
The annual summary report of Article 42(6) is what the CSSF collects as the AML/CFT summary report RC, or SRRC. Its mechanics, as published by the CSSF and summarised in our guide to CSSF reporting for UCIs:
- Drafted by
- The RC, at least once a year, covering the RC’s activities and operation over the past year.
- Addressed to
- The RR, the authorised management, the Board and, where appropriate, specialised committees.
- Submitted by
- The RR, to the CSSF.
- Deadline
- Within five months following the end of the professional’s financial year.
- Channel
- eDesk “AML/CFT Summary report RC” or the API (S3), under Circular CSSF 24/854.
- Exemption
- Luxembourg investment funds that designated a Luxembourg management company submitting this annual report.
Check the exemption condition, not just the structure. It covers funds whose management company is Luxembourg-based and actually submits the report. A fund managed from another Member State does not fall within the wording.
Asset due diligence in the wider Regulation 12-02 framework
Article 34(2) does not stand alone. Several other provisions decide who owns the process, how it is approved and how it is checked.
| Article | What it requires | Why it matters for asset due diligence |
|---|---|---|
| Art. 4 | Risk assessment fed by the supranational and national risk assessments, sub-sector assessments, the ESA Risk Factor Guidelines and CSSF publications; risk appetite approved by the Board. | These are the sources the asset risk methodology should cite, and the risk appetite sets which unlisted assets are acceptable at all. |
| Art. 6 and 38 | AML/CFT policy approved by the Board; procedures approved by the authorised management or, for investment funds supervised by the CSSF, by the Board. | The asset due diligence procedure needs the same approval chain as any other AML/CFT procedure. |
| Art. 32 | Identification of complex or unusual transactions, and analysis of the economic background of funds involved. | An unusually priced or structured acquisition is a transaction to analyse, not only an asset to classify. |
| Art. 37(2a) | Risk assessment of outsourced functions; IFMs perform due diligence on registrar and transfer agents, delegated portfolio managers and investment advisers. | Where portfolio management is delegated, the IFM remains responsible and must check how the delegate performs asset due diligence. |
| Art. 39 | Supervisory system covering customers and transactions; documented searches, including those with no hit. | A screening or review with no result still needs a record. |
| Art. 44 and 49 | Internal audit tests AML/CFT policies and procedures; the statutory auditor reviews AML/CFT compliance, with sampling tests. | The formalised assessments are what both lines of audit will sample. |
Where asset due diligence goes wrong
The obligation is short. The failure modes are predictable.
| Cause | What happens |
|---|---|
| “Listed” read as “on any exchange” | MTF-only or non-EEA securities are classified under the relief without a documented justification. |
| No evidence of admission on file | The FAQ asks the professional to demonstrate admission on request. Without the evidence, the relief cannot be shown to apply. |
| Relief applied to sanctions | Listed issuers drop out of screening because they are “low risk”, although the FAQ expressly excludes targeted financial sanctions. |
| Delistings not passed on | An asset leaves the regulated market and stays in the light-touch bucket. |
| Silent annual review | Nothing changed, so nothing was written. The CSSF and the auditor then see no review at all. |
| Delegated managers not checked | The asset analysis is performed by a portfolio manager the IFM never assessed, contrary to Article 37(2a). |
| Procedure and survey disagree | Assets counted as “unlisted” in the CSSF questionnaire have no matching assessment in the files. |
| RC change notified after the fact | Article 40(2) requires information prior to changes. A resignation discovered by the CSSF in the next SRRC is a finding in itself. |
| An external RC with no time | One third-party RC covers dozens of vehicles and cannot evidence the availability Article 40(3) and the adapted workload Article 43 require. |
| RC and RR merged in practice | The same person accepts high-risk files and controls them afterwards. The second line ends up checking its own decisions. |
| Reports without follow-up | Article 42(5) requires each report to track past recommendations. A list of new findings with no status on the old ones does not meet it. |
Frequently asked questions
What is AML/CFT asset due diligence?
The obligation, under Article 34(2) of CSSF Regulation No 12-02, to analyse the money laundering and terrorist financing risk posed by an investment, take due diligence measures adapted to that risk, formalise the analysis and review it annually and when events require it.
Do listed securities need an ML/TF risk assessment?
According to the CSSF FAQ of 13 December 2024, for securities admitted to trading on a regulated market it is sufficient to demonstrate, on request, that they are actually admitted to trading on such a market. Sanctions screening remains required.
When does due diligence apply to unlisted assets?
When operations take place on assets not admitted to trading on a regulated market, such as a purchase, transfer or sale, and when a change in the asset has resulted in a higher ML/TF risk.
Must the asset risk assessment be renewed every year?
The regulation requires an annual review. The FAQ accepts that if no relevant change happened during the year, a renewal of the annual risk assessment is not required. Documenting that check is the safest way to show the review took place.
Does the FAQ cover targeted financial sanctions?
No. Its disclaimer excludes international financial restrictive measures. Articles 33 and 39(1a) of the regulation still require screening of the persons and entities linked to the assets a professional manages.
What is the difference between the RC and the RR?
The RR is the member of the authorised management (or of the Board, where there is no authorised management) who is responsible for AML/CFT compliance. The RC is the compliance officer who implements AML/CFT and controls compliance as the second line of defence. The RC prepares the annual summary report; the RR submits it to the CSSF.
Can an investment fund appoint an external compliance officer?
Yes. Article 40(1) allows investment fund managers and investment funds subject to AML/CFT supervision by the CSSF to appoint a third party. Responsibility for compliance stays with the fund or manager, and the RC must still meet the experience, knowledge, powers and availability criteria of Article 40(3).
Must the CSSF be informed when the RC changes?
Yes, and in advance. Article 40(2) requires the names of the RR and the RC, and any information prior to changes regarding these functions, to be communicated to the CSSF.
When is the RC’s annual summary report due?
The RR submits it to the CSSF within five months following the end of the financial year (Article 42(7)). Luxembourg funds that designated a Luxembourg management company submitting this report are not required to file their own.
Who is the “professional” for an investment fund?
The regulation applies to the professionals supervised, authorised or registered by the CSSF for AML/CFT purposes, which includes investment funds and their managers. Where a Luxembourg management company is designated, it carries much of the operational burden, but responsibility for delegated tasks stays with the entity that delegates them.
Sources and related
Sources: CSSF, FAQ on AML/CFT asset due diligence obligations in accordance with CSSF Regulation No 12-02, 13 December 2024, version 1; CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended by CSSF Regulation No 20-05 of 14 August 2020, coordinated text. Both are published on cssf.lu. This article is an analysis, not legal advice; the CSSF texts prevail.
Regulatory data, ready for the CSSF
Fund XP builds the Excel solutions that turn your fund data into the exact files Luxembourg supervisors accept. Tell us which obligations you handle and we will show you how.