AMLR - What Changes for Luxembourg Firms Under the New EU AML Regulation

Last updated: March 2026

Your compliance team has spent years building its AML framework around the Luxembourg Law of 12 November 2004, as amended, which transposes the EU Anti-Money Laundering Directives. That framework is about to be replaced. Not amended. Replaced. The AMLR (Regulation (EU) 2024/1624), published on 19 June 2024, is a directly applicable EU regulation that will become the single AML/CFT rulebook for every obliged entity in the EU from 10 July 2027. On that date, the customer due diligence rules, the beneficial ownership requirements, the suspicious transaction reporting obligations, and the internal controls framework that your teams operate under will change in substance and in legal form.

This article covers what the AMLR changes for Luxembourg financial institutions and other obliged entities: the shift from directives to a regulation, the expanded scope, the new CDD and EDD requirements, the creation of AMLA, and the practical steps to start preparing now. If you file STRs, maintain KYC files, or run an AML compliance function in Luxembourg, this is the transition you need to plan for.

Related reading: AML Reporting in Luxembourg

The AML Package: Four Instruments, One Framework

The AMLR does not exist in isolation. It is one of four legislative instruments adopted in 2024 that together overhaul the EU’s AML/CFT framework. Understanding the instruments is necessary because their interaction determines how the new regime works in practice.

Regulation (EU) 2024/1624 (the AMLR)

The Anti-Money Laundering Regulation is the single rulebook. It contains the core obligations: customer due diligence (CDD), enhanced due diligence (EDD), beneficial ownership identification and verification, suspicious transaction and activity reporting, internal controls, and record-keeping. Because it is a regulation, not a directive, it applies directly in all Member States without national transposition. Luxembourg cannot add gold-plating or interpret the rules differently from Germany or France. The same text applies everywhere.

This is the fundamental shift. Under the current framework, Directive (EU) 2015/849 (AMLD4, as amended by AMLD5) sets the minimum standards. Each Member State transposes them into national law, creating 27 slightly different AML regimes. Luxembourg’s version lives in the Law of 12 November 2004, as amended. After 10 July 2027, the AMLR’s CDD and EDD provisions apply directly, overriding the corresponding provisions of national law.

Directive (EU) 2024/1640 (AMLD6)

The Sixth Anti-Money Laundering Directive covers the areas that cannot be fully harmonized through a regulation: the powers and structure of national supervisory authorities and Financial Intelligence Units (FIUs), the AML supervisory framework, access to beneficial ownership registers, and the administrative sanctions regime. Luxembourg must transpose AMLD6 into national law by 10 July 2027.

For compliance teams, AMLD6 matters because it governs how the CSSF will supervise AML compliance going forward and how the FIU (the Cellule de Renseignement Financier, or CRF) will operate. The Directive also requires Member States to ensure that national supervisory authorities have sufficient powers, resources, and independence to enforce the new single rulebook effectively.

Regulation (EU) 2024/1620 (the AMLA Regulation)

The third instrument creates the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA), headquartered in Frankfurt. AMLA will directly supervise a selection of high-risk cross-border financial entities and coordinate between national supervisory authorities. AMLA begins direct supervision from 1 January 2028.

For most Luxembourg firms, AMLA will operate in the background: coordinating standards, issuing guidelines, and running the oversight system for FIUs. For a small number of Luxembourg-based entities with cross-border operations in six or more Member States and a high ML/TF residual risk profile, AMLA could become the direct supervisor. The selection process under Article 12 of the AMLA Regulation runs in two stages: first identifying entities operating in at least six Member States, then classifying their ML/TF risk profile as low, medium, substantial, or high. Only those rated “high” qualify for direct supervision.

Regulation (EU) 2023/1113 (Recast Transfer of Funds Regulation)

The fourth instrument is the recast Transfer of Funds Regulation (TFR), which extends the travel rule to crypto-asset transfers. The TFR requires payment service providers and crypto-asset service providers to ensure that transfers of funds and crypto-assets are accompanied by information on the payer/originator and the payee/beneficiary. For CASPs, this means collecting and transmitting originator and beneficiary data with every crypto-asset transfer, with no de minimis threshold. The TFR complements the AMLR by addressing the specific traceability requirements for funds and crypto-asset transfers that the regulation-level CDD rules do not cover in detail.

Application Timeline

The AMLR was published in the Official Journal on 19 June 2024 and entered into force on 9 July 2024. However, it does not apply until 10 July 2027. This three-year implementation period is the window for compliance teams to prepare.

Key dates:

19 June 2024: AMLR published in the Official Journal
9 July 2024: Entry into force
10 July 2025: Deadline for Member States to designate national supervisory authorities and FIUs under AMLD6 (Article 74)
10 July 2027: AMLR becomes directly applicable. AMLD6 transposition deadline. The current AML directive framework is repealed.
1 January 2028: AMLA begins direct supervision of selected obliged entities
10 July 2029: Delayed application date for professional football clubs and agents

In practice, Luxembourg’s transposition of AMLD6 will require amendments to the Law of 12 November 2004, the CSSF’s supervisory procedures, and possibly the CRF’s operational framework. The CSSF has not yet published detailed implementation guidance, but obliged entities should not wait for it. The AMLR text is final and directly applicable. You can start your gap analysis now.

Expanded Scope of Obliged Entities

New Entities Brought Into Scope

The AMLR significantly expands the list of obliged entities compared to AMLD4/AMLD5. The most notable additions include:

Crypto-asset service providers (CASPs) as defined under MiCAR (Regulation (EU) 2023/1114). Under the current framework, CASPs were brought into scope by AMLD5, but the AMLR consolidates and tightens the requirements.
Crowdfunding service providers under Regulation (EU) 2020/1503.
Mortgage and consumer credit intermediaries not already covered as financial institutions.
Professional football clubs and agents, where the value of transactions involving the transfer of professional football players exceeds a specified threshold. This is new territory for AML regulation and reflects concerns about money laundering through the football transfer market. Note: the AMLR provides a delayed application date of 10 July 2029 for professional football clubs and agents, giving this sector an additional two years to prepare.
Traders in luxury goods (precious metals, precious stones, jewellery, watches, motor vehicles, watercraft, aircraft, and cultural goods). The thresholds are differentiated by goods category: for example, the general cash transaction threshold is EUR 10,000, but specific goods categories may have different trigger points depending on the nature and value profile of the goods. The AMLR details the applicable thresholds per category.

For Luxembourg, the CASP addition is directly relevant. Luxembourg has a growing number of licensed CASPs under MiCAR, and they will be subject to the full AMLR CDD framework from July 2027. The football clubs provision is less impactful in Luxembourg but could affect entities involved in sports finance or transfer intermediation.

Impact on Existing Obliged Entities

Entities already subject to the Luxembourg AML Law (credit institutions, investment firms, management companies, AIFMs, payment institutions, insurance undertakings, etc.) remain obliged entities under the AMLR. The scope does not shrink. What changes is the source of the obligation: it shifts from national law implementing AMLD4/AMLD5 to the directly applicable AMLR text.

In practice, this means your AML policy documents, procedures manuals, and training materials will need to reference the AMLR articles instead of the Law of 12 November 2004. The substance is largely similar, but the detail has changed in several important areas.

Customer Due Diligence: What Changes

Standardized CDD Measures

The AMLR harmonizes CDD requirements across the EU. Under the current directive framework, Member States have discretion in how they implement CDD. Luxembourg has been relatively prescriptive (the CSSF’s Regulation 12-02, for example, adds detail to the Law). Under the AMLR, the core CDD requirements are set at EU level. Member States cannot add requirements that contradict the regulation, though they may maintain certain national measures during a transitional period where explicitly permitted.

The standard CDD measures under the AMLR (Article 20) include:

Identifying and verifying the identity of the customer
Identifying the beneficial owner and taking reasonable measures to verify their identity
Understanding the ownership and control structure of the customer (where the customer is not a natural person)
Assessing and obtaining information on the purpose and intended nature of the business relationship
Conducting ongoing monitoring of the business relationship

These are familiar. The change is in the detail. The AMLR specifies more precisely what “reasonable measures” for beneficial ownership verification mean (Article 22(7)(b)), including consulting public registers, tax registers, passport databases, and land registers. The EBA is developing RTS under the AMLR that will further specify these requirements, including the minimum information to be collected, the verification standards, and the conditions for simplified and enhanced due diligence.

Beneficial Ownership: Enhanced Requirements

The beneficial ownership framework under the AMLR is more prescriptive than under AMLD4/AMLD5. Key changes include:

The 25% ownership threshold for identifying beneficial owners of legal entities is maintained for now. However, the AMLR includes a review clause empowering the European Commission to assess, by 10 July 2029, whether the threshold should be lowered to 15%. If the assessment concludes that a lower threshold is warranted, the Commission can adopt a delegated act to reduce it. This means the 25% threshold may not be permanent. The AMLR also requires obliged entities to understand the full ownership and control structure, not just identify the persons above the threshold.
Where no individual meets the 25% threshold, the AMLR requires identification of the person(s) exercising control through other means (voting rights, shareholder agreements, etc.). If no natural person can be identified, the senior managing official(s) must be recorded as the beneficial owner, but the obliged entity must document the steps taken and the reasons why no natural person could be identified.
Verification of beneficial ownership information must be performed using independent and reliable sources. The AMLR explicitly lists the types of sources (Article 22(7)(b)) and the EBA is developing RTS on the reasonable measures for verification.
For trusts and similar legal arrangements, the AMLR requires identification of the settlor, trustee(s), protector (if any), beneficiaries or class of beneficiaries, and any other natural person exercising ultimate effective control.

In my experience, beneficial ownership verification is the area where most Luxembourg firms will need the most remediation. Current practices vary widely. Some firms rely heavily on the Luxembourg Register of Beneficial Owners (RBE). The AMLR raises the bar on what constitutes adequate verification, and the upcoming EBA RTS will set a floor that may be higher than what many firms currently do.

Simplified Due Diligence: Narrower Scope

The AMLR restricts the circumstances in which simplified due diligence (SDD) may be applied. Under the current framework, Member States have discretion to define low-risk categories eligible for SDD. The AMLR sets EU-wide conditions for SDD and limits the national discretion to add categories.

In practice, Luxembourg firms that currently apply SDD based on national low-risk categories defined in the CSSF’s sectoral guidance may find that some of those categories no longer qualify for SDD under the AMLR. A gap analysis comparing your current SDD categories against the AMLR’s Article 33 conditions is essential before July 2027.

Enhanced Due Diligence: More Prescriptive

The AMLR standardizes EDD requirements, reducing the current variation between Member States. Article 34 specifies the additional measures that must be applied in high-risk situations, including:

Additional information on the customer and beneficial owners (source of wealth, source of funds)
Enhanced ongoing monitoring (increased frequency and scope of transaction reviews)
Senior management approval for entering into or continuing high-risk business relationships

Mandatory EDD situations remain: PEPs, correspondent banking relationships with third-country institutions, and complex or unusually large transactions with no apparent economic purpose. The AMLR adds further detail on the EDD measures required for each mandatory category.

Politically Exposed Persons: Harmonized Framework

The AMLR harmonizes the PEP framework across the EU. Under the current regime, the definition of a PEP is in AMLD4, but Member States have discretion on how they maintain and publish the list of domestic PEP functions. The AMLR requires each Member State to publish a list of prominent public functions that qualify as PEP positions, using a standardized format.

The de-escalation period after a PEP leaves office is addressed in the AMLR. Under the current Luxembourg framework, former PEPs remain subject to EDD for a minimum of 18 months after leaving office. The AMLR harmonizes this across the EU, requiring obliged entities to continue applying risk-sensitive measures for a period after the PEP has left the prominent public function. The exact duration and the conditions for de-escalation should be reviewed directly against the AMLR text (Title II, Chapter III) once your gap analysis begins. Compliance teams should also track the EBA RTS on PEP measures, which will provide further detail on the risk-sensitive approach to former PEPs.

For Luxembourg, with its concentration of EU institutions, international organizations, and cross-border financial services, the PEP population is significant. Any change to the PEP framework has outsized operational impact here compared to most other Member States.

Suspicious Transaction Reporting

The AMLR maintains the obligation to report suspicious transactions and activities to the national FIU. For Luxembourg, this means the CRF remains the recipient of STRs filed through the goAML platform. The fundamental obligation does not change, but the AMLR introduces more standardized requirements for:

The content and format of STRs (to be specified by AMLA in cooperation with the FIUs)
Feedback mechanisms from FIUs to obliged entities
Coordination between FIUs where suspicious transactions have cross-border elements

In practice, the STR reporting workflow for most Luxembourg firms is unlikely to change dramatically on day one. The goAML platform and the CRF’s procedures will need to align with the AMLR standards, but the operational shift for reporting officers will be incremental. The more significant change is on the internal controls side: the AMLR’s requirements for transaction monitoring systems and automated alert generation are more detailed than the current directive framework.

Internal Controls and Compliance Function

The AMLR sets out detailed requirements for the internal AML/CFT governance framework. Article 9 requires obliged entities to establish and maintain policies, controls, and procedures that are proportionate to the size, nature, and risk of the entity. The requirements cover:

An AML/CFT compliance function with a nominated compliance officer responsible for AML/CFT compliance at management board level
Independent audit of the AML/CFT framework (the internal audit function or an external auditor must test the effectiveness of policies and procedures)
Employee screening procedures to ensure that staff involved in AML/CFT functions are fit and proper
Training programs for staff, including the content, frequency, and documentation of training
Whistleblowing channels for reporting AML/CFT concerns internally

Most Luxembourg credit institutions and investment firms already have these elements in place, driven by the CSSF’s existing expectations. The change is that these requirements will be at the regulation level (directly applicable, no national discretion), and the EBA/AMLA will issue guidelines and RTS providing further specificity. The gap for firms that are currently operating at the minimum will widen.

AMLA: What It Means for Luxembourg

Direct Supervision Scenario

AMLA will directly supervise a small number of selected obliged entities from 1 January 2028. The selection criteria focus on cross-border presence (operations in at least six Member States) and high ML/TF residual risk. Luxembourg’s role as a financial center with significant cross-border activity means that some Luxembourg-headquartered entities could be candidates for AMLA direct supervision.

The selection process under Article 12 of the AMLA Regulation runs in two stages. First, AMLA identifies all credit institutions and financial institutions operating in at least six Member States (including the home Member State), either through establishment or through relevant activity under the freedom to provide services. Second, AMLA classifies the ML/TF risk profile of each eligible entity using a methodology based on residual risk. Only entities with a “high” risk classification qualify for direct supervision.

For Luxembourg entities that meet the cross-border threshold, the practical question is whether their risk profile will be classified as high. The EBA has developed draft RTS on the methodology for this classification, building on the work of national supervisory authorities. Firms should review these draft standards and assess their own risk profile against the criteria.

Indirect Supervision for Everyone Else

For the vast majority of Luxembourg obliged entities, the CSSF remains the primary AML/CFT supervisor. AMLA will exercise indirect supervision by coordinating standards, conducting peer reviews of national supervisory authorities, and issuing guidelines that the CSSF must comply with or explain. This supervisory convergence function is likely to raise the practical bar for AML compliance in Luxembourg, as the CSSF aligns its expectations with the AMLA standards.

Luxembourg-Specific Considerations

The Law of 12 November 2004

Luxembourg’s AML Law of 12 November 2004 (as amended by the laws of 13 February 2018, 25 March 2020, and 6 February 2025, among others) will need to be amended to align with the AMLR and to transpose AMLD6. The directly applicable provisions of the AMLR will override the corresponding provisions of the Law. Provisions that implement AMLD6 (supervisory powers, FIU structure, sanctions) will need to be updated through the transposition process.

In practice, compliance teams should expect a period where the old national law and the new EU regulation coexist. The CDD and EDD provisions of the AMLR will apply directly from 10 July 2027, regardless of whether Luxembourg has completed its transposition of AMLD6. This means your AML policy must reference the AMLR from that date, even if the CSSF’s implementing guidance is still catching up.

CSSF Expectations

The CSSF has historically been an active AML supervisor. Its supervisory approach, including on-site inspections and thematic reviews, is likely to continue under the new framework, aligned with AMLA standards. Recent CSSF communications in March 2026 signal ongoing supervisory attention to AML compliance, and firms should expect the CSSF to communicate its expectations for AMLR readiness well before the July 2027 application date.

I expect the CSSF to issue sector-specific guidance on the transition from the national AML Law to the AMLR. For management companies and AIFMs, which form a large part of Luxembourg’s financial sector, the key challenge will be aligning beneficial ownership practices for fund structures with the AMLR’s enhanced requirements.

The Register of Beneficial Owners (RBE)

Luxembourg’s Register of Beneficial Owners, managed by the Luxembourg Business Registers (LBR), will need to align with the AMLR and AMLD6 requirements. AMLD6 requires that beneficial ownership information held in central registers be accurate, adequate, and up-to-date, and that access rules for obliged entities, competent authorities, and persons with a legitimate interest are harmonized.

For obliged entities, the practical implication is that you can continue to use the RBE as a source for beneficial ownership information, but you cannot rely on it as the sole verification source. The AMLR requires independent verification using multiple sources. The RBE is one input, not the entire answer.

Preparing Now: Practical Steps

July 2027 is 16 months away. That sounds like a lot of time until you consider that a gap analysis across CDD, EDD, beneficial ownership, PEP handling, transaction monitoring, internal controls, and training requires cross-functional coordination and is typically a 6-12 month project. Here is what I recommend starting now:

Conduct a gap analysis comparing your current AML framework (based on the Law of 12 November 2004 and CSSF Regulation 12-02) against the AMLR text. Focus on CDD (Article 20), EDD (Article 34), beneficial ownership identification and verification (Articles 22 and following), SDD conditions (Article 33), and internal controls (Article 9).
Review your SDD categories against the AMLR’s Article 33 conditions. Identify any national low-risk categories that may not survive the transition.
Assess your beneficial ownership verification practices. If you rely primarily on the RBE without independent corroboration, you have a gap.
Review your PEP screening process against the AMLR’s harmonized PEP framework. Update your PEP function lists once Luxembourg publishes its standardized list.
Track the EBA’s and AMLA’s regulatory technical standards. Several RTS mandates under the AMLR are in development, covering CDD measures, beneficial ownership verification, PEP risk assessment, and the AMLA selection methodology.
If your entity operates in six or more Member States, assess your cross-border footprint against the AMLA direct supervision criteria.
Update your AML policy documents and procedures manuals to be ready for dual referencing (national law + AMLR) during the transition period.
Plan your training program. Staff need to understand the shift from directive-based national law to a directly applicable regulation.

Frequently Asked Questions

Does the AMLR replace the Luxembourg AML Law entirely?

Not entirely. The AMLR replaces the substantive CDD, EDD, beneficial ownership, and STR provisions that are currently in the Law of 12 November 2004. The Law will still be needed for provisions that transpose AMLD6 (supervisory powers, sanctions, FIU structure). In practice, the Law will be significantly amended but not repealed.

When do we need to be compliant with the AMLR?

10 July 2027. The AMLR is directly applicable from that date. You do not need to wait for Luxembourg to transpose it or for the CSSF to issue guidance. The regulation is the law from that date.

Will the CSSF still be our AML supervisor?

Yes, for the vast majority of Luxembourg obliged entities. AMLA will directly supervise only a small number of selected entities that meet the cross-border and high-risk criteria under Article 12 of the AMLA Regulation. For everyone else, the CSSF remains the primary supervisor, operating under the AMLA coordination framework.

Do we need to update our AML policy documents before July 2027?

Yes. Your AML policy should reference the AMLR from the application date. In practice, start drafting the updated policy now and plan for board approval and staff training before the deadline.

What happens to our current SDD categories?

Any SDD categories based on national discretion under AMLD4/AMLD5 must be re-assessed against the AMLR’s Article 33 conditions. Categories that do not meet the AMLR criteria will no longer be eligible for SDD from 10 July 2027.

Is AMLA operational now?

AMLA was established by Regulation (EU) 2024/1620. It is building its operational capacity in Frankfurt. AMLA will begin direct supervision of selected entities from 1 January 2028. Until then it is developing its supervisory methodology, issuing guidelines, and preparing the selection process for directly supervised entities.

How does the AMLR affect crypto-asset service providers in Luxembourg?

CASPs licensed under MiCAR are fully within the scope of the AMLR as obliged entities. They must apply the full CDD framework, including beneficial ownership identification for customers that are legal entities, transaction monitoring, and STR filing. CASPs already subject to Luxembourg’s AML Law will need to align with the AMLR’s specific provisions for virtual asset transactions, including the travel rule requirements.

AML Reporting in Luxembourg – The current Luxembourg AML reporting framework, including STR filing through goAML and the role of the CRF
MiCAR Reporting Obligations – Reporting requirements for crypto-asset service providers, who are also AMLR obliged entities
CARF Crypto Tax Reporting – The Crypto-Asset Reporting Framework for tax transparency, which intersects with AMLR obligations for CASPs
COREP Reporting Explained – Prudential reporting framework for credit institutions, which operate under both CRR and AMLR requirements
DORA Register of Information – Another recent EU regulatory obligation requiring cross-functional implementation at financial entities

Key Takeaways

The AMLR (Regulation (EU) 2024/1624) is a directly applicable EU regulation that replaces the directive-based AML framework from 10 July 2027. No national transposition needed for the core CDD, EDD, and beneficial ownership provisions.
The EU AML package has four instruments: the AMLR (single rulebook), AMLD6 (supervisory and institutional framework, to be transposed), the AMLA Regulation (EU-level AML authority), and the recast Transfer of Funds Regulation (travel rule for funds and crypto-asset transfers).
Obliged entity scope expands: CASPs, crowdfunding service providers, professional football clubs, and luxury goods traders are brought in alongside existing financial sector entities.
CDD requirements are more prescriptive, with standardized verification measures and EU-wide conditions for simplified and enhanced due diligence.
Beneficial ownership verification standards are raised. The 25% threshold is maintained but the Commission can lower it to 15% after a 2029 assessment. The RBE is one source, not sufficient on its own. The EBA is developing RTS on the reasonable measures for verification.
AMLA begins direct supervision of selected high-risk cross-border entities from 1 January 2028. Most Luxembourg firms will remain under CSSF supervision, but AMLA coordination will raise the practical bar.
Start your gap analysis now. The AMLR text is final. Comparing your current framework against Articles 20, 22, 33, and 34 of the AMLR is the first step.
Luxembourg’s Law of 12 November 2004 will be significantly amended but not repealed. Expect a transition period where national law and the AMLR coexist.

Sources and References

Regulation (EU) 2024/1624 (AMLR) – Anti-Money Laundering Regulation https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1624
Directive (EU) 2024/1640 (AMLD6) – Sixth Anti-Money Laundering Directive https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024L1640
Regulation (EU) 2024/1620 (AMLA Regulation) – Establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1620
Directive (EU) 2015/849 (AMLD4) – Fourth Anti-Money Laundering Directive (to be repealed) https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32015L0849
Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended https://legilux.public.lu/eli/etat/leg/loi/2004/11/12/n1/consolide/20250206
EBA Consultation Paper on Response to Call for Advice on New AMLA Mandates – Draft RTS on CDD measures, beneficial ownership verification, and AMLA selection methodology
Regulation (EU) 2023/1113 (Recast Transfer of Funds Regulation) – Information accompanying transfers of funds and crypto-assets https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32023R1113
CSSF AML/CFT Communications (March 2026) – Recent supervisory communications on AML compliance expectations https://www.cssf.lu/en/aml-cft/

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.