Luxembourg Terrorist Financing NRA 2026: Sector Ratings for Your BWRA

On 12 October 2026 the CSSF relayed the Ministry of Justice’s communiqué of 7 October 2026 announcing the Luxembourg terrorist financing NRA: the 2026 National Risk Assessment of Terrorist Financing, which covers the observation period 2021 to 2024. The report rates the sub-sectors within the scope of the Law of 12 November 2004 for inherent and residual terrorist financing (TF) risk, and the CSSF tagged the release as relevant for 15 of the entity types it supervises, from credit institutions and investment fund managers to crypto-asset service providers and support PFS.

The obligation that gives the release weight sits in Article 2-2(2) of the Law of 12 November 2004, which requires professionals to ensure that the information on risks included in the national and supranational risk assessments is incorporated in their own risk assessment, and to keep that assessment documented, up to date and available to their supervisor. The release sets no deadline of its own. The NRA’s own chapter on mitigating factors records that CSSF on-site teams expect an entity’s risk self-assessment to have considered the supranational risk assessment, the NRA and the relevant CSSF sub-sector risk assessments.

The practical work is a re-mapping exercise with three parts: place each business line in the 2026 sub-sector taxonomy, compare the firm’s own TF scores with the national ratings, and update customer risk factors where the NRA rates customer types such as fiducies, foreign trusts and non-profit associations. The only High residual ratings in the report attach to domestic fiducies, foreign trusts and internationally active ASBLs without public utility status or development NGO accreditation; no CSSF-supervised sub-sector ends above Medium.

Related reading: Luxembourg Sanctions Risk Assessment: Screening Gaps the CSSF Flagged

Five documents, three observation periods: where the 2026 TF NRA fits

Luxembourg now publishes its money laundering and terrorist financing findings in separate national documents. The 2020 national risk assessment covered both. The government’s press release of 26 May 2025 presented the 2025 NRA as a money laundering assessment based on 2020 to 2023 data, and said the 2022 terrorist financing risk assessment would be updated to reflect 2021 to 2024. The 2026 TF NRA is that update.

The national portal at amlcft.public.lu states that the national assessments it lists are adopted by the Comité de prévention LBC/FT. Two of these documents are easy to merge by mistake. The September 2026 sanctions VRA assesses risks around international financial sanctions linked to TF and proliferation financing, while the 2026 NRA assesses how terrorist actors raise, move and use funds through each sub-sector. Their observation periods also differ by three years at the start, so a sector statistic lifted from one cannot be read as an update of the other.

The legal hook in Article 2-2(2) and CSSF Regulation 12-02

Article 2-2(1) of the Law of 12 November 2004 requires professionals to take appropriate steps to identify, assess and understand the money laundering and TF risks they face, taking into account risk factors relating to customers, countries or geographic areas, products, services, transactions and delivery channels, in proportion to their nature and size. Article 2-2(2) then adds the two duties this NRA activates. Professionals must ensure that the risk information included in the national and supranational risk assessments, or communicated by supervisors, self-regulatory bodies or the European Supervisory Authorities, is incorporated in their risk assessment. They must also document the assessment, keep it up to date and make it available to supervisors and self-regulatory bodies. Article 2-2(2) nevertheless allows those authorities or bodies to decide that individual documented risk assessments are not required where the specific risks inherent in the sector are clear and understood; this is a discretionary exception, not an automatic exemption.

For CSSF-supervised professionals, Article 4(1) of CSSF Regulation No 12-02, as amended by CSSF Regulation No 20-05, turns that duty into a source list for risk management procedures: the supranational risk assessment, the national risk assessment, the sub-sector risk assessments, the ESAs’ risk factor guidelines and the related CSSF publications. Article 4(3) requires professionals to be organised so that they can fill in the CSSF’s annual ML/TF questionnaire correctly and exhaustively. Article 4(4) ties the risk-based approach to an ML/TF risk appetite approved by the Board of Directors.

The text of Article 2-2(2) attaches the obligation to risk information: threats, typologies, vulnerability drivers and the findings on mitigating factors. It says nothing on whether a firm’s own score must match the national rating for its sub-sector. My reading is that a firm can score itself below the NRA’s sub-sector rating and still comply, provided its assessment shows the NRA content was considered and explains why the firm’s client base, products or channels differ. The CSSF has not published a rule on divergence, and the “kept up to date” duty carries no fixed refresh date.

The same input duty moves into directly applicable EU law on 10 July 2027, when Regulation (EU) 2024/1624 (AMLR) applies. Article 10(1)(c) AMLR lists “the findings of the national risk assessments carried out by the Member States pursuant to Article 8 of Directive (EU) 2024/1640, as well as of any relevant sector-specific risk assessment carried out by the Member States” among the minimum inputs to the business-wide risk assessment, and Article 10(1) extends the assessment to the risks of non-implementation and evasion of targeted financial sanctions. Article 10(2) requires the assessment to be documented, kept up to date and regularly reviewed, including where internal or external events significantly affect the risks; the compliance officer draws it up and the management body in its management function approves it. Article 10(2) does not define whether a new national risk assessment counts as such an external event.

How the Luxembourg terrorist financing NRA scores a sub-sector

The NRA follows the FATF’s 2019 Terrorist Financing Risk Assessment Guidance and applies a three-stage framework of threat, vulnerability and mitigating factors. Inherent risk is the TF risk before mitigating measures; residual risk is the level after them. The vulnerability stage scores each sub-sector on six dimensions: size and structure, ownership and legal structure, products and activities, geographical exposure, clients, and channels. Each dimension is rated from 1 to 5 with equal weighting, and the average is mapped to one of five levels from “Very low” to “Very high”.

Mitigating factors run through a second scorecard with five dimensions: market entry controls, understanding of TF risks and AML/CFT obligations, prevention and private-sector controls, supervision and enforcement, and detection, prosecution and asset recovery. The result is bucketed into five outcomes that reduce the inherent score by 0, 0.5, 1, 1.5 or 2 points. Where information was missing, the assessors raised the assessed level of risk, following the conservative approach the NRA attributes to the FATF.

Three design choices affect how a firm maps itself:

• Sectors are mapped by supervisory set-up, not by activity. The banking chapter covers entities holding a banking licence, and its sub-sector “Entities operating online” consisted of five entities in 2024 offering mainly payment-related services, including e-money services, transfers of funds and payment services using virtual IBANs (vIBANs). The PI and EMI rows cover licensed payment and e-money institutions, so a bank’s sub-sector rating sits in the banking chapter, although the NRA states that it analyses the e-money products of entities operating online in its section 10.1.3 on money value and transfer services.
• Three investment-firm rows were renamed since 2020. The NRA’s footnotes map the 2020 labels “Wealth and asset managers”, “Brokers and broker-dealers (non-banks)” and “Traders / market-makers” to the 2026 rows on investment advice and portfolio management, on reception, transmission and execution of orders, and on dealing on own account, underwriting and placing.
• Cross-sector vulnerabilities carry no rating. Cash, crypto-assets, crowdfunding and underground banking are described separately “without assigning them an inherent risk level”.

A risk assessment that still cites the 2020 labels, or that quotes a national score for crypto-asset exposure, is citing a rating the 2026 document does not contain.

A threat profile built on small amounts and legitimate income

Luxembourg raised its terrorist threat level to 2 (“Medium”) after the 2015 Paris attacks and, according to the NRA, maintained it throughout the 2021 to 2024 observation period; under the VIGILNAT scale, Level 2 applies where the threat is real but abstract. For that observation period the NRA states that Luxembourg has not experienced a completed terrorist attack and that no established terrorist group operates on its soil, and records one right-wing attack foiled in 2023. The NRA nonetheless assesses TF exposure independently of domestic threat, because Luxembourg operates as an international financial centre with deep cross-border reach.

The prevailing threat comes from lone actors, small cells and foreign terrorist fighters with low and granular financial needs, predominantly linked to jihadist ideology, followed by extreme-right and ethno-nationalist movements. They use basic products offered by retail banks, PIs, EMIs and, increasingly, virtual asset service providers (VASPs), and their funds are mainly of legitimate origin: salaries, social benefits and small loans. The NRA rates the inherent threat from this category “Medium”. The scenario of large international organisations using Luxembourg to raise or move substantial funds is rated “Low”: flows with the 56 targeted jurisdictions selected for analysis represent only 2 to 3% of total Luxembourg financial flows, with foreign direct investment the outlier at over 10%, and no evidence of materialised TF risk through these channels was found.

The CRF’s typologies, based on TF-related reports filed between 2017 and 2023, describe what that looks like in transaction data:

• donations to foreign NPOs suspected of links to extremist organisations, usually below EUR 100, with social media and online fundraising campaigns playing an important role;
• peer-to-peer transfers to unrelated individuals for alleged humanitarian purposes, such as support for orphans, widows, prisoners and the families of those killed;
• purchases and sales of items linked to extremist ideologies, and of weapons or other suspicious goods;
• a broader shift in consumer behaviour, such as expenses in jurisdictions with higher TF risk, remittances to unrelated individuals there, or successive purchases of flight tickets to them.

Paragraph 159 of the NRA contains the sentence most relevant to scenario design. Flow analysis with jurisdictions selected on the Global Terrorism Index or weak FATF ratings “is not, by itself, suitable” for assessing the threat from decentralised networks, lone actors, small cells and foreign terrorist fighters, which the report describes as predominantly intra-EU and intra-Western. I read this as a direct challenge to TF models built mainly on high-risk-country lists and value thresholds. For retail and business banks, the NRA reaches a similar operational conclusion: where funds are licit and counterparties undesignated, it calls the identification of transactional indicators crucial.

Inherent and residual ratings for CSSF-supervised sub-sectors

The table reproduces the 2026 ratings for the sub-sectors under CSSF supervision, using the NRA’s row labels, shortened for the investment-firm rows. Market operators are included because they appear in the same chapter.

The NRA’s overall conclusion names the sectors needing continued supervisory focus: retail and business banks and entities operating online, PIs and EMIs, VASPs, internationally active NPOs, and professionals providing trust and company service provider services or involved in real estate transactions. The volume figures explain the High inherent scores. Retail and business banks counted over one million client accounts in 2024, almost 90% held by natural persons, while entities operating online served approximately 93 million active client accounts. The PI sub-sector served approximately 16 million clients in 2024 and the EMI sub-sector around 110 million. Entities registered with the CSSF as VASPs grew from six in 2021 to 15 in 2024.

The mismatch to watch is between those drivers and the client-level picture. Retail and business banks reported a high-risk client share of around 1 to 2%, and EMIs an average of 0.85%, yet both stay High on inherent risk: the NRA names size and client and transaction volumes as leading drivers for retail and business banks, and products, transaction volumes and distribution channels for EMIs. Straight after reporting the low high-risk share, it adds that, for low-value financiers, the origin of the funds is usually licit and transactions might occur between unrelated and undesignated individuals. My reading is that a firm in one of these rows that rates its own inherent TF risk as Low mainly because its high-risk client share is small leans on the indicator the NRA qualifies most.

Current CSSF sub-sector assessments provide further risk information alongside the national NRA. Relevant publications include the 2025 collective-investment assessment, the 2023 private-banking update and the January 2026 update of the sub-sector assessment for specialised PFS providing corporate services (trust and company service provider activities), which the CSSF expects firms carrying out those activities to integrate into their AML/CFT frameworks. For collective investments, the NRA points to the 2025 update of the CSSF’s collective investment sub-sector risk assessment for an in-depth view of TF risk. For private banking, the NRA cites the 2023 update of the CSSF’s private banking sub-sector risk assessment, which concluded there is no strong indication that private banking services are particularly exposed to TF, while advising private banks to remain cautious.

Customer types that carry the highest residual ratings

The only High residual ratings in the 2026 table attach to legal arrangements and to one NPO category. For a bank, PI, EMI or Specialised PFS, these rows describe customers, counterparties and intermediaries, so they enter the risk assessment through the customer risk factor instead of the sub-sector score.

Article 5(1) of CSSF Regulation No 12-02 requires professionals to categorise all their customers by ML/TF risk level, using risk factors that include the type of customer. The NPO rows depend on two data points that a standard KYC record may not hold: whether an ASBL has public utility (“UP”) status, and whether it holds the development NGO (DNGO) accreditation from the ministry the NRA abbreviates as MoFA, which covers development cooperation. A customer file that records only the legal form “ASBL” cannot be placed in the right row. The NRA also counts approximately 1,000 ASBLs and Fondations in Luxembourg’s FATF NPO subset, of which approximately 400 conduct primarily international activities, with a significant presence in Sub-Saharan Africa.

The NRA places the principal NPO vulnerability at the operational and geographical level, where funds are distributed in countries with high terrorism impact and weak CFT frameworks, and calls beneficial-owner links to targeted jurisdictions minimal. In my reading, that makes information on where an NPO customer spends its funds more useful for this risk than ownership screening. Elsewhere in the table, AED-supervised accountants and “professional directors and business centres” are both rated High inherent and Medium residual, a point relevant where a bank or Specialised PFS deals with such professionals as introducers or as directors of client entities. The NRA does not say how a firm should weigh a High residual customer type against a Medium residual rating for its own sub-sector; that calibration stays inside the firm’s methodology.

What CSSF supervisors look for in the TF section

The mitigating-factors chapter gives an unusually direct view of the CSSF’s TF supervision. Its findings are relevant to the Article 2-2(2) duty to incorporate national risk information into a professional’s own assessment; that provision requires incorporation of the relevant risk information and does not prescribe reading every chapter of the report as a separate legal obligation. The annual AML/CFT questionnaire, which over 1,500 professionals completed each year during the observation period, has one part on inherent risk and one on mitigating measures, with TF questions both general and sector-specific. The NRA describes it as a tool that lets the CSSF identify whether professionals have assessed their exposure to TF. Off-site teams also review the annual ML/TF risk assessments completed by professionals, among other things to identify shortcomings related to TF.

The on-site control plan covers TF in four testing phases:

• review of procedures, which are required to mention the obligation to detect persons, entities or groups subject to TF-related prohibitions or restrictive measures and to inform the competent authorities as soon as possible;
• a management interview with the AML/CFT (chief) compliance officer and/or the member of management in charge of AML/CFT;
• risk assessment and risk appetite, where the entity is expected to have considered the supranational risk assessment, the NRA and the relevant sub-sector risk assessments published on the CSSF website;
• a review of a sample of client files, including an analysis of account movements over a selected period to confirm they do not give rise to TF suspicions.

The NRA also records that the CSSF follows up with professionals that incorrectly classified countries, using its own country risk rating tool to challenge classifications. On several occasions the CSSF has identified general breaches in transaction monitoring, enhanced due diligence and “name matching” controls, which may include a component related to targeted financial sanctions.

On the structure of the assessment, the message is a recommendation addressed to banks. At the Preventing Terrorism Financing seminar of 8 November 2024, organised by the CSSF, the CRF, the ABBL and ALFI, and again at the CSSF’s joint conference with the ABBL on 24 April 2025, the attending banks heard that TF patterns are specific and that assessing TF risk separately from ML risk is “highly recommended”. The CSSF also recommends that banks document the analysis in a separate section of their business-wide risk assessment, applying proportionality. Article 2-2 does not itself require a stand-alone TF document.

The NRA reports the result from the latest annual Survey on Financial Crime: all entities confirmed they had assessed TF risk, 11% in a dedicated risk assessment and 43% in a separate section. Of the 46% that assessed TF jointly with ML, 43% reported low TF exposure and 85% belong to a sub-sector the 2022 TF VRA assessed as lower risk. The insight box does not state whether these percentages cover all CSSF-supervised respondents or banks only.

TFAR and TFTR filings through goAML: the CRF’s read on quality

Article 5(1)(a) of the Law of 12 November 2004 grounds the duty to report suspicions to the Cellule de renseignement financier (CRF). For TF, two report formats exist in goAML: a terrorist financing transaction report (TFTR) where the suspicion relates to specific transactions, and a terrorist financing activity report (TFAR) where it does not. Our goAML Luxembourg reporting workflow guide covers enrolment and filing mechanics.

The NRA’s statistics, which may differ in vintage from other CRF publications, show 321 TF-related reports in 2021, 220 in 2022, 223 in 2023 and 230 in 2024. The NRA describes this flow as relatively stable at between 200 and 300 reports a year; the step down from 2021 to 2022 is visible in its own figures. Around 70% of reports for 2023 and 2024 related to Islamism, a category the CRF uses broadly and which does not always involve jihadism, followed by extreme right-wing (10%), separatism (6%) and left-wing terrorism (2%). Most reports concern non-residents; 7% of TF reports filed in 2024 concerned Luxembourg residents. E-banks, a goAML classification for specific reporting entities holding a banking, EMI, PI or other licence, filed the majority, although their share has fallen since 2019 as EMIs (since 2023) and DNFBPs (since 2020) filed relatively more.

The weak point the CRF identifies sits in screening-driven reports. Almost one third of TF-related reports filed in 2023 and 2024 were based on open-source information, including terrorism-related adverse media or sanctions, usually generated from name screening alerts. The NRA states that the analysis by reporting entities of the link between the business relationship or funds and the TF-related information “is not systematic and varies among reporting entities”. The same report rates the overall quality of information received as generally good and finds no indication of under-reporting.

The CRF has also disseminated two TF documents to reporting entities via goAML: one on terrorist financing fundraising campaigns in the context of the attacks on Israel of 7 October 2023 (dated 26 October 2023), and “Financing of terrorist organizations: List of indicators” (8 December 2023). A sanctions-screening alert runs on a different track. Where an applicable financial restrictive measure is confirmed, professionals are required to implement the freezing or other restrictions without delay and notify the Ministry of Finance, with the CSSF copied where required; the NRA restates this for CSSF-supervised professionals.

A potential screening match is assessed to establish whether an applicable restrictive measure covers the person, entity or funds concerned, and an unresolved possible match calls for investigation; in case of doubt, the CSSF’s sanctions FAQ states that professionals have to contact the Ministry of Finance and suspend any transactions on the account until the situation is sufficiently clarified. Separately, where the circumstances give rise to a suspicion of terrorist financing or sanctions circumvention, a report also goes without delay to the CRF through goAML under Article 5(1)(a) of the Law of 12 November 2004. For the full suspicious-reporting framework, see our guide to AML reporting in Luxembourg.

Unrated cross-sector vectors: vIBANs, instant payments, crypto-assets

The NRA’s list of emerging risks reads like a scenario backlog, and none of the items comes with a rating a firm can copy:

• Virtual IBANs. Transactions settle through a master account identified by an IBAN, while vIBANs attached to it can be issued to many end-users, sometimes through a chain in which a PI or EMI issues vIBANs received from a bank to its own clients, who issue them onward. The NRA calls monitoring of vIBAN use challenging.
• Instant payments. As the NRA summarises Regulation (EU) 2024/886, PSPs execute instant euro credit transfers within 10 seconds, 24/7, and must verify their payment service users immediately after a new or amended restrictive measure enters into force and screen their client database at least once a day. Funds become usable by the beneficiary immediately, which compresses the window for intervention.
• Crypto-assets. Authorities report a growing but still limited use of crypto-assets for TF, with a shift towards stablecoins, in particular USDT, and use of self-hosted wallets, privacy coins and mixers.
• Donation-based crowdfunding. The NRA treats unregulated donation-based platforms as a material gap until the AMLR applies in July 2027, and notes that no entity in Luxembourg had yet been licensed under Regulation (EU) 2020/1503.
• AI-enabled document fraud and minors. Forged identity documents used to access remote-onboarding services are listed as an emerging threat, and 30% of EU terrorism-related arrestees in 2024 were aged 12 to 20.
• Alternative payment systems. The NRA reports indications of unregistered money-transfer operations in Luxembourg linked to high-risk third countries, including via encrypted messaging groups.

Social media is the common thread in several of these typologies; our article on FATF terrorist financing typologies on social media covers the related FATF guidance. Because the NRA deliberately leaves these vectors unscored, each firm’s exposure to vIBAN chains, instant payment flows or crypto withdrawals has to be sized in its own assessment. The NRA’s overall conclusion calls for proactive adaptation of the Luxembourg CFT framework ahead of the AML Regulation’s application in July 2027.

Sequencing the TF refresh inside the business-wide risk assessment

The order below is my working sequence for absorbing the 2026 NRA, built from the legal duties and the CSSF checks described above. None of the steps is prescribed by the NRA or the CSSF release.

1. Map each licence and business line to the 2026 row labels, including the renamed investment-firm rows, and record where the NRA’s licence-based mapping differs from the firm’s internal business-line view.
2. Set the firm’s own inherent TF score next to the NRA rating for the matching row, and write down the evidence for any gap: client mix, channels, transaction volumes, geographic flows.
3. Feed the customer-type ratings for fiducies, foreign trusts, the ASBL categories and professional directors into customer risk scoring, and check that KYC data captures UP status and DNGO accreditation.
4. Re-test monitoring scenarios against the CRF typologies and the indicator list in the NRA’s Insight Box 4, with particular attention to low-value NPO donations, peer-to-peer “humanitarian” transfers, vIBAN chains and crypto withdrawals.
5. Sample TFARs and TFTRs raised from name screening alerts and check that each file documents the analysis of the link to the business relationship.
6. Where the refresh changes the TF risk appetite or strategy, take it to the Board under Article 4(4) of CSSF Regulation No 12-02, and keep the version trail for the next annual questionnaire.

For firms whose 2025 refresh absorbed the money laundering NRA, the TF section is the remaining gap from the national cycle. Our explainer on what the EU AMLR changes for obliged entities sets out the wider 2027 transition into which this assessment will roll.

Frequently Asked Questions

We are the Luxembourg branch of a bank authorised in another Member State. Does the NRA input duty reach us?

CSSF Regulation No 12-02 applies under its Article 2(1) to professionals referred to in Article 2 of the Law of 12 November 2004 that are supervised, authorised or registered by the CSSF, including Luxembourg branches of foreign professionals notified to the CSSF and foreign professionals providing services in Luxembourg without a branch. The Article 4(1) source list therefore applies to the branch’s risk management procedures. A different row covers passported payment networks: the NRA rates “Agents and e-money distributors acting on behalf of PIs/EMIs established in other European Member States” Medium inherent and Medium residual, and counted 21 agents working for five such PIs in 2024, with more than 80% of consolidated flows cash-based.

Our group runs a single business-wide risk assessment from another EU country. Is a Luxembourg-specific TF input expected?

Article 2-2(2) applies the incorporation duty to the risk assessment of the Luxembourg professional, and the CSSF’s on-site plan checks whether the entity’s own risk self-assessment considered the NRA. My reading is that a group methodology can carry the analysis, provided the Luxembourg entity’s assessment shows the Luxembourg NRA findings for its rows and customer types. Neither source specifies a format for doing so.

We hold a MiCA authorisation as a crypto-asset service provider. The NRA only rates “VASPs”. Which row applies?

The NRA’s VASP row covers entities registered with the CSSF as VASPs during the 2021 to 2024 observation period, which explains the label. The Law of 6 February 2025 added crypto-asset service providers to Article 1(3a)(ca) of the Law of 12 November 2004. However, Article 1(32) defines that category by reference to Regulation (EU) 2023/1114 while excluding the provision of advice on crypto-assets as the sole relevant crypto-asset service. A MiCA authorisation alone therefore does not establish that a provider falls within this statutory category; its authorised services have to be considered. For a provider that does fall within it, the NRA’s Insight Box 6 states that the inherent TF risk exposure of CASPs is similar to that of VASPs because the services offered are usually the same, while some mitigation measures, notably market entry controls and prevention, will be stronger under the stricter authorisation and prudential regime, so the VASP row (High inherent, Medium residual) and the cross-sector section on crypto-assets are the closest rated content.

Does the 2026 TF NRA supersede the 2025 NRA?

The two documents run in parallel. The 2025 NRA remains the national money laundering assessment, based on 2020 to 2023 data, and the 2026 document carries the TF findings for 2021 to 2024. A combined ML/TF assessment needs both, together with the supranational risk assessment and the CSSF sub-sector assessments listed in Article 4(1) of CSSF Regulation No 12-02.

We are an investment fund manager. Is the “Collective investments” row (Medium, Low) enough for our TF assessment?

The NRA points readers to the 2025 update of the CSSF’s collective investment sub-sector risk assessment for an in-depth view of the sector’s TF risks, and Article 4(1) lists sub-sector assessments as a separate source. The NRA’s sector analysis also notes that the exposure of collective investment schemes to TF is more relevant for wealthy terrorism sponsors outside the EU than for lone actors or small cells. In my reading, that shifts the TF analysis towards investor due diligence and intermediaries.

Does the NRA introduce a new return, template or filing deadline?

The NRA describes existing reporting channels only: TFTRs and TFARs through goAML, the annual CSSF ML/TF questionnaire under Article 4(3) of CSSF Regulation No 12-02, and, where a restrictive measure applies, freezing reports to the Ministry of Finance. What changes is the content those submissions are measured against.

Related Articles

• Luxembourg Sanctions Risk Assessment: Screening Gaps the CSSF Flagged: the first PF and TF targeted financial sanctions VRA and the screening failures behind CSSF fines.
• goAML Luxembourg: The CRF Reporting Workflow Explained: how obliged entities enrol on goAML and file suspicious transaction and activity reports with the CRF.
• AML Reporting in Luxembourg: the suspicious-reporting framework that applies to Luxembourg obliged entities.
• What the EU AMLR Changes for Obliged Entities: how Regulation (EU) 2024/1624 moves AML/CFT duties into a directly applicable single rulebook from 2027.
• FATF Terrorist Financing on Social Media: What AML Teams Should Check: FATF typologies for TF on social media and messaging, and what they mean for monitoring and reporting.
• The EU AML Package: The Countdown to 10 July 2027: how the AMLR, AMLD6 and the AMLA Regulation fit together ahead of the 2027 application date.

Key Takeaways

• Re-map business lines to the 2026 row labels; three investment-firm rows carry new names compared with the 2020 NRA.
• Where the firm’s own TF score sits below the NRA rating for its row, the file should hold the evidence for the gap.
• Highest residual risk (High): domestic fiducies, foreign trusts and internationally active ASBLs without UP status or DNGO accreditation. Customer scoring and KYC fields need to reflect them.
• Retail and business banks, banks operating online, PIs, EMIs and VASPs: High inherent, Medium residual.
• CSSF recommendation to banks: a separate, proportionate TF section in the business-wide risk assessment; in the NRA’s survey figures, 46% of entities still assessed TF jointly with ML.
• TF reports raised from name screening hits need a documented analysis of the link to the client relationship.
• Cash, crypto-assets, crowdfunding and underground banking have no national score; the firm sizes that exposure itself.
• From 10 July 2027, AMLR Article 10 lists national and sector-specific risk assessment findings as minimum inputs, with drafting by the compliance officer and approval by the management body.

Sources and References

• CSSF, press release “Luxembourg updates its national risk assessment of terrorist financing” (communiqué from the Ministry of Justice), 12 October 2026: cssf.lu
• Ministry of Justice, communiqué “Le Luxembourg actualise son évaluation nationale des risques de financement du terrorisme”, 7 October 2026: mj.gouvernement.lu
• Ministry of Justice, 2026 National Risk Assessment of Terrorist Financing, observation period 2021 to 2024 (PDF): mj.gouvernement.lu
• National AML/CFT portal, national risk assessments: amlcft.public.lu
• National AML/CFT portal, sectoral and vertical risk assessments: amlcft.public.lu
• Government of Luxembourg, “Luxembourg finalises its first vertical risk assessment on terrorist financing”, 21 June 2022: gouvernement.lu
• CSSF, publication of the update of the ML/TF sub-sector risk assessment on specialised PFS providing corporate services, January 2026: cssf.lu
• Government of Luxembourg, “Le Luxembourg actualise son évaluation nationale des risques de blanchiment de capitaux”, 26 May 2025: gouvernement.lu
• Ministry of Finance, release on the first vertical risk assessment on international financial sanctions linked to TF and proliferation financing, 21 September 2026: gouvernement.lu
• Ministry of Finance, first vertical risk assessment on international financial sanctions linked to TF and proliferation financing, 2018 to 2023 (PDF): mfin.gouvernement.lu
• Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (CSSF English coordinated text), Articles 1, 2-2 and 5: cssf.lu
• CSSF Regulation No 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing, as amended by CSSF Regulation No 20-05, Articles 2, 4 and 5: cssf.lu
• CSSF, Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) page, including the sub-sector risk assessments: cssf.lu
• CSSF, FAQ regarding international financial sanctions (updated 3 November 2025), Questions 1, 3, 4, 9 and 16: cssf.lu
• Regulation (EU) 2024/1624 (AMLR), Articles 10 and 90: EUR-Lex
• Directive (EU) 2024/1640 (AMLD6), Article 8: EUR-Lex
• Regulation (EU) 2024/886 on instant credit transfers in euro: EUR-Lex
• Regulation (EU) 2020/1503 on European crowdfunding service providers for business: EUR-Lex
• Regulation (EU) 2023/1114 on markets in crypto-assets (MiCA), Article 3(1), points (15) and (16), as referenced by Article 1(32) of the Law of 12 November 2004: EUR-Lex

From the 2026 TF NRA to the AMLR Article 10 assessment

The 2026 NRA now feeds into three things the CSSF already reviews: the annual ML/TF questionnaire, the off-site review of each professional’s risk assessment, and the on-site check that the NRA was considered. The artifact to produce now is an updated TF section (for banks, a separate section of the business-wide risk assessment, applying proportionality, as the CSSF recommends) that maps the firm to the 2026 rows, records its divergences with evidence and carries the customer-type ratings into client scoring. That same document becomes the starting point for the Article 10 business-wide risk assessment that the compliance officer has to draw up and the management body has to approve once the AMLR applies on 10 July 2027.

Disclaimer: The information on RegReportingDesk.com is for educational and informational purposes only. It does not constitute legal, regulatory, tax, or compliance advice. Always consult your compliance officer, legal counsel, or the relevant supervisory authority for guidance specific to your institution.