CSSF Circular: AML/CFT Standardised Data Collection Taking Place in 2026

Circular letter AML/CFT standardised data collection exercise taking place in 2026

CIRCULAR LETTER 2/4 Circular letter AML/CFT standardised data collection exercise taking place in 2026 To the Management Board and the Board of Directors of all:

• Credit institutions;
• Investment firms;
• Investment fund managers including registered AIFMs, Luxembourg branches of investment fund managers, SIAG, FIAAG and investment funds which did not designate an investment fund manager;
• Payment institutions and electronic money institutions;
• Virtual Asset Service Providers
• Crypto Asset Service Providers
• Specialised professionals of the financial sector; and
• Central Securities Depositories incorporated under Luxembourg law. To all Luxembourg branches of the above-listed entities having their registered office in an EU country or a third country. Luxembourg, 12 February 2026 Ladies and Gentlemen, This year, the CSSF will deploy the data collection templates which have been developed by the European Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) in cooperation with EU Member states’ relevant National Competent Authorities, instead of launching its usual annual Questionnaire on Financial Crime as previously announced1, except for Specialised professionals of the financial sector, as provided for in the last point below. This decision comes following the recent launch of a significant data collection exercise2 by AMLA covering a broad range of CSSF supervised entities. Given the broad scope of the AMLA exercise, the CSSF Questionnaire would lose representativeness unless requesting supervised entities to complete both Questionnaires. As part of its simplification and burden reduction considerations, the CSSF has therefore decided to request the AMLA prepared questionnaire from all supervised entities, except for specialised professionals of the financial sector. This approach is intended to ensure consistency and a level-playing field, against the background of preparing for the new common EU AML/CFT methodology. An ad-hoc questionnaire may still be requested later in the year to collect essential data points such as those required for FATF, where these are not covered by the AMLA questionnaire. In this case, the CSSF will provide detailed information thereon at a later stage. 1 2025 Questionnaire on Financial Crime – CSSF 2 See AMLA press release 26th of January 2026 and Explainer

CIRCULAR LETTER 3/4 Data collection for all entities will launch on the 2nd of March via the eDesk platform, except for specialised professionals of the financial sector which will launch 23rd of February, as provided for in the last point below. Given the interaction with the AMLA exercise, the addressees of this Circular Letter fall into 3 categories: A. Supervised entities that have been selected to participate in the AMLA “calibration exercise” B. All other supervised entities, except specialised professionals of the financial sector C. Specialised professionals of the financial sector A. AMLA 2026 AML/CFT Risk Assessment and Selection Methodology Calibration Exercise Certain supervised entities have been selected to participate in a calibration exercise to be conducted in 2026 by AMLA. Selected entities have been notified directly by the CSSF of their participation, which is mandatory. As part of this exercise, participating credit and financial institutions are required to report a defined set of quantitative and qualitative data points. The testing exercise aims to calibrate the methodology to be used at European Union level for the assessment of ML/TF risks of individual credit and financial institutions. The data collection will launch the 2nd of March 2026 and shall be reported to the CSSF by the 15th of April 2026 via the eDesk platform. These data points are specified in the annexes of the following draft Regulatory Technical Standards: • Draft RTS on risk assessments (Draft Regulatory Technical Standards on the assessment of the inherent and residual risk profile of obliged entities under Article 40(2) of Directive (EU) 2024/1640), and • Draft RTS on selection (Draft Regulatory Technical Standards on the risk assessment for the purpose of selection of credit institutions, financial institutions and groups of credit and financial institutions for direct supervision under Article 12(7) of Regulation (EU) 2024/1620). The definitive template and an interpretative guidance will be made available soon by AMLA. B. AMLA Questionnaire for the CSSF AML/CFT standardised data collection Credit and financial institutions, except specialised professionals of the financial sector, that have not received notification of being selected to participate in the previously mentioned AMLA calibration exercise, will also be required to report to CSSF about their ML/TF risks and mitigation measures regarding 2025, and this, based on the AMLA developed data collection templates as detailed above. The data collection will be launched on the 2nd of March via the eDesk platform. Further modalities and reporting timelines will be communicated shortly. C. Specialised professionals of the financial sector to complete the CSSF Questionnaire as usual For all specialised professionals of the financial sector, which are out of scope of the AMLA data collection exercise, the usual CSSF Questionnaire collecting standardised key information concerning ML/TF risks to which the professionals under supervision are exposed and the implementation of related risk mitigation measures and targeted financial sanctions measures will be launched on the

CIRCULAR LETTER 4/4 23rd of February 2026. Answers to the questions will have to be submitted through the CSSF eDesk platform by the 3rd of April 2026 (at the latest). Claude WAMPACH Director Marco ZWICK Director Jean-Pierre FABER Director Pascale TOUSSING Director Claude MARX Director General