Entry into Force of Laws Amending AML Framework and Establishing Central IBAN Data System

Luxembourg, 4 May 2020 To all the professionals subject to the AML/CFT supervision of the CSSF and that fall within the scope of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended CIRCULAR CSSF 20/742 Re: Entry into force

1. of the Law of 25 March 2020 amending, inter alia, the Law of 12 November 2004 on the fight against money laundering and terrorist financing, and
2. of the Law of 25 March 2020 establishing a central electronic data retrieval system related to IBAN accounts and safe-deposit boxes Ladies and Gentlemen, We draw your attention to the entry into force, on 30 March 2020, of the Law of 25 March 2020 (“Law of 25 March 2020”)1 amending: a) the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (hereinafter “2004 Law”); b) the Law of 9 December 1976 on the organisation of the profession of notary, as amended; c) the Law of 4 December 1990 on the organisation of bailiffs (huissiers de justice), as amended; d) the Law of 10 August 1991 on the legal profession, as amended; e) the Law of 10 June 1999 on the organisation of the accounting profession, as amended; f) the Law of 23 July 2016 concerning the audit profession, as amended; in view of the transposition of certain provisions of Directive (EU) 2018/843 of the European Parliament and of the Council of 30 May 2018 amending Directive (EU) 2015/849 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing, and amending Directives 2009/138/EC and 2013/36/EU (cf. Section I. below) and, 1 as published in Mémorial A – No 194 of 26 March 2020 Outdated

Circular CSSF 20/742 page 2/5 to the entry into force, on 26 March 2020, of the Law of 25 March 2020 establishing a central electronic data retrieval system related to IBAN accounts and safe-deposit boxes2 (cf. Section II. below). The purpose of this circular is to draw the attention of the financial sector professionals to the major changes introduced by the two above-mentioned laws dated 25 March 2020 to the anti￾money laundering and countering the financing of terrorism (“AML/CFT”) regime applicable to the Luxembourg financial sector, as provided for in the 2004 Law. The consolidated version of the 2004 Law is available under the following link: https://www.cssf.lu/en/Document/law-of-12-november-2004/ I. Law of 25 March 2020 amending, inter alia, the 2004 Law In Article 1 of Chapter 1 of Title I of the 2004 Law, new definitions have been introduced (e.g. virtual currency, virtual asset, virtual asset service provider, safekeeping or administration service provider, custodian wallet service, high-risk country, etc.), while other definitions have been amended. We draw the professionals’ attention in particular to the adaptation of the definitions of “financial institution” (the scope of application has notably been extended to any person in respect of which the CSSF is in charge of ensuring compliance with the professional obligations as regards the fight against money laundering and terrorist financing in accordance with Article 2-1(1)) and of “beneficial owner” (control through other means has been specified) (Article 1 of the Law of 25 March 2020). Article 2 of the 2004 Law on the scope of Title I of the 2004 Law has been reviewed and the list of professionals subject to the 2004 Law has been completed (e.g. tied agents, virtual asset service providers, safekeeping or administration service providers, agents of payment institutions and of electronic money institutions, real estate agents, real estate developers, persons storing, persons trading or acting as intermediaries in the trade of works of art). Article 2-1 of the 2004 Law relating to the supervisory authorities and self-regulatory bodies has been reviewed in order to extend the scope of the CSSF’s AML/CFT supervision by adding, notably, competence for the AML/CFT supervision of foreign institutions for occupational retirement provision authorised to provide services in Luxembourg, tied agents established in Luxembourg and agents established in Luxembourg of payment institutions and electronic money institutions (Article 3 of the Law of 25 March 2020). Article 2-2 of the 2004 Law on the obligation to perform a risk assessment has been reviewed in order to emphasise that the professionals must ensure that the information on the risks included in the national and supranational risk assessment or communicated by the supervisory authorities, self-regulatory bodies or the European Supervisory Authorities is incorporated in their risk assessment (Article 4 of the Law of 25 March 2020). As regards Chapter 2 of the 2004 Law, Article 3 on customer due diligence has undergone many adaptations (Article 5 of the Law of 25 March 2020). Thus, identifying the customer and verifying the customer’s identity will henceforth also be possible via “electronic identification means and [...] relevant trust services as set out in Regulation (EU) No 910/2014 of the European Parliament and of the Council or any other 2 as published in Mémorial A – No 193 of 26 March 2020

Circular CSSF 20/742 page 3/5 secure, remote or electronic identification process regulated, recognised, approved or accepted by the relevant national authorities”. It is also worth noting the specifications brought to Article 3(2b) of the 2004 Law relating to life or other investment-related insurance business, if “concluded or negotiated” by professionals. As regards the identification of the beneficial owner, and more specifically where all possible means have been exhausted in order to determine the beneficial owner and the latter is identified as the person who holds the position of senior managing official (dirigeant principal), the obliged entities will be required to take the necessary reasonable measures to verify the identity of the natural person who holds the position of senior managing official (dirigeant principal) and must keep records of the actions taken as well as any difficulties encountered during the verification process. The prohibition for credit institutions and financial institutions to keep anonymous accounts or anonymous passbooks was supplemented with the prohibition to keep “anonymous safe-deposit boxes”. As a consequence of the amendment of Article 3-1 on simplified customer due diligence of the 2004 Law and the derogation granted to electronic money services, the maximum amounts referred therein were reduced from EUR 250 to EUR 150. The limit of EUR 500 set for payment instruments that can be used [in Luxembourg] has been removed. Finally, this derogation will not be applicable “in the case of redemption in cash or cash withdrawal of the monetary value of the electronic money where the amount redeemed exceeds EUR 50, or in the case of remote payment transactions as defined in point (6) of Article 4 of Directive (EU) 2015/2366 of the European Parliament and of the Council, where the amount paid exceeds EUR 50 per transaction” (Article 6 of the Law of 25 March 2020). As regards enhanced customer due diligence measures, professionals may not invoke them with respect to branches or majority-owned subsidiaries which are located in high-risk countries, where those branches or majority-owned subsidiaries fully comply with the group-wide policies and procedures in accordance with Article 4-1 of the 2004 Law or with Article 45 of Directive (EU) 2015/849. Professionals must handle those cases by using a risk-based approach (Article 7 of the Law of 25 March 2020). As concerns the performance of due diligence measures by a third party, professionals must ensure that the third party is regulated, subject to supervision, and that it has taken measures to comply with customer due diligence requirements and record-keeping requirements that are consistent with those laid down in Articles 3 to 3-2 of the 2004 Law (Article 8 of the Law of 25 March 2020). The details relating to the internal management requirements of the professionals (Article 4 of the 2004 Law) are also worth mentioning, notably in relation to the internal control arrangements, including the internal audit function, which must be adequately resourced to test compliance, including sample testing, with the procedures, policies and controls and which must enjoy the independence which is necessary to perform their tasks (Article 9 of the Law of 25 March 2020).

Circular CSSF 20/742 page 4/5 As regards professionals that are part of a group, the latter must include in their group-wide policies and procedures the policies, controls and procedures provided for in Article 4(1) and (2) of the 2004 Law and the provision, pursuant to Article 5(5) and (6) of the 2004 Law, of customer, account and transaction information from branches and subsidiaries, when necessary for AML/CFT purposes, to the compliance, audit and AML/CFT functions at group level. This information refers to data and analyses of transactions or activities which appear unusual, if such analyses were performed, and information related to suspicious reports or the fact that such reports have been transmitted to the FIU. Similarly, branches and subsidiaries must receive such information from these group-level compliance functions when relevant and appropriate to risk management. Adequate safeguards on the confidentiality and use of information exchanged, including safeguards to prevent disclosure must also be provided (Article 10 of the Law of 25 March 2020). The Law of 25 March 2020 further strengthens, under Article 5(4) of the 2004 Law, the protection of individuals, including employees and representatives of the professional, who may not be subject to threats, retaliatory or hostile action, and in particular to adverse or discriminatory employment actions due to the report of a suspicion of money laundering or terrorist financing to the FIU (Article 11 of the Law of 25 March 2020). Article 11 of the Law of 25 March 2020 also brings changes to Article 5(5) of the 2004 Law concerning the prohibition of tipping-off. Finally, the supervisory powers of the supervisory authorities and self-regulatory bodies in charge of monitoring compliance by the professionals of their professional obligations as regards AML/CFT have also been strengthened by the Law of 25 March 2020 (Article 15 of the Law of 25 March 2020). Several new articles (Articles 9-1a to 9-2c of the 2004 Law) further enhance cooperation between competent authorities and/or with other national or international authorities (Articles 24 to 27 of the Law of 25 March 2020). II. Law of 25 March 2020 establishing a central electronic data retrieval system related to IBAN accounts and safe-deposit boxes This law introduces two other significant amendments to the 2004 Law, through the addition of:

• a new Section 3 under Chapter 3 relating notably to the specific provisions applicable to virtual asset service providers and to the registration and supervision regime for AML/CFT purposes of these entities by the CSSF. In this context, the CSSF draws attention to its Communiqué of 9 April 2020 on virtual assets, virtual asset service providers and the related registration process, which includes, among others, the link to the forms to be used by these professionals that wish to proceed with their registration;
• a new Section 4 under Chapter 3 on the particular provisions applicable to trust and company service providers which must henceforth register with their competent authority, including the CSSF for those professionals falling within the scope of application of the CSSF’s supervision and providing services to companies and trusts. As indicated by its title, this law also establishes a central electronic data retrieval system related to IBAN accounts and safe-deposit boxes, allowing the identification, in due time, of any natural or legal person holding or controlling payment accounts, bank accounts identified by IBAN as well as safe-deposit boxes in Luxembourg. This aspect of the law, which does not

Circular CSSF 20/742 page 5/5 amend the 2004 Law, will be further detailed in a new dedicated CSSF circular, including specifications on the technical requirements needed for the implementation of this system. Please note that the preceding presentation does not entirely cover all the amendments to the 2004 Law and therefore only gives a general overview of the changes of particular interest for the financial sector. Moreover, attention is drawn to the fact that the two laws of 25 March 2020 only transpose part of the provisions of Directive (EU) 2018/843 of 30 May 2018 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing. Yours faithfully, COMMISSION de SURVEILLANCE du SECTEUR FINANCIER Claude WAMPACH Marco ZWICK Jean-Pierre FABER Director Françoise KAUTHEN Claude MARX Director Director General