Grand-ducal Regulation of 1 February 2010 on the fight against money laundering and terrorist financing

1 This consolidated text was drawn up by the CSSF for information purposes only. In case of discrepancies between the French and the English consolidated texts, the texts published in the Journal officiel du Grand-Duché de Luxembourg are the sole authoritative and universally valid versions. Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended, (Mém. A 2010, No 15) as amended by:

• Grand-ducal Regulation of 5 August 2015 amending Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended; (Mém. A 2015, No 156)
• Grand-ducal Regulation of 14 August 2020 amending Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended. (Mém. A 2020, No 694)
• Grand-ducal Regulation of 25 October 2022 amending Grand-ducal Regulation of 1 February 2010 providing details on certain provisions of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended. (Mém. A 2022, No 537) Art. 1. Customer due diligence (…)1 (3) (…)2 “For the purposes of Article 3(7) of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (hereinafter the “Law”), special”3 attention shall notably be paid to: significant transactions relative to a business relationship, transactions that exceed certain limits, very high account turnover inconsistent with the size of the balance, or transactions which fall out of the regular pattern of the account's activity. Professionals shall scrutinise, as far as possible, the background and purpose of such transactions, set forth their findings in writing and keep these documents in accordance with Article 3(6)(b) of the Law and to keep them available for the “Luxembourg” authorities “responsible for the fight against money laundering and terrorist financing”4 and auditors for at least five years, without prejudice to longer record-keeping periods prescribed by other laws. “(4) In order to apply due diligence measures to customers, "appropriate times on a risk-sensitive basis" within the meaning of Article 3(5) of the Law shall notably mean one of the following situations: − a transaction of significance takes place; − customer documentation standards change substantially; 1 Grand-ducal Regulation of 14 August 2020 2 Grand-ducal Regulation of 14 August 2020 3 Grand-ducal Regulation of 14 August 2020 4 Grand-ducal Regulation of 14 August 2020

2 − as regards banking business, a material change in the way that a customer's account is operated; − the professional becomes aware that it lacks sufficient information about an existing customer. The professionals shall be able to prove to the supervisory authorities or self-regulatory bodies that the extent and frequency of customer due diligence measures is appropriate in view of the money laundering and terrorist financing risks. The customer due diligence measures shall be carried out at least every seven years, without prejudice to higher frequency depending on the risk assessment.”5 (5) The record-keeping obligation of documents “, data”6 and information as provided in Article 3(6) of the Law shall include the obligation to maintain records of the identification data, account files and of the business correspondence “, as well as the results of any analysis carried out”7, for at least five years following the termination of an account or business relationship, without prejudice to any longer record-keeping periods prescribed by other laws. If a “supervisory”8 authority requests, in specific cases and for the fulfilment of its mandate, to apply a longer record-keeping period than the minimum period provided above, the professional shall comply with this request. Transaction records shall be sufficient to allow reconstruction of various transactions so as to provide, if necessary, evidence for prosecution of criminal activity. Together, the different components of an “individual”9 transaction record shall thus provide, in particular, the following information: name of the customer and beneficiary “of the transaction”10, address or other identifying information“()”11, the nature and date of the transaction, the type and amount of currency involved, and the type and identifying number of any account involved in the transaction. Professionals shall ensure that all the above-mentioned transaction records and information are available to the “Luxembourg”12 authorities “responsible for the fight against money laundering and terrorist financing”13, when acting in the context of their mandate, so that professionals may respond “without delay”14 to information requests by such authorities. (6) Both customer due diligence in general and the assessment of the extent of the measures to be applied on a risk-sensitive basis in particular, shall be consistent with the guidelines issued by the “supervisory”15 authorities “and self-regulatory bodies”16, for instance in the form of circulars. (Grand-ducal Regulation of 14 August 2020) 5 Grand-ducal Regulation of 14 August 2020 6 Grand-ducal Regulation of 14 August 2020 7 Grand-ducal Regulation of 14 August 2020 8 Grand-ducal Regulation of 14 August 2020 9 Grand-ducal Regulation of 14 August 2020 10 Grand-ducal Regulation of 14 August 2020 11 Grand-ducal Regulation of 14 August 2020 12 Grand-ducal Regulation of 14 August 2020 13 Grand-ducal Regulation of 14 August 2020 14 Grand-ducal Regulation of 14 August 2020 15 Grand-ducal Regulation of 14 August 2020 16 Grand-ducal Regulation of 14 August 2020

3 “(7) The threshold of EUR 1,000 as laid down in Article 3(1)(b)(ii) of the Law shall also apply to occasional operations carried out by virtual asset service providers as defined in Article 7-1 of the Law.” Art. 2. Simplified customer due diligence It is not mandatory to apply the simplified customer due diligence regime as set out in Article 3-1 of the Law and is therefore not imposed on professionals. The obligation to gather sufficient information in any circumstances so as to establish whether the customer meets the necessary conditions for Article 3-1 of the Law to apply, shall at least include customer identification and monitoring of the business relationship so that the necessary conditions for Article 3-1 of the Law are always met and the verification that there is no suspicion of money laundering or terrorist financing. This obligation also applies to the situations referred to in Article 3-1(4) of the Law. (Grand-ducal Regulation of 5 August 2015) “The professionals may reduce the identification measures and need not verify the identity of their customer and, where applicable, the beneficial owner of the business relationship when they carry out online payment services fulfilling each of the following conditions:

1. the transaction concerns the provision of payment services listed under number 3, second and third indents, number 4, second and third indent, number 5 and number 7 of the Annex to the law of 10 November 2009 on payment services, as amended;
2. the transaction is executed via accounts held with payment service providers located in the EU or in a third country which imposes equivalent requirements relating to the fight against money laundering and terrorist financing;
3. the transaction does not exceed a unit amount of EUR 250;
4. the total amount of the transactions executed for the customer during the 12 months preceding the transaction does not exceed EUR 2,500. The possibility not to verify the identity of the customer and, where applicable, of the beneficial owner of the business relationship, also applies to professionals with respect to electronic money referred to in Article 3-1(4)(…)17 of the Law.” The simplified customer due diligence regime is excluded when there is a suspicion of money laundering or terrorist financing, when there are doubts about the veracity or adequacy of previously obtained data or in specific circumstances which carry a higher risk. Art. 3. Enhanced customer due diligence “(1) Business relationships and transactions involving notably high-risk countries constitute higher-risk situations within the meaning of Article 3-2(2) of the Law which require particular attention and the application of enhanced due diligence measures.”18 17 Grand-ducal Regulation of 14 August 2020 18 Grand-ducal Regulation of 14 August 2020

4 “Supervisory authorities”19 and, where applicable, self-regulatory bodies of the different professionals shall inform the professionals of concerns about country-specific loopholes in the relevant provisions for the fight against money laundering and terrorist financing of the countries referred to above. Where such a country continues not to apply or insufficiently applies measures for the fight against money laundering and terrorist financing, these authorities and bodies shall warn the professionals about the risks of money laundering and terrorist financing in transactions with natural or legal persons of that country. They may set out “counter-measures”20 based on a case-by-case approach which professionals must implement in view of the risk identified. “The authorisation procedure requiring the approval of senior management shall also include the anti-money laundering and counter-terrorist financing compliance officer.”21 (2) For non-face-to-face transactions “and where the professional has not put in place electronic identification means, relevant trust services within the meaning of Regulation (EU) No 910/2014 or any other secure, electronic or remote identification process which is regulated, recognised, approved or accepted by the relevant national authorities”22, the professionals shall have policies and procedures in place to address any specific risks associated with such business relationships or transactions. These policies and procedures shall apply when establishing customer relationships and when conducting ongoing due diligence. (…)23 (3) In relation to cross-border correspondent (…)24 relationships referred to in Article 3- 2(3) of the Law, credit institutions“, financial institutions and other institutions concerned by this provision”25 shall also: − determine from publicly available information the reputation of the respondent institution and the quality of its supervision, including whether the institution concerned has been subject to a money laundering or terrorist financing investigation or regulatory action; − assess the respondent institution's controls against money laundering and terrorist financing and ascertain that they are adequate and effective; − “clearly understand and”26 document the respective responsibilities “as regards”27 the fight against money laundering and terrorist financing of each institution. (…)28 19 Grand-ducal Regulation of 14 August 2020 20 Grand-ducal Regulation of 14 August 2020 21 Grand-ducal Regulation of 14 August 2020 22 Grand-ducal Regulation of 14 August 2020 23 Grand-ducal Regulation of 14 August 2020 24 Grand-ducal Regulation of 14 August 2020 25 Grand-ducal Regulation of 14 August 2020 26 Grand-ducal Regulation of 14 August 2020 27 Grand-ducal Regulation of 14 August 2020 28 Grand-ducal Regulation of 14 August 2020

5 Where a correspondent (…)29 relationship involves the maintenance of "payable￾through" accounts, credit institutions“, financial institutions and other institutions concerned by such relationships”30 shall be satisfied that: (a) their customer (the respondent (…)31 institution) has performed all the (…)32 customer due diligence obligations set out in Article 3 of the Law on those of its customers that have direct access to the accounts of the correspondent institution; and (b) the respondent (…)33 institution is able to provide relevant customer identification data “and information”34 upon request to the correspondent institution. A Luxembourg credit institution is authorised to provide such “data and”35 information within the framework of a correspondent (…)36 relationship. To the extent that other institutions which are not credit institutions are involved in correspondent banking relationships, these rules shall equally apply to these institutions. (4) Enhanced customer due diligence for politically exposed persons shall also apply when this person carries out a prominent public function in another Member State or in a third country or on behalf of the Member State or the third country. Professionals shall put in place appropriate risk management systems“, including risk￾based procedures,”37 to determine whether a potential customer, a customer or the beneficial owner is a politically exposed person. Where a customer has been accepted and the customer or beneficial owner is subsequently found to be, or subsequently becomes a politically exposed person, professionals shall obtain approval to continue the business relationship from the senior management. The authorisation procedure requiring approval from the senior management shall “also involve”38 the “anti-money laundering and counter-terrorist financing compliance officer”39. Professionals shall take reasonable measures to establish the source of wealth and the source of funds of customers and beneficial owners identified as politically exposed persons. Where professionals are in a business relationship with a politically exposed person, they shall be required to conduct enhanced ongoing monitoring on that relationship. 29 Grand-ducal Regulation of 14 August 2020 30 Grand-ducal Regulation of 14 August 2020 31 Grand-ducal Regulation of 14 August 2020 32 Grand-ducal Regulation of 14 August 2020 33 Grand-ducal Regulation of 14 August 2020 34 Grand-ducal Regulation of 14 August 2020 35 Grand-ducal Regulation of 14 August 2020 36 Grand-ducal Regulation of 14 August 2020 37 Grand-ducal Regulation of 14 August 2020 38 Grand-ducal Regulation of 14 August 2020 39 Grand-ducal Regulation of 14 August 2020

6 Art. 4. Obligations of branches and subsidiaries in foreign countries The customer due diligence requirements laid down in “Article 4-1(3)”40 of the Law that the branches and “majority-owned”41 subsidiaries in third countries shall comply with include all of the requirements listed in Article 3 of the Law and particularly those set out in paragraph 2 of this article. “Professionals”42 shall pay particular attention that this principle is observed with respect to their branches and subsidiaries in “high-risk”43 countries (…)44. Where the minimum requirements for the fight against money laundering and terrorist financing of host countries differ from those applicable in Luxembourg, branches and subsidiaries in host countries shall apply the higher standard, to the extent that host country laws and regulations permit. Art. 5. Prohibition of accounts and passbooks in fictitious names Customer due diligence procedures and requirements for the recording and the keeping of documents prohibit that accounts and passbooks be kept in fictitious names. (…)45 (…)46 (Grand-ducal Regulation of 25 October 2022) “Art. 6. Performance of customer due diligence by third parties For the purpose of applying Article 3-3 of the Law, each professional shall apply a risk￾based approach which takes into account the information available on the risk level relating to the countries in which the third parties are based.” Art. 7. Appropriate internal management requirements (1) Appropriate internal management requirements shall include the obligation to establish and maintain internal procedures, policies and controls“, including risk management methods,”47 to prevent money laundering and terrorist financing and to communicate these to employees. These procedures, policies and controls shall cover, inter alia, customer due diligence, record -keeping, the detection of unusual or suspicious transactions and the obligation to report suspicious transactions. (…)48 40 Grand-ducal Regulation of 14 August 2020 41 Grand-ducal Regulation of 14 August 2020 42 Grand-ducal Regulation of 14 August 2020 43 Grand-ducal Regulation of 14 August 2020 44 Grand-ducal Regulation of 14 August 2020 45 Grand-ducal Regulation of 25 October 2022 46 Grand-ducal Regulation of 25 October 2022 47 Grand-ducal Regulation of 14 August 2020 48 Grand-ducal Regulation of 14 August 2020

7 Art. 8. Cooperation requirements with the authorities (1) The obligation to communicate information referred to in Article 5(1)(b) of the Law shall include the communication of existing documents on which this information is based. (2) Pursuant to Article 5(1)(a) of the Law, the obligation to report suspicious transactions shall apply for each fact which might be an indication of money laundering “, an associated predicate offence”49 or terrorist financing due, in particular for reasons relating to the person concerned, to his development, to the source of the funds, to the nature, the purpose or procedures of the transactions, without the reporting person classifying the underlying offence. Particularly in the fight against terrorist financing, this reporting obligation shall also apply to funds for which there are reasonable grounds to suspect or they are suspected to be linked or related to, or to be used for terrorism, terrorist acts or by “a terrorist”50 “or a terrorist group”51 or by those who finance terrorism, without limiting this obligation solely to funds of persons listed by the United Nations or by the European Union in the context of the fight against terrorism. (3) An information request relating to the fight against money laundering and terrorist financing pursuant to Article 5(1)(b) of the Law or an instruction “not to execute transactions pursuant to”52 paragraph 3 of this article does not presuppose a prior information according to paragraph (1)(a) of this article but these measures may also be taken by “the Financial Intelligence Unit (hereinafter the “FIU”)”53, in the absence of a “prior”54 suspicious transaction report (…)55. (Grand-ducal Regulation of 14 August 2020) “A request for information from the FIU may be transmitted electronically or, where the professional is not registered with the FIU, by mail.” “An instruction by the FIU not to execute a transaction may be transmitted either electronically”56 “or by mail”57 “or through verbal instruction”58. “In case of verbal instruction, this communication”59 must be followed by a written confirmation within 3 “working”60 days. (…)61 (4) The adequate and appropriate procedure regarding the communication referred to in Article 4(1) of the Law shall include procedures enabling professionals to respond rapidly and fully to any information request from the Luxembourg authorities responsible for the fight against money laundering and terrorist financing. “These procedures aim, in particular with respect to the obligation to cooperate with the FIU, at the prior registration in the data 49 Grand-ducal Regulation of 14 August 2020 50 Grand-ducal Regulation of 14 August 2020 51 Grand-ducal Regulation of 14 August 2020 52 Grand-ducal Regulation of 14 August 2020 53 Grand-ducal Regulation of 14 August 2020 54 Grand-ducal Regulation of 14 August 2020 55 Grand-ducal Regulation of 14 August 2020 56 Grand-ducal Regulation of 14 August 2020 57 Grand-ducal Regulation of 14 August 2020 58 Grand-ducal Regulation of 14 August 2020 59 Grand-ducal Regulation of 14 August 2020 60 Grand-ducal Regulation of 14 August 2020 61 Grand-ducal Regulation of 14 August 2020

8 processing system of the FIU in order to report suspicious transactions or to respond to an information request of the FIU.”62 (5) The protection for disclosures made in good faith under Article 5(4) of the Law shall apply even “in circumstances where the reporting person was not precisely aware of the associated predicate offence, regardless of whether illegal activity actually occurred”63. Art. 9. Sanctions Any person breaching the professional obligations as specified in this grand-ducal regulation shall incur a fine or sanctions in accordance “with Articles 8-4, 8-10 or”64 9 of the Law“, where applicable”65. Art. 10. Our Minister of Finance shall execute this regulation, which shall be published in the Mémorial. 62 Grand-ducal Regulation of 14 August 2020 63 Grand-ducal Regulation of 14 August 2020 64 Grand-ducal Regulation of 14 August 2020 65 Grand-ducal Regulation of 14 August 2020