Circular CSSF 26/904

Key dates

Financial year ending 31 December 2024

- Applicability of revised LFR to all investment firms; submissions begin for this period onward on a yearly basis

No specific submission deadline stated Deadline

- Yearly production required via CSSF portal; firms should align with existing annual reporting cycles for auditors (typically post-year-end)

Suggested considerations

• Investment Firms: Complete and submit the digital SAQ yearly via CSSF portal, providing descriptions of business model, ML/FT risks, commercial policy, monitoring, AML/CFT roles, and entity-level compliance; ensure data on fund transfers (e.g., missing payer/payee info) is included.
• REAs/Auditors: Verify SAQ adequacy, assess descriptions, perform corroborative controls, supplement with findings (e.g., AML/CFT audit declarations), independently assess ML/FT risks/organization, and integrate into single LFR document.
• General: Review existing processes for proportionality (focus on incremental info); update AML/CFT policies/documentation for branches/subsidiaries/tied agents; prepare for digital submission; document risk assessments thoroughly.
• Ongoing: Monitor compliance with related regs like Regulation (EU) 2023/1113 (effective 30 December 2024, per draft bill 8387).

What changed

• - Revised LFR Structure: Comprises four parts in a single digital document: (1) yearly SAQ completed by investment firms; (2) descriptive elements verified by approved statutory auditors (REAs); (3) AML/CFT report with risk assessments, declarations
• Digital Format: Completion and submission via CSSF's online portal, supporting CSSF 4.0 digital strategy for efficient processing.
• Proportionality and Scope: Applies individually to investment firms (no consolidated LFR if under CSSF consolidated supervision); focuses on incremental, relevant information tied to business models, avoiding overlap with other reports.
• Enhanced AML/CFT Focus: Requires descriptions of commercial policy, ML/FT risk management, roles/responsibilities, branch/subsidiary/tied agent compliance; REA must assess adequacy of infrastructures/controls, supplement descriptions, and document in
• REA Responsibilities: Verify/ensure adequacy of SAQ elements, assess descriptions, perform control procedures, and provide assessments on AML/CFT policy implementation across entities.

Who is affected

• Primary
• Secondary
• Indirect
• owned subsidiaries, and tied agents of investment firms, subject to ML/FT risk analysis and compliance verification.

Related regulations

• Predecessors
• CSSF Newsletter No 300 (January 2026)
• content/uploads/newsletter300.pdf).4
• MiFIR Reporting Update (January 2026)
• the-quality-of-transaction-reports-received-under-article-26-of-mifir-4/).6
• cssf-circular-25-901-modernizes-aif-rules).2