Steven Curfs (ALCO): CSSF introduces new flexibility on asset due diligence

The frequently-asked questions document issued by the CSSF last December represents a more pragmatic and adaptive approach to due diligence on assets by Luxembourg entities, according to Steven Curfs, conducting officer at Engelwood Asset Management and adviser to the Association of Luxembourg Compliance Officers.

What is the basis for due diligence on assets in Luxembourg?

Regulated entities in Luxembourg are subject to a high degree of due diligence requirements on assets, under the anti-money laundering legislation of November 12, 2004 and CSSF Regulation No 12-02. The 2004 law, the foundation of Luxembourg's AML framework, obliges entities including investment businesses and financial institutions, to implement strong controls. The CSSF regulation requires professionals to assess and monitor risks related both to customers and to investment assets on a continuous basis to curb prevent abuse of financial services for criminal purposes. However, the regulator’s frequently-asked questions document on December 13 last year – following the principles of ALFI’s May 2021 guidelines, emphasising a risk-based compliance approach – introduces a high degree of flexibility in the performance of due diligence and a more pragmatic compliance strategy.

How do the CSSF’s FAQs emphasize a risk-based approach?

Without sacrificing the fundamental principles of AML compliance, the CSSF’s FAQs acknowledges the need for a proportionate and risk-based approach to due diligence, rather than imposing a one-size-fits-all requirement. While high-risk assets, such as those linked to politically exposed persons or jurisdictions with poor AML controls, remain subject to enhanced due diligence, lower-risk assets can be dealt with by a simplified approach as long as documentary justification is provided. Regulated institutions can adapt the intensity and frequency of due diligence procedures to an asset's risk profile rather than adhering to rigid guidelines to ensure effective management of resources. The FAQs also acknowledge that ongoing due diligence does not necessarily require a repeated

“The FAQs demonstrate the CSSF’s desire for an efficient and practical AML regime that enhances Luxembourg's position as a financial centre.”

periodic review on all asset classes, offering greater autonomy to determine the frequency of review according to evolving risk factors, while facilitating wider use of automated surveillance systems and machine-learning-based risk assessment as well as the use of financial intelligence units and third-party service providers for risk discovery.

How do the due diligence requirements take greater account of proportionality?

The CSSF addresses the issue of proportionality by allowing institutions to use prior internal risk assessments rather than using standalone due diligence reports for all assets, simplifying documentation requirements for low-risk assets, and facilitating the use of digital technology and regtech solutions for record-keeping and compliance. The regulator’s more flexible approach should benefit the industry by enabling resources to be deployed more effectively, and aligning due diligence monitoring with other processes in the financial industry that employ AI and machine learning. In tandem with the ALFI guidance, the FAQs demonstrate the CSSF’s desire for an efficient and practical AML regime that enhances Luxembourg's position as a financial centre that prioritises compliance without compromising pragmatic operational considerations.