CSSF Circular 25/896 - Enhanced Focus on Sanctions
CSSF Circular 25/896 - Enhanced Focus on Sanctions
CSSF Circular 25/896 puts the spotlight on Sanctions, with the new rules being applicable as of 30th December 2025.
Luxembourg firms must now treat Sanctions Compliance as a separate, Board-level responsibility with strong operational processes and documented policies. This is a shift from the more implicit, AML-driven approach of the past.
The Circular includes 2 sets of guidelines: EBA/GL/2024/14 and 15. The first one is for all CSSF regulated financial institutions under EBA’s remit and the second one is for CSSF regulated PSPs and CASPs particularly. Both enhance the way Sanctions are treated and documented. Restrictive measures compliance is now formally a stand-alone obligation aligned with the EBA’s guidelines.
What does this mean for CSSF regulated banks, AIFMs, PSPs and CASPs in Luxembourg?
- Responsible individuals need to be appointed at Senior Management/Board level for Sanctions Compliance, and updated Governance Documentation needs to be put in place.
- A Restrictive Measures Exposure Assessment needs to be conducted, focusing specifically on the exposure to Sanctions Risks (business lines, clients, products, geography). Risk Indicators need to be identified and documented with an annual review (minimum).
- Separate Sanctions Policy and Procedures need to be put in place, separate from AML/CTF policies and procedures. The sanctions screening process needs to be clearly defined for both customers, UBOs and transactions. The policies and procedures need to include how screening is conducted, how lists are updated, how alerts are handled and escalated, and how reporting to the authorities are conducted.
- Sanctions screening relevant IT systems and framework needs to be reviewed to ensure CSSF expectations, and a daily update towards official Sanctions Lists (EU, UN; US if relevant, national) needs be guaranteed.
- Training needs to be role-specific and not generic. All training needs to be documented (attendance, frequency, content).
Full compliance is required by 30th December 2025.