Commission de Surveillance du Secteur Financier (CSSF)

What is Commission de Surveillance du Secteur Financier (CSSF)?

The Commission de Surveillance du Secteur Financier (CSSF) is Luxembourg’s financial regulator. It permits, checks, and enforces compliance at banks, investment firms, payment institutions, fund managers, and other financial sector professionals. It also monitors the effective implementation of the Luxembourg anti-money laundering and counter-terrorist financing (AML/CFT) regulations.

According to CSSF Regulation No. 12-02, supervised entities are required to implement customer due diligence, identify and verify beneficial owners, conduct ongoing monitoring of customer relationships, and report any suspicious activity to the Luxembourg Financial Intelligence Unit (CRF), not the CSSF. The CSSF was established by the Law of 23 December 1998 and acts as Luxembourg’s competent authority for supervising the financial sector. The CSSF regularly issues regulations, circulars, and guidance to provide further clarity on supervisory expectations and the interpretation of AML/CFT obligations.

Who Does the Luxembourg Financial Regulator Supervise?

The CSSF supervises credit institutions, investment fund managers (UCITS and AIFMs), payment and electronic money institutions, professionals of the financial sector (PFS), and the Luxembourg Stock Exchange. Life insurers are subject to separate AML oversight by the Commissariat aux Assurances, while lawyers, notaries, and accountants answer to their respective professional bodies, which work alongside the CSSF and the CRF. 

That split matters for group structures spanning banking, fund administration, and insurance, where a single client relationship can trigger obligations to multiple competent authorities simultaneously. Luxembourg is one of the world’s largest investment fund domiciles, making investment funds a major focus of the CSSF’s oversight.

How the CSSF Enforces AML/CFT Compliance

The CSSF follows a risk-based supervisory model, with higher-risk entities subject to more frequent on-site inspections, desk-based reviews, and thematic assessments. Supervisory intensity is determined by factors such as business activities, customer profile, products, delivery channels, and geographic exposure. The regulator also expects firms to maintain strong governance, effective internal controls, independent compliance functions, and documented AML/CFT policies that are proportionate to their business activities and risk exposure.

In March 2026 alone, the CSSF fined Stonehage Fleming Luxembourg S.A. €56,000 and PingPong Europe S.A. €12,000, both following AML/CFT on-site inspections that identified deficiencies in customer due diligence and transaction monitoring controls. Fines are calculated based on annual turnover and are generally published by name, which adds reputational exposure on top of the financial penalty.

Beyond administrative fines, the CSSF can issue injunctions, require remediation plans, restrict certain business activities, withdraw authorizations in serious cases, and publish enforcement actions where permitted by law. These measures allow the regulator to address weaknesses before they create wider risks to Luxembourg’s financial system.

What will Change for CSSF in the Context of the EU AML Package?

The Luxembourg CSSF is adjusting its regulatory approach as the EU’s new Anti-Money Laundering Regulation (AMLD6) and the Anti-Money Laundering Authority (AMLA) come into force. Most domestic institutions are supervised by the CSSF under a harmonized single rulebook, while selected high-risk cross-border institutions will be gradually subject to direct supervision by AMLA under the EU AML package. The Anti-Money Laundering Regulation (AMLR) establishes directly applicable AML requirements in EU Member States and is designed to reduce differences in AML rules across the Member States.

The CSSF will continue reviewing its AML Handbook, risk-factor guidance, and reporting templates as the underlying EU legislation is finalized, and will likely provide transitional arrangements during the transition period. This translates to extra layers of compliance for compliance teams, screening, and reporting that can range from national to EU-level standards.

How AML Watcher Supports Compliance with the Luxembourg Regulator

The CSSF’s AML expectations will be met through ongoing transactions and customer risk monitoring, complemented by continuous sanctions, PEP, and adverse media screening. Customer screening, monitoring, and audit documentation can be some of the areas identified as weaknesses during CSSF examinations that firms may not know about. 

AML Watcher supports firms to improve their customer screening, sanctions screening, PEP screening, and adverse media monitoring capabilities, and keeps the audit trail that regulators require during supervisory visits.

Request a demo to see how the platform supports AML compliance under Luxembourg’s regulatory framework.