On 26 April 2017, the Bill of Law n.7128 (Bill of Law), which will implement into national legislation some provisions of the 4th AML Directive and reinforce measures of the Regulation on information accompanying transfers of funds, was introduced to the Chamber of Deputies.

This legal alert will only treat the provisions of the 4th AML Directive that will mainly be implemented by amending the law of 12 November 2004 on the fight against money laundering and terrorist financing (AML Law).

Credit institutions, professionals of the financial and insurance sector, pension funds, management companies, alternative investment fund managers, undertakings for collective investment (UCIs, UCITS, SIFs, RAIFs) and investment companies in risk capital (SICAR), statutory auditors, accountants and accounting professionals, real estate agents, notaries, court bailiffs, lawyers, tax and economic advisers, traders of goods and other obliged entities subject to the AML Law: What will your new obligations be?

The Bill of Law will amend the Luxembourg legal framework to ensure:

  • The implementation of provisions of the Directive (EU) 2015/849 of the European Parliament and of the Council of 20 May 2015 on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (4th AML Directive) that relate to the obliged entities’ professional obligations and the monitoring of their respect.
  • The reinforcement of measures of the Regulation (EU) 2015/847 of the Parliament and of the Council of 20 May 2015 on information accompanying transfers of funds (Regulation on information accompanying transfers of funds).

Below you will find the main amendments to the AML Law proposed by the Bill of Law.

Scope

The following entities and professionals will explicitly be subject to the AML Law:

  • Foreign credit institutions and financial institutions when they perform their activities in Luxembourg through branches or simply as free service providers.
  • Every person exercising the Family Office activity.
  • Court bailiffs when they proceed to valuation and public sales of furniture, movables and harvestings.

Traders of goods

The amount of cash payments, either made or received, for which traders of goods shall implement the obligations of the AML Law, will be reduced from €15,000 to €10,000.

Professional obligations

  • Take appropriate steps to identify and assess the risks of money laundering and terrorist financing to which they are exposed taking into account risk factors (including those relating to their customers, countries or geographic areas, products, services, transactions or delivery channels) and risk variables (such as the purpose of an account or relationship, the size of the transactions undertaken, the regulatory and duration of the business relationship), in order to adapt their level of vigilance in accordance with the identified risks.
  • Document, keep up-to-date and make available the risk assessments to the relevant control authorities and self-regulatory bodies concerned.
  • Identify and assess the money laundering and terrorist financing risks which may arise in relation to the development of new products, business practices and technologies.

The AML Law will contain in appendix non-exhaustive lists of risk factors and risk variables.

The relevant control authorities and self-regulatory bodies can decide that individual and documented risk assessments are not mandatory, if the risks of the concerned sector have been clearly identified and understood.

For companies:

  • A shareholding of 25% plus one share or an ownership interest of more than 25% in the customer held by a natural person, shall be an indication of direct or indirect ownership (if through a corporate entity).
  • The senior managing official shall be identified if a natural person cannot be identified as beneficial owner or if there is a doubt on whether the identified persons are not the beneficial owners.

For trusts, foundations and similar legal arrangements:

  • The settlor, the trustee, the protector, the beneficiaries or the class of persons in whose main interest the legal entity is set up or operates as well as any other natural person exercising ultimate control over the trust by means of direct or indirect ownership or by other means shall be identified.

Apart from the standard customer due diligence measures, additional measures shall be taken for insurance policy beneficiaries.

  • In some specific cases, the control authorities may demand to withhold information and documents for a supplementary five year period. The latter may be envisaged by the Obliged Entities as well.
  • Obliged Entities must keep records of the actions they have undertaken to identify the beneficial owners.
  • The processing of personal data for any other purpose that the preventing of money laundering and terrorist financing is prohibited.
  • Obliged Entities must provide new clients with certain information before establishing a business relationship or carrying out an occasional transaction.
  • In limited cases foreseen by the AML Law, the data subject’s right to access his or her personal data can be restricted or delayed.
  • The processing of personal data according to the AML Law is considered as a public interest issue in accordance with the amended Act of 2 August 2002 on the protection of persons with regard to the processing of personal data.

Simplified customer due diligence

  • An appendix including the risk factors which shall be at least taken into consideration by the Obliged Entities to ascertain that the business relationship or the transaction presents a lower degree of risk will be attached to the AML Law.
  • Specific provisions for electronic money.

Enhanced customer due diligence

  • An appendix including the risk factors which shall be at least taken into consideration by the Obliged Entities when they assess the risks of money laundering and terrorist financing (ML-TF) will be attached to the AML Law.
  • Enhanced customer due diligence shall be applied when dealing with natural persons or legal entities established in third countries that do not or insufficiently apply measures for the fight against money laundering and terrorist financing.
  • Politically exposed persons (PEPs):
  • There will no longer be a distinction between domestic and foreign PEPs.
  • The directors and members of the board of an internal organization will be considered PEPs.
  • Brothers and sisters will be included among the PEPs’ family members.

Adequate internal management requirements

  • Implement policies and monitoring procedures to effectively check, mitigate, and manage the ML-TF risks that are identified at an/a international, European, national, sector level as well as at their own level.
  • In relation to their level of risk, their size and their nature, take the necessary measures to inform their employees of their anti-money laundering and counter terrorist financing (AML/CFT) and data protection obligations.
  • Implement an appropriate procedure to allow their employees to report internally any AML/CFT obligations breaches through a specific, independent and anonymous channel.
  • Implement group-wide policies and procedures (including data protection policies and sharing information policies within the group) in order to apply to their branches and majority-owned subsidiaries measures that are equivalent to those laid down in the AML Law or in the 4th AML Directive.

Control authorities and self-regulatory bodies

  • Control Authorities: Commission de surveillance du secteur financier (CSSF), Commissariat aux assurances (CAA), Administration de l’enregistrement et des domaines (AED).
  • Self-regulatory bodies: Institut des réviseurs d’entreprises, Ordre des experts-comptables, Chambre des Notaires, Conseil de l’ordre, Chambre des huissiers

The above authorities shall ensure:

  • An efficient monitoring of the Obliged Entities’ compliance with their AML/CFT obligations (and, if required, with the cooperation of the competent authorities of the Member state where the Obliged Entity has its head office, if it operates establishments in Luxembourg).
  • That Obliged Entities have access to up-to-date information on the practices of money launders and financers of terrorism and on indications leading to the recognition of suspicious transactions.
  • Have identical supervisory and investigative powers as listed in the AML Law.
  • Ensure the establishment of reliable and efficient procedures to encourage the reporting of any of the Obliged Entities’ potential and actual breach of professional obligations.
  • Be entitled to impose administrative sanctions and measures (administrative sanction can amount to €5,000,000 or 10% of the total annual turnover according to the latest available accounts) that will be determined on circumstances listed in the AML Law. Any appeals against the authorities’ decisions will be brought before the Luxembourg Administrative Court (Tribunal Administratif) within a month as of their notification.
  • Publish the decisions imposing an administrative sanction or measure on their official website immediately after having informed the sanctioned person (exemptions are possible, if the publication might create disproportionate reactions and jeopardize the stability of financial markets or an on-going investigation).
  • Inform the European Supervisory Authorities (European Banking Authority, European Insurance and Occupational Pensions Authority and the European Securities and Market Authority) of all administrative sanctions and measures imposed to credit and financial institutions.
  • Inform the European Supervisory Authorities when a third country’s law does not allow the implementation of policies and procedures required at the group’s level.
  • Closely cooperate with each other and with the Financial Intelligence Unit.

Criminal sanctions

A fine between €12,500 and €5,000,000 will be imposed for the non-compliance with professional obligations.

The Bill of Law does not provide for the implementation of a beneficial owners’ register.

By 26 June 2017, the Luxembourg legislator should implement all the provisions of the 4th AML Directive.