CSSF AML/CFT questionnaire: the 2026 AMLA data collection
For the first time since the exercise began, a Luxembourg payment institution’s annual AML return is not a CSSF questionnaire at all. The CSSF has run an annual online Questionnaire on Financial Crime for years: launched in February, due in early April, filed on eDesk, owned by the RC or the RR. For the 2026 exercise it has stepped aside in favour of data collection templates developed by the European Authority for Anti-Money Laundering and Countering the Financing of Terrorism. This piece sets out who files what this year, the three categories entities fall into, the deadlines as they now stand, and what the change signals about supervision from here.
1. The return, and who owns it
The annual exercise collects standardised information on the money-laundering and terrorist-financing risks a supervised entity is exposed to, and on the risk-mitigation and targeted-financial-sanctions measures it has implemented. It is not an incident report and not a suspicious-transaction filing — it is the raw material for the CSSF’s risk-based supervision, feeding the assessment that determines how closely an entity is supervised and how likely it is to be inspected.
The addressee list is wide: credit institutions, investment firms, investment fund managers, payment institutions and electronic money institutions, virtual asset service providers, crypto-asset service providers, specialised professionals of the financial sector and central securities depositories incorporated under Luxembourg law — plus Luxembourg branches of those entity types whose registered office is in another EU country or a third country.
Ownership is personal and fixed by regulation. The questionnaire is submitted by the RC — the responsable du contrôle du respect des obligations professionnelles — or the RR, the responsable du respect des obligations professionnelles, as defined in Article 1(1) of CSSF Regulation N° 12-02 of 14 December 2012 as amended by CSSF Regulation N° 20-05 of 14 August 2020. Completion may be assigned within eDesk to another employee or a third party, but ultimate responsibility stays with the RC or the RR.
2. What changed for 2026
By its circular letter of 12 February 2026, the CSSF announced that it would deploy the data collection templates developed by AMLA in cooperation with national competent authorities, instead of launching its usual annual Questionnaire on Financial Crime — with one exception, noted below.
The reasoning is stated plainly in the letter, and it is a simplification argument. AMLA had launched a significant data collection covering a broad range of CSSF-supervised entities; running the CSSF questionnaire alongside it would either have lost representativeness or forced firms to complete two questionnaires. The CSSF chose to request the AMLA-prepared questionnaire instead, to ensure consistency and a level playing field ahead of the new common EU AML/CFT methodology.
The letter also flags that an ad-hoc questionnaire may still be requested later in the year to collect essential data points — those required for FATF purposes, for example — where the AMLA templates do not cover them.
3. Three categories, three answers
The 12 February letter divides addressees into three groups, and which group an entity is in determines both what it files and when.
| Category | Who | What they file |
|---|---|---|
| A | Entities selected for the AMLA calibration exercise — notified directly by the CSSF; participation is mandatory | A defined set of quantitative and qualitative data points for the AMLA risk-assessment and selection methodology test |
| B | All other supervised entities except specialised PFS — including payment and e-money institutions not in the sample | Reporting on 2025 ML/TF risks and mitigation measures, on the AMLA-developed templates |
| C | Specialised professionals of the financial sector, who are outside the AMLA exercise | The usual CSSF Questionnaire on Financial Crime |
The data points required of category A are specified in the annexes to two draft regulatory technical standards: the draft RTS on the assessment of the inherent and residual risk profile of obliged entities under Article 40(2) of Directive (EU) 2024/1640, and the draft RTS on the risk assessment for the purpose of selecting credit institutions, financial institutions and groups for direct supervision under Article 12(7) of Regulation (EU) 2024/1620. Those are the same instruments that will decide, in due course, which institutions AMLA supervises directly — which is why the calibration exercise is mandatory rather than invited.
4. The dates, and how they moved
The timetable was reset once. The 12 February letter set the launch at 2 March 2026 via eDesk for all entities except specialised PFS, whose CSSF questionnaire launched on 23 February 2026, and gave the calibration sample a reporting date of 15 April 2026. By the follow-up circular letter of 16 March 2026, the final AMLA documents were available through eDesk and the deadlines had moved:
| Category | Launch | Deadline |
|---|---|---|
| A — AMLA calibration sample | 2 March 2026 | 22 April 2026 (updated by AMLA from 15 April) |
| B — all other entities except specialised PFS | 2 March 2026 | 22 May 2026 |
| C — specialised PFS | 23 February 2026 | 3 April 2026 |
Two points are worth carrying into next year’s planning. The deadline moved after the exercise had been announced, and the final documents did not appear until mid-March for an exercise that opened on 2 March. Building a filing plan on the launch-date announcement alone is how a team ends up rebuilding it.
5. Pre-population, and why it is worth the enrolment
For its own questionnaire the CSSF has offered an API route: a structured exchange file in JSON format transmitted to the CSSF over the S3 protocol, which pre-fills the questionnaire on eDesk. Pre-filled values remain editable in eDesk, and manual entry of the whole form stays available for firms that prefer it. The CSSF publishes technical guidance on transmitting reports via the S3 API, including the enrolment process, and a user guide covering the JSON schema and naming conventions.
The case for enrolling is not the time saved on a single filing. It is that a JSON payload is generated from a system of record, which makes the answers reproducible, reviewable before submission and comparable year on year — three things a manually keyed web form is bad at. Where the same underlying figures also feed other returns, generating them once removes an entire class of inconsistency between filings.
6. Three worked scenarios
Scenario 1 — the EMI that was not notified
Facts: a Luxembourg electronic money institution hears about the AMLA calibration exercise and cannot tell whether it is in the sample.
Rule: selected entities are notified directly by the CSSF. No notification means category B: the AMLA-developed templates, launched 2 March, due 22 May.
What the team does: confirm no notification reached the RC or RR — not the general mailbox — then plan to the category B date. The trap is assuming the later deadline and discovering a direct notification sitting unread in a personal eDesk account.
Scenario 2 — the Luxembourg branch of an EU payment institution
Facts: a payment institution authorised in another member state operates a Luxembourg branch and files its group AML return to its home supervisor.
Rule: the circular letters are addressed to Luxembourg-incorporated entities and to Luxembourg branches of the listed entity types whose registered office is in an EU or third country. The branch is an addressee in its own right.
What the team does: file for the branch, on branch-attributable activity, regardless of what the group files at home. Establish which figures are branch-level and which are group-level before the form is open, because the reconciliation question — why the branch numbers do not tie to the group return — is the one that arrives afterwards.
Scenario 3 — the delegated preparer
Facts: an entity asks an external adviser to complete the questionnaire because the RC is on leave through the deadline.
Rule: completion may be assigned within eDesk to another employee or a third party, but ultimate responsibility for adequate completion remains with the RC or the RR — and both the officer and the delegate need eDesk accounts with LuxTrust authentication.
What the team does: set the delegation up in eDesk in advance, not in the final week, and keep a documented review step before submission. Delegation moves the keystrokes, not the accountability.
7. What the change signals
A national questionnaire being displaced by AMLA templates is a small administrative event with a large direction of travel behind it. The data points come from draft RTS made under Article 40(2) of Directive (EU) 2024/1640 and Article 12(7) of Regulation (EU) 2024/1620 — the risk-profile assessment and the selection of institutions for AMLA’s direct supervision. This year the exercise calibrates the model. Later, the same shape of data decides which institutions are supervised from Frankfurt rather than from Luxembourg.
The practical implication for a payment or e-money institution is that the questionnaire is no longer purely a local compliance chore. The figures reported into a common EU template become comparable across member states, and comparability is what makes an outlier visible.
8. FAQ
Is the CSSF Questionnaire on Financial Crime still running?
For 2026, only for specialised professionals of the financial sector. All other supervised entities, including payment and e-money institutions, report on the AMLA-developed data collection templates instead.
How do we know whether we are in the AMLA calibration sample?
Selected entities were notified directly by the CSSF, and participation is mandatory. If no direct notification was received, the entity falls into the general category.
Who has to submit the filing?
The RC or the RR, as defined in Article 1(1) of CSSF Regulation N° 12-02 as amended by CSSF Regulation N° 20-05. Completion can be assigned in eDesk to an employee or third party, but responsibility does not move.
Does a Luxembourg branch of a foreign institution have to file?
Yes. The circular letters are addressed to Luxembourg branches of the listed entity types having their registered office in an EU country or a third country, alongside Luxembourg-incorporated entities.
Can the questionnaire be pre-filled from our own systems?
The CSSF has offered an API route for its questionnaire using a JSON exchange file transmitted over the S3 protocol, which pre-fills the eDesk form; pre-filled values stay editable and full manual entry remains possible. Technical guidance and a user guide covering the JSON schema and naming conventions are published by the CSSF.
What reference period does the 2026 exercise cover?
2025. Entities outside the calibration sample report on their 2025 ML/TF risks and the related mitigation measures.
9. What to do, today
- Confirm the RC or RR — and any intended delegate — hold live eDesk accounts with working LuxTrust authentication, outside the filing window.
- Check whether a direct CSSF notification of calibration-sample selection reached the responsible officer personally, not a shared mailbox.
- For a Luxembourg branch, settle the branch-versus-group figure boundary before the form opens, and record the reasoning.
- Assess the S3 / JSON pre-population route on reproducibility and reviewability, not on the hours it saves in one filing.
- Diarise a check of the CSSF circular-letter feed in the first quarter — this year both the instrument and the deadline changed after the exercise was announced.
- Read the draft RTS annexes under Article 40(2) of Directive (EU) 2024/1640 and Article 12(7) of Regulation (EU) 2024/1620 as a preview of the data the model will run on.
Related: Filing an STR with the Luxembourg CRF · CSSF legal reporting for LU payment and e-money institutions · AMLA entity risk scoring · Luxembourg reporting calendar · CSSF Regulation 12-02 — the Luxembourg AML rulebook
