How to file a suspicious transaction report in Luxembourg — the CRF and goAML

In Luxembourg, money-laundering and terrorism-financing intelligence flows to one national agency: the Cellule de Renseignement Financier (CRF), and it arrives through one channel only — goAML. Every professional subject to the AML law — including EMIs, payment institutions and their Luxembourg branches — files its déclaration d’opération suspecte electronically, separately from any prudential dialogue with the CSSF. The legal threshold, the electronic-only intake, the duty to abstain from executing the operation, and the CRF’s power to block funds are all tighter than a casual reading suggests. This is the operational walkthrough, and it completes our SAR-filing set across the branch jurisdictions.

1. What the CRF is

The Cellule de Renseignement Financier (CRF) is Luxembourg’s financial-intelligence unit. It is part of the judicial system — attached to the public prosecutor’s office (Parquet) — and operationally independent. Its mandate sits in the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (the “AML Law”).

The CRF is the sole authority competent to receive suspicious-operation reports under Article 5, paragraph 1(a) of the AML Law. It analyses reports, enriches them with intelligence, and disseminates to the prosecutor and partner agencies. Like TRACFIN in France, the CRF is purely an intelligence unit — it does not supervise. Prudential and AML supervision of the financial sector sits with the CSSF.

2. Who must file

The AML Law lists the professionnels in scope. For a fintech audience the relevant categories are:

• Credit institutions and branches of foreign credit institutions
• Electronic-money institutions and payment institutions, including Luxembourg branches of EU EMIs/PIs
• Investment firms and other CSSF-supervised professionals of the financial sector (PSF)
• Virtual-asset service providers / crypto-asset service providers under the MiCA regime
• Investment fund managers, and a wide range of non-financial professions when handling regulated transactions

The obligation is anchored in CSSF Regulation 12-02, which operationalises the AML Law for the financial sector and sets the detailed customer-due-diligence and reporting expectations the CSSF inspects against.

3. The two named roles — RR and RC

Luxembourg AML rules require every professional to designate two named functions, both notified to the CSSF and known to the CRF:

• Responsable du Respect des obligations (RR) — a member of the management body accountable at board level for the AML/CFT framework
• Responsable du Contrôle du respect des obligations (RC) — the day-to-day compliance officer who operates the framework and is the point of contact for the CRF and the CSSF

The RC is, in practice, the person who ensures the déclaration reaches the CRF. For a Luxembourg branch of an EU institution the roles must be filled locally with genuine authority — a mailbox delegation to the head office does not satisfy the substance expectation.

4. What triggers a declaration

The reportable situations include operations the professional knows, suspects or reasonably suspects to be linked to money laundering or terrorist financing; operations whose lawful economic purpose is not apparent; and any information the CRF requests in the course of its analysis. A declaration is required even where the operation has not been, or cannot be, executed.

5. goAML — the only channel

Reporting to the CRF is entirely electronic through goAML, the reporting platform the CRF operates (built on the UNODC goAML system). There is no paper or email intake. The build:

• Enrolment first. The professional registers as a reporting entity in goAML before it can file; the RC (and delegated users) authenticate through the national electronic-identity means (LuxTrust). Enrolment is a prerequisite, not a same-day step — set it up before you need it.
• Report types. goAML distinguishes suspicious-transaction/activity reports from other communications; the professional selects the correct type and completes the structured subject, account and transaction blocks.
• Two capture routes. Web-form data entry for one-off reports, or structured XML upload generated from the firm’s own case-management system for higher volumes.
• Acknowledgement. goAML issues a receipt/reference on submission, which the firm retains in its AML records.

6. Timing, and the duty to abstain

The AML Law requires the declaration to be made promptly once suspicion crystallises. Critically, Article 5, paragraph 3 sets an abstention duty: before executing an operation it knows or suspects to be linked to ML/TF, the professional must in principle refrain from carrying it out and inform the CRF. Where abstaining beforehand is impossible, or would frustrate the pursuit of the beneficiaries, the operation may proceed and the CRF is informed immediately afterwards. The CRF can then exercise its power to block the transaction or freeze the assets for a statutory period, giving the prosecutor time to act.

7. Tipping-off and confidentiality

Disclosing to the customer — or to any third party — that a declaration has been or will be filed, or that an analysis is under way, is prohibited and criminally sanctioned under the AML Law. The prohibition covers the firm’s communications, any customer-accessible notes, and indirect signalling. Sharing within a group for AML purposes is permitted under the conditions the law sets, but the customer-facing wall is absolute.

8. The CRF and the CSSF — two functions

The CRF receives and analyses declarations. The CSSF supervises whether the professional has the framework to detect, decide and file them. The two are independent but interlinked:

• CSSF inspections examine the SAR track record, sample alert investigations, and assess AML governance against CSSF Regulation 12-02.
• Feedback on filing quality informs the CSSF’s supervisory view.
• AML enforcement — administrative sanctions — sits with the CSSF; the named RR/RC can be held to account.

9. Worked examples

Example A — enrolment gap on go-live. A newly authorised payment institution detects a clear structuring pattern in its first fortnight of operation but has not yet enrolled in goAML. Applicable rule: reporting is electronic-only through goAML, and enrolment is a prerequisite. What the firm does: it should have completed goAML enrolment and LuxTrust user set-up during authorisation, not after; the fix is to treat goAML enrolment as a go-live gate alongside the CSSF authorisation, and in the interim escalate to the RC to file the moment access is live. Outcome: the “we couldn’t file because we weren’t set up” excuse is exactly what a CSSF inspection treats as a governance failure.

Example B — abstain versus execute. A customer instructs an outgoing transfer that trips a strong suspicion. Applicable rule: Article 5(3) abstention duty. What the RC does: where the transfer can be held without alerting the customer, the firm abstains and files, letting the CRF decide whether to block; where holding it is operationally impossible (an instant credit transfer that has already settled), the firm files immediately after and documents why prior abstention was not feasible. Outcome: a defensible record either way, and no tipping-off in the customer message.

Example C — CRF information request. Months after a declaration, the CRF asks the firm for additional account history on the same subject. Applicable rule: the professional must respond to CRF requests, and confidentiality still binds. What the firm does: the RC answers through goAML within the CRF’s timeframe, pulling the full relationship history, and does not contact the customer. Outcome: a complete, timely response that keeps the firm out of a data-quality finding.

10. FAQ

11. What to do, today

• Enrol in goAML and provision LuxTrust access for the RC and backups as a go-live gate — before authorisation completes, not after.
• Designate the RR (board level) and RC (operational) locally with genuine authority; a head-office mailbox delegation will not pass a CSSF inspection.
• Document the SAR workflow end to end: trigger → investigation → RC decision → filing → goAML receipt → record.
• Wire the Article 5(3) abstention decision into the payment-release flow, with a documented reason whenever the firm executes instead of abstaining.
• Build XML generation against your case-management system once volumes grow; manual re-typing at the boundary is the classic source of late or inconsistent filings.

Related: TRACFIN — filing in France · FIU-Nederland — filing in the Netherlands · How to file a SAR in Spain