Responsable du respect & du contrôle: Luxembourg AML roles
Every Luxembourg payment or e-money institution supervised by the CSSF needs two named AML/CFT officers: a responsable du respect (RR) inside the management, and a responsable du contrôle (RC) who runs the control function. The roles come from Article 4(1) of the Law of 12 November 2004 and are spelled out in Articles 40 to 45 of CSSF Regulation No 12-02, as amended by CSSF Regulation No 20-05. They are not interchangeable, the CSSF must hear about changes before they happen, and one of the two signs off an annual report that goes to the CSSF within five months of year-end. Below: who can hold each role, what each owes, how branches fit in, and what the AMLR changes from 10 July 2027.
1. The texts
Two instruments carry the rules:
- Law of 12 November 2004 on the fight against money laundering and terrorist financing, Article 4(1). Point (a) of the second subparagraph requires the appointment, at the appropriate hierarchical level, of a responsable du contrôle du respect des obligations; the fourth requires the designation, where applicable, of the personne responsable du respect des obligations professionnelles from among the management body or authorised management.
- CSSF Regulation No 12-02 of 14 December 2012, Section 3 on the person responsible for compliance and the compliance officer (Articles 40 to 43), with Article 45 on recruitment. Article 1 defines both terms.
Article 2(1) of the Regulation is what makes this relevant to passported firms: it applies to professionals supervised, authorised or registered by the CSSF, including Luxembourg branches of foreign professionals notified to the CSSF, and foreign professionals notified to provide services in Luxembourg without a branch.
2. Two roles, two jobs
The RR owns the obligation; the RC runs the control over it. The CSSF Regulation defines the RR as the member of the authorised management responsible for AML/CFT, and, where the professional has no authorised management, a member of the Board or the Board as a whole. The RC is the person who implements AML/CFT — in practice the AML compliance officer.
| Responsable du respect (RR) | Responsable du contrôle (RC) | |
|---|---|---|
| Legal hook | Art. 4(1), fourth subparagraph, Law of 2004; Art. 40(1) RCSSF 12-02 | Art. 4(1), second subparagraph, point (a), Law of 2004; Art. 40(1) RCSSF 12-02 |
| Who | Member of authorised management or of the Board | Compliance officer at the appropriate hierarchical level |
| Core job | Accountability at management level; receives the RC’s reports; files the annual summary report with the CSSF | Applies the AML/CFT policy, checks the first line, controls branches and subsidiaries, runs training, deals with the authorities |
| Independence test | Cumulation with other functions must not impede independence and objectivity (Art. 43) | Cumulation must not impede independence, objectivity and decision-making autonomy; workload must fit (Art. 43); must be able to report to management or the Board without going through the direct superior (Art. 4(1) Law) |
| Delegation | Not provided for | To connected employees meeting Art. 40(3), keeping responsibility (Art. 41) |
Article 42 is the RC’s job description: apply the policy, propose any necessary measure to management on his own initiative (including resources), check first-line controls as second line of defence, control branches and majority-owned subsidiaries, run training, and act as the privileged contact for the AML/CFT and restrictive-measures authorities.
3. Who can hold the roles
Article 40(3) sets one person specification for both officers. Each needs:
- professional experience;
- knowledge of the Luxembourg AML/CFT legal and regulatory framework — not generic EU knowledge;
- the hierarchy and powers within the entity, including timely access to customer identification data and other due diligence information;
- the availability needed to do the job effectively and autonomously.
Article 45 adds that recruitment procedures must check professional standing and experience, with the RC and RR named specifically, and that a police record extract or equivalent is obtained when hiring managers.
One limit deserves attention. Article 40(1) allows investment fund managers and investment funds supervised by the CSSF to appoint a third party. The Regulation gives no equivalent option to payment or e-money institutions. For them the RC is an internal appointment, with Article 41 delegation to connected employees as the flexibility valve.
4. Telling the CSSF
Article 40(2) requires the names of the RR and RC to be communicated to the CSSF, together with information prior to any change in those functions. The order matters: the CSSF should learn of a resignation, replacement or reorganisation before it takes effect, not from the next annual report.
The CSSF publishes identification forms for the RR and RC of investment funds and fund managers. We found no equivalent published form for payment or e-money institutions, so they communicate through their normal supervisory channel. Any CSSF assessment of the institution’s managers also covers the RR, but the Article 40(2) notification runs alongside it, not instead of it.
5. The reports the pair produces
Article 42 builds a reporting chain with three layers:
- Regular and ad hoc written reports (Art. 42(5)) from the RC to the RR, authorised management and, where appropriate, the Board or its committees. They follow up findings, rate new shortcomings, propose corrections and judge the framework’s adequacy.
- An annual summary report (Art. 42(6)) prepared by the RC on his activities and the function’s operation, submitted to the RR, authorised management and the Board.
- Filing with the CSSF (Art. 42(7)): the RR submits that summary report to the CSSF every year, covering the past year, within five months of the end of the financial year. For a calendar-year institution that is 31 May.
For the fund sector the CSSF has turned the report into a structured template, the AML/CFT Summary Report RC (SRRC), filed via eDesk or S3; its guide limits it to fund managers and funds. Payment and e-money institutions still owe the Article 42(7) report, but the SRRC template is not theirs.
Internal audit owes its own annual AML/CFT summary report under Article 44(2), and the statutory auditor’s long-form report covers AML/CFT under Article 49. The CSSF’s AML/CFT questionnaire is a different exercise again; see the CSSF AML/CFT data collection, where the RC or RR carries responsibility for completion.
6. The RC and the CRF
Luxembourg has no separate “MLRO” title. Article 42(4) makes the RC the privileged contact for the AML/CFT authorities and the person in charge of transmitting information to them. Article 48(2) requires the professional to organise the RC function so that internal reports can be analysed and a decision taken on reporting to the CRF under Article 5(1)(a) of the Law, and to register in the tool implemented by the FIU — goAML. The analysis and the decision must be kept in writing. In practice the RC is the goAML reporting officer; how to set that up is in how to file a SAR with the CRF in goAML.
7. Branches, groups and outsourcing
A Luxembourg branch of an EEA institution is inside Article 2(1), so it needs an RR and an RC for its Luxembourg business. The branch is not a separate legal person, so head-office staff are employees of the same professional; the question is not whether they may hold the role, but whether they meet Article 40(3) — Luxembourg framework knowledge, powers, access and availability — and can show it.
In the other direction, a Luxembourg institution’s RC must control its foreign branches and majority-owned subsidiaries and review summaries of their audit and compliance reports (Art. 42(2)).
AML/CFT tasks can be outsourced under Article 37, with a contract allocating responsibilities, regular control of the provider and access rights for the CSSF; responsibility stays with the professional. Outsourcing tasks to a group centre does not move the RC role out of the institution.
8. From 10 July 2027: the AMLR pair
Regulation (EU) 2024/1624 applies from 10 July 2027 and, in Article 11, replaces the national design with two EU roles that map closely onto the Luxembourg pair:
| Topic | Today (Law 2004 / RCSSF 12-02) | AMLR Article 11 |
|---|---|---|
| Management role | RR, member of authorised management or Board | Compliance manager, one member of the management body in its management function (11(1)) |
| Control role | RC at the appropriate hierarchical level | Compliance officer, appointed by the management body, sufficiently high standing, contact point for authorities and responsible for FIU reporting (11(2)) |
| Same person | Two distinct appointments | Allowed where nature, risk, complexity and size justify it (11(7)) |
| Group sharing | Delegation to connected employees (Art. 41) | Group entity may use another group entity’s compliance officer if size and low risk justify it (11(2)) |
| Annual report | RC report to management and Board; RR files it with the CSSF within five months | Compliance manager submits the compliance officer’s report to the management body at least yearly (11(6)) |
| Removal | Prior information to the CSSF on any change | Prior notice to the management body; supervisor notified of the removal and whether it relates to the officer’s AML tasks (11(2)) |
Two further AMLR points touch the RC. Where senior managers are subject to fit-and-proper checks under Article 6 of Directive (EU) 2024/1640, the compliance officer is verified too. And Article 18(3)(e) bars outsourcing of suspicious activity reporting to the FIU, except to another obliged entity of the same group established in the same Member State. How Luxembourg will adapt Article 40(2) and the Article 42(7) filing has not yet been published.
9. Worked scenarios
Facts: the Luxembourg branch of an e-money institution authorised elsewhere in the EEA proposes the group’s head-office AML lead as RC. She sits outside Luxembourg and covers four branches.
Applicable rule: Article 2(1) brings the branch inside the Regulation; Article 40(3) requires Luxembourg framework knowledge, powers, access and availability; Article 41 allows delegation to connected employees; Article 43 requires a workload compatible with an effective framework.
What the compliance officer does: documents her Luxembourg AML/CFT training, direct access to branch files, a time allocation and a local Article 41 delegate for daily alerts. The RR is a branch manager. Both names go to the CSSF before the appointment takes effect.
Outcome: the arrangement rests on evidence of Article 40(3), not on group title. Whether the CSSF accepts a non-resident RC is a supervisory judgement we have not seen published, so the branch raises it with the CSSF first.
Facts: a payment institution reshuffles its authorised management. The executive who was RR moves to a group role; a new chief operating officer joins next month.
Applicable rule: Article 40(2) requires information prior to changes in the RR function; Article 40(3) and Article 45 apply to the incoming person; Article 42(7) puts the annual filing on the RR.
What the compliance officer does: asks the Board to name an interim RR before the departure date, informs the CSSF before the switch, and briefs the newcomer on open findings. If the change lands between January and May, the RC confirms who files the Article 42(7) report.
Outcome: there is no day without an RR, and the summary report is filed by someone who has read it.
Facts: a small e-money institution’s RC also acts as its goAML reporting officer and as its sanctions contact.
Applicable rule: Article 42(4) makes the RC the contact for AML/CFT and sanctions authorities; Article 48(2) requires goAML registration; Article 43 limits cumulation.
What the compliance officer does: keeps every no-report decision in writing, sets a deputy with goAML access under Article 41, and records in the annual summary report how much time the roles take.
Outcome: this combination is the Regulation’s design, not a conflict. A commercial role that pressures the RC’s decisions would be.
FAQ
Can the RR and the RC be the same person?
Today Article 40(1) of CSSF Regulation No 12-02 requires two appointments with different profiles: the RR inside authorised management or the Board, the RC running the control function. The AMLR allows one person to hold both from 10 July 2027 where size and risk justify it.
Can a payment institution outsource the RC to an external provider?
The Regulation expressly allows only investment fund managers and investment funds to appoint a third party. Payment and e-money institutions can outsource AML/CFT tasks under Article 37, but the RC remains an internal role.
When is the annual summary report due at the CSSF?
Within five months of the end of the financial year, filed by the RR under Article 42(7). For a calendar year that is 31 May.
Does a Luxembourg branch of an EEA institution need its own RR and RC?
Yes. Article 2(1) applies the Regulation to Luxembourg branches of foreign professionals notified to the CSSF, so the branch needs both roles for its Luxembourg business.
Who registers with goAML?
The institution registers in the FIU’s tool under Article 48(2), and the RC, as the person in charge of transmitting information to the authorities, is the natural reporting officer.
10. What to do, today
- Names on file: confirm the RR and RC the CSSF holds are current, and write the “inform before change” step into the board’s appointment procedure.
- Person specification: keep a short file per officer showing experience, Luxembourg AML/CFT knowledge, powers, access and time allocation under Article 40(3).
- Calendar: put the Article 42(7) filing at five months after year-end, with the RC’s draft ready a month earlier for the Board.
- Delegation: name an Article 41 deputy with goAML access so the CRF channel never depends on one person.
- 2027: map RR to compliance manager and RC to compliance officer now, and decide whether you will merge or keep the two roles under AMLR Article 11(7).
Related: CSSF Regulation 12-02 explained · AMLR compliance manager and officer · AML representatives across the EU · AML officer roles compared across the EU
