Luxembourg Funds & AML: October 2026 Monthly Brief

October regulatory developments point to a common theme: CSSF reaffirms that Luxembourg fund managers must be able to demonstrate that their controls work in practice.

From white-label arrangements and delegated portfolio management to fund errors and future AML requirements, recent CSSF and AMLA publications highlight the importance of effective oversight, clear responsibilities and documented decisions.

The main developments this month concern white-label fund business, oversight of portfolio managers, fund errors and investor compensation, AMLA's new draft standards and Luxembourg's updated terrorist-financing risk assessment.

1. White-label funds: new CSSF process

On 8 October 2026, the CSSF published a new form for Luxembourg investment fund managers intending to start white-label business.

White-label business generally refers to arrangements where an external sponsor creates or promotes a fund while a regulated management company or AIFM provides the fund-management platform.

The sponsor may design the investment strategy, introduce investors, act as investment adviser or manage the portfolio under delegation.

However, the regulated fund manager remains responsible for its legal obligations.

What changed?

The Law of 3 March 2026 introduced additional requirements for investment fund managers managing funds at the initiative of third parties. These requirements apply to the relevant arrangements, including those involving existing white-label business.

The CSSF's new form provides a dedicated process for submitting information and evidence. An IFM intending to undertake white-label business for the first time must complete and submit this form.

The new form is specifically required for firms starting this activity. However, the underlying legal requirements are not limited to newly established arrangements. The CSSF may also request additional information.

Why does it matter?

The main question is whether the AIFM has a real control over the fund.

For example, an external sponsor may recommend investments or appoint representatives to a fund's committees. However, the AIFM must still be able to make independent decisions, challenge recommendations and manage conflicts of interest.

AIFMs should be particularly careful where the sponsor has a strong influence over:

• investment decisions;

• the selection of service providers;

• valuation;

• governance committees;

• fee arrangements;

• delegated activities.

The existence of an investment committee or a formal delegation agreement does not, by itself, demonstrate that conflicts are properly managed.

What should AIFMs check?

AIFMs should review their new-business approval process and existing white-label arrangements.

The review should establish:

• who makes the final decisions;

• whether the AIFM can challenge the sponsor;

• how conflicts of interest are identified and managed;

• whether responsibilities are clearly documented;

• whether the AIFM has sufficient expertise and resources;

• whether the AIFM can take action when a delegate does not perform properly.

The point that the AIFM demonstrates that it is genuinely managing the fund, rather than simply providing its regulatory licence.

Source: CSSF communication, 8 October 2026

2. Delegate oversight: evidence matters more than questionnaires

On 5 October 2026, the CSSF published a decision imposing a EUR 71,500 fine on a Luxembourg fund manager for weaknesses in the oversight of delegated portfolio managers.

The decision concerned failures to perform certain reviews on time, insufficient checks of best-execution arrangements and excessive reliance on information provided by delegates.

This was an enforcement action under existing requirements, not the introduction of a new rule.

What did the CSSF find?

The fund manager had not completed all delegate reviews according to its own risk-based review schedule.

It had also failed to perform sufficient independent checks of how delegated portfolio managers complied with their best-execution obligations.

Best execution means taking the necessary steps to obtain the best possible result when buying or selling investments, considering the relevant factors.

The CSSF considered that relying mainly on confirmations from delegates was not enough to demonstrate effective oversight.

What does effective oversight look like?

Consider a simple example.

A delegated portfolio manager completes its annual questionnaire and confirms that it complies with its best-execution policy.

The AIFM could accept the answer and close the review.

However, a stronger approach would be to request supporting evidence and check whether the policy works in practice.

Depending on the investment strategy, the AIFM could:

• review the delegate's best-execution monitoring reports;

• examine how brokers are selected;

• check whether transaction costs are monitored;

• review exceptions and unusual transactions;

• request evidence of corrective actions;

• independently test a sample of transactions where appropriate.

The objective is not to duplicate every control performed by the portfolio manager.

It is to obtain sufficient evidence that the delegated activity is properly managed.

What should AIFMs check?

AIFMs should compare their delegate oversight procedures with the way reviews are actually performed.

In particular:

• Are all reviews completed within the required deadlines?

• Does the review frequency reflect the delegate's risk rating?

• Are supporting documents collected and assessed?

• Are unclear answers challenged?

• Are findings followed up?

• Are overdue reviews escalated to the Conducting Officers?

AIFMs should also consider whether their oversight resources remain appropriate as the number of delegated portfolio managers increases.

The lesson is straightforward: oversight should be supported by evidence, not only by confirmations received from delegates.

Source: CSSF sanction decision

3. Fund errors: lessons from the CSSF's first year of feedback

On 5 October 2026, the CSSF published a feedback report on the first year of application of Circular CSSF 24/856.

The Circular has applied since 1 January 2025 and covers NAV calculation errors, investment-limit breaches and other errors affecting investment funds.

During 2025, the CSSF received 2,218 notifications, including:

• 1,393 investment-limit breaches;

• 239 NAV calculation errors;

• 586 other errors.

Of the other errors, 416 concerned incorrect payments of fund costs or fees.

These figures show that fund errors remain an important operational and investor-protection issue.

What did the CSSF observe?

The CSSF identified several recurring weaknesses.

These included:

• incorrect classification of errors;

• incomplete or inconsistent notifications;

• insufficient controls over fund costs;

• delays in correcting errors;

• weaknesses in fund-administrator oversight;

• repeated errors where corrective measures were ineffective.

The report also provides clarification on the treatment of different fund structures and the methods used to calculate and correct errors.

Why does it matter?

An error is not resolved simply because it has been identified and reported.

The AIFM should also be able to demonstrate that:

• the error was correctly classified;

• the impact was properly calculated;

• affected investors or funds were compensated where required;

• the root cause was understood;

• appropriate corrective actions were implemented.

For example, if a fund administrator repeatedly charges an incorrect fee, correcting each payment is not enough.

The AIFM should also understand why the error keeps happening and whether the administrator's controls need to change.

What about investor compensation?

The CSSF emphasised the importance of correcting errors promptly and applying the appropriate compensation rules.

For costs or fees charged contrary to fund documents, firms should not assume that a small amount can automatically be ignored.

The applicable notification and correction requirements must be assessed under Circular 24/856.

The report also highlights the importance of selecting the correct method for calculating compensation and applying it consistently.

What should AIFMs check?

AIFMs should review their procedures for identifying, reporting and correcting fund errors.

A practical review should cover:

• error classification;

• notification responsibilities;

• review and approval before CSSF submission;

• compensation calculations;

• oversight of the central administrator;

• monitoring of unresolved cases;

• escalation of repeated errors.

Conducting Officers should receive sufficient information to understand not only the number of open errors, but also their financial impact, age and root causes.

For funds investing in illiquid assets, NAV-error tolerance levels should be supported by a fund-specific assessment.

A general statement that a fund invests in private or illiquid assets is not sufficient by itself.

The key question is not only whether the error was corrected, but whether the controls have improved enough to prevent it from happening again.

Source: CSSF communication and feedback report, 5 October 2026

4. AMLA: prepare for the new standards, but distinguish drafts from binding rules

On 1 October 2026, AMLA finalised three draft regulatory technical standards.

The CSSF drew the Luxembourg financial sector's attention to these standards on 7 October 2026.

The standards provide more detail on:

• business relationships and occasional transactions;

• customer due diligence;

• group-wide AML arrangements.

They have been submitted to the European Commission for formal adoption.

The standards are not yet binding.

The European Commission may still amend them before adoption and publication.

What could change?

The draft standards provide further detail on the information firms should collect and verify when identifying customers and beneficial owners.

They also address:

• remote onboarding;

• electronic identification;

• politically exposed persons;

• simplified and enhanced due diligence;

• linked transactions;

• ongoing customer monitoring;

• group-wide AML controls;

• information sharing within financial groups.

The approach remains risk-based.

For example, a company with several ownership layers should not automatically be treated as high risk simply because its structure is complex.

The firm should assess the actual risks and determine whether the structure can be properly understood and verified.

What does the CSSF expect now?

The CSSF has recommended that professionals finalise their gap analysis and begin internal preparations.

This includes reviewing policies, procedures and controls, as well as preparing potential changes involving Compliance and IT.

AMLA has proposed a six-month transitional period following the entry into force of each final standard.

However, the final texts and their application dates still need to be confirmed.

What should AIFMs do?

AIFMs should review the potential impact on:

• investor onboarding;

• beneficial-owner identification;

• investor risk assessments;

• enhanced due diligence;

• transfer-agent oversight;

• sanctions and PEP screening;

• ongoing monitoring;

• group-wide AML arrangements.

The review should distinguish between three stages.

First, analysis: identify gaps between current arrangements and the draft requirements.

Second, preparation: identify the changes that may be needed to procedures, systems, training and responsibilities.

Third, implementation: introduce the necessary changes based on the final adopted requirements and confirmed application dates.

This distinction is important because firms should prepare early without treating every provision in a draft as an obligation already in force.

The practical message is to complete the analysis now, prepare the necessary changes and implement them according to the final legal requirements.

Source: CSSF communication, 7 October 2026

Source: AMLA announcement, 1 October 2026

5. Terrorist financing: Luxembourg updates its national risk assessment

In October, Luxembourg published an updated national risk assessment of terrorist financing.

The assessment was adopted in June 2026 and brought to the attention of the financial sector in October.

It provides a more detailed picture of terrorist-financing risks across Luxembourg's economy.

This is a risk assessment, not a new law.

However, it is an important reference for firms reviewing their AML and counter-terrorist-financing controls.

What are the main findings?

The assessment highlights that terrorist financing may involve:

• relatively small amounts;

• funds from legitimate sources;

• individuals or small groups;

• payment services and electronic money;

• virtual assets;

• international payment arrangements.

These characteristics are important because terrorist-financing activity may not resemble traditional money-laundering patterns.

Large or unusual transactions are not the only possible warning signs.

What does this mean for investment funds?

The investment fund sector is generally considered less exposed to certain terrorist-financing risks than some other financial activities.

However, this does not mean that every investment fund or investor relationship is low risk.

The actual exposure depends on the fund's structure, investors, activities and payment arrangements.

For example, an AIFM managing a fund with institutional investors may have a different risk profile from a manager dealing with complex ownership structures, unusual payment arrangements or exposure to higher-risk activities.

What should AIFMs and MLROs consider?

The updated assessment provides an opportunity to review the business-wide risk assessment.

In particular:

• Is terrorist-financing risk assessed separately from money-laundering risk?

• Are the relevant investor and beneficial-owner risks covered?

• Are payment arrangements properly understood?

• Are virtual-asset exposures considered where relevant?

• Does the transfer agent have appropriate monitoring controls?

• Are unusual activities escalated to the appropriate AML function?

The review should remain proportionate to the firm's actual exposure.

For an RC or MLRO, the assessment may also provide useful input for the annual AML report and discussions with the management body.

The main lesson is that terrorist-financing risk should not be assessed only by reference to transaction size or whether the source of funds appears legitimate.

Source: Luxembourg National Risk Assessment of Terrorist Financing 2026

Looking ahead: Cyber security and fund costs

Two additional developments deserve attention.

Cyber security under DORA

On 21 October 2026, the CSSF published an alert concerning critical vulnerabilities affecting certain PHP systems.

PHP is widely used to operate websites and online applications.

The vulnerabilities may allow unauthorised access to affected systems if they are not properly secured.

AIFMs should ask their IT teams and relevant service providers whether affected systems are used and whether the necessary security updates have been applied.

A useful response should confirm:

• whether the firm is exposed;

• which systems were checked;

• whether updates were installed;

• whether signs of compromise were identified;

• whether any incident needs to be assessed under DORA.

Where unauthorised access is suspected or confirmed, the firm should assess the incident against the applicable DORA classification and reporting requirements.

Source: CSSF security alert

Fund costs and investor protection

On 21 October 2026, the CSSF published an enforcement decision concerning excessive costs charged to a UCITS fund.

The fund had relatively low assets and high ongoing charges over several years.

The case is a reminder that disclosing fees in the prospectus does not automatically mean that the total costs are reasonable.

Although the decision concerned a UCITS, it also provides a useful lesson for AIFMs managing funds with low assets and relatively high operating costs.

Managers should consider whether total costs remain reasonable in relation to the fund's size, characteristics and investor interests.

Where costs remain high for a long period, the AIFM should be able to demonstrate that the situation has been reviewed and that appropriate action has been considered.

Source: CSSF sanction decision

This briefing is provided for general information only and does not constitute legal or regulatory advice.

Diego Ofano
Investment Funds · Compliance & AML