Luxembourg occupies a unique position in the European corporate services landscape. As the EU's premier fund domicile and a major holding company jurisdiction, Luxembourg hosts an enormous volume of corporate structures — from investment fund holding vehicles to group treasury companies and IP holding structures. The corporate service providers that support these structures — domiciliation agents, professional addressees, administrative agents — operate under CSSF supervision and face some of the most demanding AML/CFT compliance requirements in the EU.
For CSPs with a Luxembourg footprint, or those managing structures with Luxembourg-incorporated entities in their portfolio, understanding the current regulatory framework is essential. This article covers the domiciliation agent framework, AML/CFT obligations, the impact of the EU's new Anti-Money Laundering Authority (AMLA), and practical compliance considerations for 2025 and beyond.
The Domiciliation Agent Framework
Luxembourg's Law of 31 May 1999 on the domiciliation of companies established the legal framework for professional domiciliation — the provision of registered address services to companies whose effective management is elsewhere. Under this law, domiciliation agents must be approved by the CSSF to provide domiciliation services, and must comply with ongoing requirements relating to client due diligence, record-keeping, and supervisory cooperation.
Approved domiciliation agents are permitted to provide: registered office services (the company's statutory address); professional address services (mailing address and communication relay); and associated corporate administration services (document management, company secretarial support). The CSSF maintains a register of approved domiciliation agents that is publicly accessible.
Key obligations under the domiciliation framework:
- Client verification: Domiciliation agents must verify the identity of all clients before commencing services, applying CDD requirements aligned with the 4th and 5th EU AML Directives as transposed into Luxembourg law.
- Beneficial ownership identification: For corporate clients, the domiciliation agent must identify and verify all beneficial owners with a 25% ownership threshold (or effective control where no individual meets the threshold). Luxembourg's beneficial ownership register (Registre des bénéficiaires effectifs, or RBE) must be searched, and the agent must verify that RBE information matches what the client has declared.
- Ongoing monitoring: The relationship between domiciliation agent and client must be subject to ongoing monitoring — including periodic CDD review and review of any information received about the client's activities or beneficial ownership changes.
- SAR filing: Domiciliation agents are obligated reporters under Luxembourg's AML legislation and must file suspicious activity reports with the Financial Intelligence Unit (CRF — Cellule de Renseignement Financier) when they form a suspicion of money laundering or terrorist financing.
2025 CSSF Supervisory Priorities
The CSSF's 2025 supervisory roadmap for domiciliation agents and professional addressees highlights three priority areas that CSPs should be particularly attentive to:
Real economic activity verification: The CSSF has increased scrutiny of whether domiciliated companies have genuine economic activity in Luxembourg — not just a registered address. The CSSF examination programme now includes questions about the company's actual operations, management, and where key decisions are taken. For domiciliation agents, this means documenting what they know about their clients' actual operations and flagging potential substance concerns to the client and their advisers.
Beneficial ownership registry verification: The CSSF has noted that discrepancies between the information held by domiciliation agents and the RBE are more common than they should be. Agents are expected to cross-reference their own KYC records against the RBE at each review cycle and to follow up discrepancies — not to accept the RBE as definitive, but to understand and resolve differences.
"The CSSF expects domiciliation agents to know their clients — not in a superficial sense, but substantively. Who controls the company? What does it actually do? Where is its management? If you cannot answer these questions, the CSSF will question whether your CDD is adequate."
— Luxembourg compliance specialist, 2025
Technology and cyber risk: Following DORA (the EU's Digital Operational Resilience Act, which entered application in January 2025), the CSSF has incorporated digital operational resilience into its examination framework for all supervised entities including CSPs. Domiciliation agents must document their technology risk management framework, business continuity arrangements, and incident reporting procedures.
AMLA: The Coming EU Anti-Money Laundering Authority
The EU's new Anti-Money Laundering Authority will begin direct supervision of certain large obliged entities across the EU from 2028, with preparatory work ongoing. For Luxembourg CSPs, AMLA has two sets of implications.
First, AMLA will set harmonised AML/CFT rules across the EU through binding technical standards and guidelines. This will reduce (but not eliminate) the current variation between member state implementations of the AML Directives. Luxembourg's implementation of the EU AML package — which was already broadly ahead of some member states — is expected to serve as a template for much of AMLA's harmonised approach.
Second, AMLA's direct supervision will initially focus on credit institutions, payment institutions, and e-money institutions — not domiciliation agents or CSPs. However, indirect effects are significant: AMLA's supervision of banks and payment institutions will likely lead to enhanced compliance requirements being passed down to CSPs through correspondent banking relationships and the know-your-correspondent obligations of supervised financial institutions.
Practical Compliance for CSPs With Luxembourg Exposure
Offshore CSPs that administer Luxembourg entities through a local correspondent arrangement, or that provide management to Luxembourg-registered structures from an offshore office, face a specific compliance challenge: Luxembourg's AML framework and CSSF expectations apply to the Luxembourg-based activities, while home-jurisdiction obligations apply to the CSP's registered activities. Navigating this dual obligation structure requires clear role definition between the offshore CSP and the Luxembourg correspondent.
A practical approach to managing Luxembourg exposure from an offshore CSP perspective:
- Clearly document which entity (the offshore CSP or the Luxembourg correspondent) is responsible for each specific compliance obligation — CDD, RBE filing, CSSF reporting, SAR filing
- Conduct annual due diligence on the Luxembourg correspondent's CSSF licence status and AML programme currency
- Ensure that KYC information gathered by either party is shared and integrated — Luxembourg CDD should supplement, not replace, the offshore CSP's own CDD files
- Track Luxembourg filing deadlines in your compliance calendar — missed Luxembourg filings create regulatory exposure that reflects on the offshore CSP's overall compliance management