KYC remediation in Luxembourg: getting ready for AMLR 2027

Learn more about AI implementation in Luxembourg, and see how the same controls apply to AI in Luxembourg family offices.

Most Luxembourg professionals I talk to have KYC files for every client. Far fewer have files that would pass a reviewer who asks three questions: who exactly are the beneficial owners today, when was this file last checked against the sanctions lists, and where is the evidence? Files opened years ago were built for the rules of the time, and many have only been touched when something went wrong.

I run document and compliance automation projects at 20 More. This guide sets out what the AMLR changes, who supervises whom in Luxembourg, and the remediation method I recommend: one data model per client file, a gap list, and automation for the repetitive parts. It is practical guidance, not legal advice; your supervisor's guidance and your own AML policy come first.

When does the AMLR apply, and what is it?

Regulation (EU) 2024/1624 was adopted on 31 May 2024, entered into force on 9 July 2024 and applies from 10 July 2027; for football clubs and agents it applies from 10 July 2029 (Article 90, EUR-Lex). It is a regulation, not a directive, so its due diligence rules apply as written in every Member State, and Directive (EU) 2015/849 is repealed from the same date (EUR-Lex summary).

It comes with a new EU authority. AMLA, the Authority for Anti-Money Laundering and Countering the Financing of Terrorism, is based in Frankfurt and started its activities in mid-2025 (AMLA). From 2028 it will directly supervise a limited number of large cross-border financial groups (AMLA explainer). A Luxembourg fiduciary or accounting firm will not be one of them: your supervisor stays national, but the rulebook it applies becomes European. The CSSF has published its own overview of the package (CSSF).

What changes for a KYC file on 10 July 2027?

Only items I could confirm in the official texts are in this table.

Two details matter for remediation planning. First, AMLA's draft technical standard on customer due diligence says files of existing clients should be brought into line on a risk-sensitive basis, within one year for higher-risk clients and five years for the others, counted from when that standard applies (AMLA final report, draft RTS Article 28(1)). It is still a draft until the Commission adopts it, so do not plan around the exact clock, but do plan around the principle: high-risk files first. Second, the same draft recitals say that consulting a beneficial ownership register is necessary but not sufficient to verify beneficial owners. A copy of the RBE extract alone will not close a file.

Who in Luxembourg is affected, and who supervises them?

The 2004 law splits supervision between supervisory authorities and self-regulatory bodies (Article 2-1, Legilux). The AMLR keeps that national structure.

Company and trust service providers must also be registered with the supervisor or self-regulatory body they fall under (AED). Since 1 October 2024 the AED has had a dedicated AML inspection unit for on-site controls (AED).

Can you still rely on the RBE?

You can use it, but not lean on it. After the Court of Justice of the EU ruled on 22 November 2022 in joined cases C-37/20 and C-601/20 that general public access to beneficial ownership registers breached the Charter of Fundamental Rights (CJEU press release), Luxembourg suspended public access to the Registre des bénéficiaires effectifs. Access was restored from 16 December 2022 for professionals subject to the 2004 law who apply to Luxembourg Business Registers, and for journalists through the Press Council (Government of Luxembourg).

In practice: request professional access if you have not, store each RBE consultation with its date, and compare it with what the client and the RCS extract tell you. Where they disagree, that disagreement is itself a finding for the file.

What does a KYC remediation project look like?

The projects that work treat remediation as a data problem first and a paperwork problem second. These are the steps I recommend.

1. Scope by risk. Export the client list with its current risk rating and last review date. Files rated high, files never reviewed, and clients with complex ownership chains go into the first wave.
2. Define one data model per file. Every file should answer the same fields (table below). If a field cannot be filled, that is a gap, not a judgement call.
3. Run a gap analysis. Compare each file with the model and with the AMLR list. The output is a per-file list: missing document, expired ID, ownership chain not traced to natural persons, no source-of-wealth evidence, screening older than your policy allows.
4. Reach out to clients in batches. One clear request per client, listing exactly what is missing, in the client's language, with a deadline and reminders. Clients who are asked for everything at once tend to answer nothing.
5. Re-screen everyone. Run clients, beneficial owners and authorised signatories against the EU consolidated financial sanctions list (data.europa.eu) and your PEP source, and record the result and the list version. The AED publishes guidance on international financial sanctions for the professionals it supervises (AED).
6. Keep an evidence trail. For each file: what was checked, against which source, on which date, by whom, and what was decided. A reviewer reads the trail before the file.

The client file data model:

What can be automated, and what stays human?

The split I use is simple: software reads, compares and chases; people judge.

This is what our KYC file remediation Agent Run does on a defined batch of files: fixed scope, EU-hosted models, a human sign-off on every change and a log of what was checked. For an ongoing setup inside your own tools, the document processing service is the better fit. If you also run AI tools in a CSSF-supervised context, our guide to AI use cases under CSSF supervision covers the governance side.

What about GDPR?

KYC files are personal data, often sensitive: identity documents, family structures, wealth, and sometimes information on criminal proceedings. The AML laws give you the legal basis to process it, but GDPR still applies, including data minimisation (Article 5(1)(c) GDPR, EUR-Lex).

Three rules I build into every remediation:

• Collect what the AML rules require, not everything the client sends. Extra documents in a file are extra risk.
• Retention is five years after the relationship ends, under both the 2004 law (Article 3(6), Legilux) and the AMLR, which then requires personal data to be deleted unless another law requires longer retention (Article 77 AMLR, EUR-Lex). Put the end-of-relationship date in the data model so deletion can be scheduled.
• Know where the processing runs. If a tool reads client IDs, you need to know where it is hosted, who can access it and whether data is used to train anything. That belongs in your processing records and, for a large remediation, a short DPIA.

Frequently asked questions

What is KYC remediation?

KYC remediation is the review and update of existing client files so that they meet current customer due diligence rules. It covers identity, beneficial ownership, purpose of the relationship, source of funds or wealth where needed, risk rating and sanctions screening, with evidence of each check. In Luxembourg it is being driven now by the EU AML Regulation that applies from 10 July 2027 (Article 90, EUR-Lex).

When does the AMLR apply in Luxembourg?

Regulation (EU) 2024/1624 applies from 10 July 2027 in every Member State, including Luxembourg, without national transposition (Article 90, EUR-Lex). The only exception is football clubs and agents, from 10 July 2029. Luxembourg supervisors such as the CSSF, the AED and the OEC will continue to supervise their professionals under the new rules.

Do accountants in Luxembourg have to do KYC?

Yes. Experts-comptables are obliged entities under the Law of 12 November 2004 and are supervised for AML by the Ordre des experts-comptables; other accounting professionals and tax advisers are supervised by the AED (AED guide). They must identify and verify clients and beneficial owners, assess risk and keep files up to date.

How often must KYC files be reviewed under the AMLR?

The AMLR sets maximum intervals: at least once a year for clients under enhanced due diligence and at least every five years for all others (Article 26 AMLR). A file must also be reviewed when the client's relevant circumstances change, for example a new beneficial owner. Your risk assessment can and often should set shorter intervals.

Can KYC checks be automated?

Much of the work can: reading documents, extracting data, building ownership chains from registry extracts, sanctions and PEP screening, gap reports and client reminders. The risk rating, the decision to accept or keep a client and any suspicious transaction report remain human decisions. A good setup logs every automated step so a supervisor can follow it.

If you want to know how long remediation of your files would take, send us a short description of your client base and current KYC setup.