Prepare for a major change in how your firm handles sanctions. Starting December 30, 2025, the CSSF’s new Circular 25/896 will require all financial institutions in Luxembourg to follow strict European guidelines for sanctions compliance. This applies to everyone, from banks to crypto-asset providers.
The circular’s goal is to make sure your firm cannot be used to hide or move money for sanctioned individuals or groups. It requires a strong governance structure and a senior person in charge of compliance.
A key requirement is your screening systems. They must be powerful enough to find even similar names or spellings on sanctions lists. This is a move toward a proactive and fully documented compliance culture. The CSSF has made it clear: all potential matches must be investigated immediately. If a match is real, you must freeze the assets and report it to the authorities right away.
This new circular is about protecting the integrity of Luxembourg’s financial center by ensuring everyone follows the same high standards.
Basis/Inspiration for the Circular: The circular is based on the European Banking Authority’s (EBA) guidelines on internal policies, procedures, and controls for the implementation of Union and national restrictive measures (sanctions). Specifically, it incorporates two sets of guidelines: EBA/GL/2024/14 and EBA/GL/2024/15. The purpose is to promote supervisory convergence across the EU.
Scope of Applicability: The circular applies to a wide range of financial institutions in Luxembourg, including:
- Credit institutions
- Investment firms
- Payment service providers (PSPs)
- Electronic money institutions
- Crypto-assets service providers (CASPs)
- Virtual asset service providers (VASPs)
Exemptions: The circular does not explicitly mention any exemptions. However, it notes that the guidelines are designed to be applied in a proportionate manner, taking into account the institution’s size, nature, complexity, and exposure to restrictive measures.
Date of Applicability: The guidelines and the circular itself are applicable as of December 30, 2025. It’s important to note that a new regulation will supersede these guidelines on July 10, 2027.
