Courses/AML and KYC in Luxembourg practice

Complete. All seven modules published

AML and KYC in Luxembourg practice

The 2004 Law as amended, CSSF Regulation 12-02, risk based due diligence, beneficial ownership and the RBE, PEPs, transaction monitoring and reporting to the CRF through goAML, international financial sanctions under the Law of 19 December 2020, the reporting and supervision cycle including the 2026 AMLA data collection templates, and the European package that applies from 10 July 2027. Built from the primary sources and current as at August 2026, including the two amending laws of July 2026.

List price 99 euros The price the course is sold at once enrolment has opened.

Founder price 69 euros Held for people who registered before enrolment opened. It is a lower price for the same course, not a smaller version of it.

Delivery Complete Available now and complete. All seven modules are published in full, together with the end-of-course assessment. The delivery commitment was the remaining modules by 31 October 2026; they were delivered on 23 August 2026.

Access 12 months Access for 12 months from the date of enrolment, including every update published during that period. Updates are published under a dated content version, and the version you were trained against stays on your certificate.

Enrolment opens shortly

No payment is taken anywhere on this site and no card details are collected. Registering your interest costs nothing and commits you to nothing.

Content version: 23 August 2026

All seven modules are open to read and watch in full while enrolment is being prepared. Lesson 1.1 needs nothing at all; the rest needs a free account.

Three courses are published today, all three complete. This is a new project and the catalogue is deliberately small. Everything published has been written from primary sources and is dated.

Why this course exists

Training is a legal obligation, and it has to be documented

The obligation

AML/CFT staff training is not optional in Luxembourg. Article 4(2) of the Law of 12 November 2004 requires obliged professionals to run continuing training programmes for their staff, including members of the management bodies. Article 46(2) of CSSF Regulation 12-02 requires that the programme, and its realisation, be documented in writing. Article 49 requires the approved statutory auditor to verify those training measures every year.

Law of 12 November 2004, article 4(2) Continuing training programmes for staff, including members of the management bodies https://www.cssf.lu/en/Document/law-of-12-november-2004/
CSSF Regulation No 12-02, articles 46(2) and 49 The programme and its realisation documented in writing, and verified each year by the approved statutory auditor https://www.cssf.lu/en/Document/cssf-regulation-n12-02-2/

Currency

Content written from the primary sources. Each instrument carries its own verification date in the source register. Content version: 23 August 2026

What you get

Five things, and each one is finished for all seven modules

Nothing here is a placeholder and nothing is still to come. What is described below exists now, for the whole course.

Twenty nine video lessons

All seven modules in short lessons, 87:50 of video in total, each lesson built around a single idea you can act on the same day. Modules 1 to 4 run to five lessons each and Modules 5, 6 and 7 to three, which is the production standard from Module 5 onwards.

Full written transcripts

Every lesson has the narration in full as a readable article, so you can read the module instead of watching it, or follow both at once.

An assessment for each module, and a final one

Eight questions per module, pass mark six. On passing you get a printable certificate carrying your name, the course title, the module and the date. The course closes with a twenty question end-of-course assessment across all seven modules, pass mark 14 of 20, which is 70 percent. It opens once all seven module assessments are passed, and passing it issues a course completion certificate.

Three downloadable references

The Regulation 12-02 navigation card, the Module 1 source list and the scope exercise, each as a one page PDF.

Every legal source linked

Each lesson ends with its sources, each one linking to the official text on Legilux or on cssf.lu. Nothing is cited without a link.

Syllabus

Seven modules

All seven modules are published in full, twenty nine lessons in all. Modules 1 to 4 carry five lessons each; from Module 5 the standard is three or four longer lessons, so Modules 5, 6 and 7 carry three each. Lesson 1.1 is open to everyone with no account. The remaining twenty eight lessons, the reading version, the assessments and the downloads need a free account, so that your progress, your results and your certificates are recorded against your name. The course closes with an end-of-course assessment drawing on all seven modules; it is not a module of its own, and it opens once all seven module assessments have been passed.

Module 1. The Luxembourg AML framework

The four instruments, what each one binds you to, who is caught by article 2, and how to find your way around CSSF Regulation 12-02.

StatusPublished LessonsFive Video13:50

LessonTitleAccess

Lesson 1.1 Why this framework looks the way it is Four instruments, four different legal weights. Knowing which layer holds what is the difference between finding an obligation and hunting in the wrong document. Open to everyone · 2:17

Lesson 1.2 The Law of 12 November 2004, and what it actually requires Articles 2, 3, 4 and 5 of the coordinated text, and the two articles inserted in July 2026 that most internal procedures do not yet cover. Account needed · 2:49

Lesson 1.3 Are you in scope? Article 2 and the boundary problem The list of obliged professionals is easy to read. The three edges where entities get it wrong are not. Account needed · 2:40

Lesson 1.4 CSSF Regulation 12-02, the document you will actually use A structural walk through the regulation you will use most, so you can find things in it under pressure. Account needed · 3:29

Lesson 1.5 Law, regulation, circular: why the difference will cost you A law binds you. A circular does not. What to do when the two diverge and the supervisor has published nothing. Account needed · 2:35

Start with lesson 1.1 Read the whole module Take the Module 1 assessment

Module 2. The RC and the RR, the two people who answer

Why Luxembourg requires two named people rather than one, what has to be notified to the CSSF and when, what may not be combined in one pair of hands, the three documents that leave the entity every year, and what article 8-4 permits against you personally.

StatusPublished LessonsFive Video14:27

LessonTitleAccess

Lesson 2.1 Why there are two people and not one The RR owns compliance from the management body and the RC runs it in the business. The structure exists to close two escapes, and the distinction is the whole lesson. Account needed · 2:44

Lesson 2.2 Appointment, notification and the file the CSSF sees Article 40 makes both appointments notifiable, and every change is notifiable too. What the CSSF assesses, what the declaration of honour requires, and the register to build this week. Account needed · 2:47

Lesson 2.3 Delegation, and what may not be combined Tasks can be delegated and responsibility cannot. Which functions may never meet in one pair of hands, and the written reasoning that has to exist in advance. Account needed · 2:25

Lesson 2.4 The annual cycle: who writes what, and who signs it Three documents leave the entity every year. Who writes each one, who signs it, and the one your auditor writes about you without showing you a draft. Account needed · 2:51

Lesson 2.5 What you are personally exposed to What article 8-4 permits against a named individual, what the CSSF has actually imposed as at August 2026, and why the paper trail is the defence. Account needed · 3:40

Start with lesson 2.1 Read the whole module Take the Module 2 assessment

Module 3. KYC and due diligence in practice

The risk assessment you have to be able to produce, identifying a customer and walking the structure behind it to its end, the beneficial owner and the register with the duty that runs both ways, enhanced due diligence for politically exposed persons, and due diligence on the asset as well as on the investor.

StatusPublished LessonsFive Video13:35

LessonTitleAccess

Lesson 3.1 The risk based approach, and what you must be able to show A risk based approach is a document you can produce, not an attitude you can state. The four questions an inspector asks of it, in the order they are asked. Account needed · 2:58

Lesson 3.2 Identifying the customer, and the chain behind it Article 3 asks you to identify the customer and to understand the structure behind it. Two different tests, three traps, and a file a colleague could read in five minutes. Account needed · 2:38

Lesson 3.3 The beneficial owner, and the register Why the rules changed twice in three years, what the register is and is not, and the duty that runs from you back to it when your findings differ. Account needed · 2:50

Lesson 3.4 Politically exposed persons and enhanced due diligence PEP status is a trigger and not a blacklist. The three components of enhanced due diligence, and the difference between source of funds and source of wealth. Account needed · 2:38

Lesson 3.5 Know Your Assets, and onboarding somebody you never meet Due diligence on the asset as well as on the investor, and what a remote onboarding process has to do to reach the same standard by different means. Account needed · 2:31

Start with lesson 3.1 Read the whole module Take the Module 3 assessment

Module 4. Monitoring, suspicion and reporting to the CRF

Ongoing monitoring as a duty rather than a system, the three thresholds in article 5 and the standard of time that goes with them, goAML as the exclusive channel and what a report has to contain, the prohibition on disclosure alongside the duty to refrain from carrying out the transaction, and the flagging mechanism that now runs the other way.

StatusPublished LessonsFive Video17:28

LessonTitleAccess

Lesson 4.1 Ongoing monitoring, and what it actually obliges Monitoring is a duty, not a purchase. The definition hides two obligations, and the second one is where customer files quietly go out of date. Account needed · 2:48

Lesson 4.2 When suspicion arises Not proof, not certainty, and not the end of an investigation you run yourself. The three thresholds in article 5, attempts included, no minimum amount, and a standard of time that means without delay. Account needed · 3:54

Lesson 4.3 goAML, the only channel One unit, one channel, and two registrations you cannot do in a hurry. What a report has to contain before it is of any use to the CRF. Account needed · 2:54

Lesson 4.4 Disclosure, and the transaction in front of you What you may not say, what you may not signal, and the duty in article 5(3) to stop the transaction on your own suspicion, before anybody instructs you to. Account needed · 4:08

Lesson 4.5 After the report, and the duty that runs the other way Silence after a report is normal and it is not feedback. The published typologies, and the new article 5-1 that runs from the unit to you. Account needed · 3:44

Start with lesson 4.1 Read the whole module Take the Module 4 assessment

Module 5. International financial sanctions

Why a prohibition is not a risk based obligation and which authorities it puts you in front of, the screening framework that Circular CSSF 25/896 made explicit from 30 December 2025, and what a confirmed match obliges you to do on the day it is confirmed.

StatusPublished LessonsThree Video9:52

LessonTitleAccess

Lesson 5.1 Not the same regime, and why that matters Anti money laundering is calibrated to risk. Sanctions are a prohibition, and the consequences of confusing the two start with which authority you are dealing with. Account needed · 3:14

Lesson 5.2 Screening, and the framework that changed in December 2025 Circular CSSF 25/896 put governance around screening from 30 December 2025. Which lists, which people, which moments, and why resolving a hit matters more than reducing hits. Account needed · 3:23

Lesson 5.3 A confirmed match, and what happens next Freeze, do not make funds available, notify the Ministry of Finance, and never release on your own authority. Where the sanctions obligation ends and the article 5 obligation begins. Account needed · 3:15

Start with lesson 5.1 Read the whole module Take the Module 5 assessment

Module 6. Reporting and supervision

The market entry form and the picture the supervisor holds of you, the annual self assessment reconciled with the auditor before either is filed, and what changed in 2026 when the CSSF replaced its usual financial crime questionnaire with the AMLA data collection templates.

StatusPublished LessonsThree Video8:55

LessonTitleAccess

Lesson 6.1 Getting on the register correctly The market entry form is how the supervisor first sees you. Once for the umbrella, not once per sub-fund, and the trigger for a new filing is whether the picture it holds of you is still accurate. Account needed · 2:41

Lesson 6.2 The annual cycle you own The self assessment, the auditor's report and the financial crime questionnaire. Why the self assessment has to be reconciled with the auditor before either is filed, and why the cheapest sanction in this course was imposed on entities that simply did not file. Account needed · 3:13

Lesson 6.3 What changed in 2026 The CSSF replaced its own questionnaire with AMLA data collection templates. What that says about where supervision is heading, and how few entities the AMLA will ever supervise directly. Account needed · 3:01

Start with lesson 6.1 Read the whole module Take the Module 6 assessment

Module 7. The 2027 European package

What changes when a directive becomes a directly applicable regulation on 10 July 2027, the two roles of the AMLA and which of them will ever reach your entity, and a gap analysis sequenced by lead time rather than by importance.

StatusPublished LessonsThree Video9:43

LessonTitleAccess

Lesson 7.1 From a directive to a regulation A regulation applies as it is written, in every member state, with no transposition. The citation problem, the cash ceiling, the threshold designed to move, and the date that is not 2027. Account needed · 3:19

Lesson 7.2 The AMLA, and who it actually supervises Two roles that are constantly conflated: direct supervision of a small number of selected entities, and standard setting that reaches everybody. For almost every entity in Luxembourg the supervisor is still the CSSF. Account needed · 2:28

Lesson 7.3 Your gap analysis Everything in the course turned into a table with four columns. Sequenced by lead time rather than by importance, with a named owner and a review date, because it will not stay finished. Account needed · 3:56

Start with lesson 7.1 Read the whole module Take the Module 7 assessment

Final item. The end-of-course assessment

Not a module, and last in the course. Twenty questions across all seven modules, pass mark 14 of 20, which is 70 percent. Available once the seven module assessments have been passed. Passing issues a course completion certificate that records the content version, the runtime of 87 minutes 50 seconds across twenty nine lessons, and the seven module titles. The seven module assessments stay exactly as they are.

AssessmentWhat it coversAccess

Final End-of-course assessment Eight scenarios taken from the module assessments and twelve questions written for this assessment alone, which cross the modules rather than sitting inside one. Every answer is marked with the reason it is right or wrong, and the result is broken down module by module. Account needed · 20 questions · Pass mark 14

Prerequisite All seven module assessments passed The route is not hidden. Open it early and it tells you which modules remain and links you to each one. Seven of seven

Go to the end-of-course assessment

The worked case on the published CSSF sanction decisions is part of the course materials, delivered as one of the five artefacts rather than as a module. The course closes with an end-of-course assessment across all seven modules, which is not a module of its own.

Module 1 runs 13 minutes 50 seconds, Module 2 runs 14 minutes 27 seconds, Module 3 runs 13 minutes 35 seconds, Module 4 runs 17 minutes 28 seconds, Module 5 runs 9 minutes 52 seconds, Module 6 runs 8 minutes 55 seconds and Module 7 runs 9 minutes 43 seconds, which is 87 minutes 50 seconds of video across twenty nine lessons. Modules 1 to 4 were recorded at five lessons each. From Module 5 the production standard is three or four longer lessons per module, which is why Modules 5, 6 and 7 carry three each. The course closes with an end-of-course assessment drawing on all seven modules, which is not a module of its own.

What is included

Everything you get for the price

Video lessonsEvery lesson is a recorded video built around a single point you can act on the same day, with playback speed control.
Full written transcriptsThe narration of every lesson in full as a readable article, word for word, so you can read the course instead of watching it.
A reading version that printsThe whole of each published module as one continuous article, typeset for reading in one sitting and for printing or saving as a PDF from the browser.
An assessment with a certificate of completionEight questions per module, pass mark six, retakeable without limit. Passing issues a printable certificate carrying your name, the module, the date, the content version, the duration as video runtime, the issuing body and the legal references the module covered.
The artefactsWorking documents, not slides: operational checklist, gap assessment for the 2027 package, working templates, worked case on published sanctions, source register. They sit inside the course area behind your account, print through the browser, and the checklist and the gap assessment save what you type against your organisation.
Every legal source linked to its official textEach lesson ends with its sources, each one resolving to the official text on Legilux, on cssf.lu or on EUR-Lex. Nothing is cited without a link.

What is not included

Stated openly, before you spend anything

No
No legal adviceThis is training material. It does not constitute legal or regulatory advice on your entity, your file or your facts, and no lawyer or adviser is engaged by your enrolment.
No
No accreditation by any bodyThe certificate of completion is issued by this project alone. It is not accredited, recognised or endorsed by the CSSF, by any other supervisory authority, or by any professional association.
No
No guarantee of any career outcomeNothing here guarantees a job, a promotion, an appointment as RC or RR, or approval of any person by any authority.
No
No live tuitionThere are no live sessions, no scheduled classes and no tutor. Everything is recorded and written, and you work through it at your own pace.

Access

Access for 12 months from the date of enrolment, including every update published during that period. Updates are published under a dated content version, and the version you were trained against stays on your certificate.

Artefacts

Five working documents, not five more slide decks

These are the part of the course you take back to your desk. They sit inside the course area behind a free account, they print to PDF through your browser, and each one carries the content version and states that it is a working template rather than legal advice.

The five artefacts

The checklist and the gap assessment save what you type against your organisation, so they can be filled in over several sittings, exported as CSV and printed as a dated, signed off document.

ArtefactWhat it isBehaviour

Artefact 1 Operational checklistEvery appointment, notification, procedure and training obligation as a working checklist, grouped by the module that covers it, each item citing its provision. Save, export, print

Artefact 2 Gap assessment for the 2027 packageA structured worksheet against Regulation (EU) 2024/1624, with current position, required position, owner and target date for each change. Save, export, print

Artefact 3 Working templatesPrintable skeletons for the appointment register, the combined functions justification, the annual training plan and the training realisation record. Print

Artefact 4 Worked case on published sanctionsNine published CSSF decisions read as they are written: what happened, the legal basis, the amount, the publication basis and the factors each decision records. Delivered as part of the course materials, not as a separate module. Print

Artefact 5 Source registerEvery instrument the course relies on in one table, with its date, its official reference, the module that uses it and a flag on the ones known to change. Print

Open the artefacts

Downloads

Three references you can keep

One page each, in the same visual system as the course. They open as PDFs. Downloading them needs a free account.

Reference 01

The Regulation 12-02 navigation card

One page. Where to look in CSSF Regulation 12-02 for the eleven things you look for most.

Download the PDF

Reference 02

Module 1 source list

Every instrument cited in Module 1, with its official link on Legilux or cssf.lu.

Download the PDF

Reference 03

Scope exercise

One page. Complete the sentence that decides which reports you owe and which sanctions apply.

Download the PDF

How the published modules are built

The same four checks were applied to every claim in all seven modules before they were recorded.

Read against the text

Every article number cited was checked against the coordinated text, not against a summary of it.

The 2026 changes named

The laws of 16 and 22 July 2026 are identified by date and by the article each one inserted.

Divergences stated

Where a circular and a law do not say the same thing, that is stated as an open question rather than resolved for you.

Sources linked, not listed

Each source resolves to its official page on Legilux or cssf.lu, so you can check the course against the instrument.

Who this is for

Compliance officers, RCs and RRs, in-house counsel, fund and ManCo staff, and anyone whose file the CSSF may read. It assumes no prior AML training and it does not assume you have read the 2004 Law.

What the course leaves you with

The ability to say which instrument an obligation comes from, which paragraph of article 2 catches your entity, where in Regulation 12-02 to look under time pressure, who in your entity writes, signs and submits each annual document, what a due diligence file has to show from the risk assessment through to the beneficial owner, what you are obliged to do on the day a relationship starts to look wrong, why a sanctions match is a different obligation to a different authority, what keeps the supervisor's picture of you accurate and filed on time, and what actually changes on 10 July 2027.

How to work through it

Watch or read the twenty nine lessons in order, do the scope exercise against the text of article 2, take the eight question assessment at the end of each module, then close with the final course assessment. It takes a handful of evenings.

Your next step

Lesson 1.1 is open to everyone, with no account. Start there, then create a free account to carry on through the remaining lessons, the assessments and the certificates.

The whole course is open now

Twenty nine lessons across seven modules, full transcripts, three references, an assessment with a certificate at the end of each module, and a final course assessment. Nothing is still to come. Enrolment opens shortly.

Start lesson 1.1 Create a free account