Keltes

Delegate due diligence and Circular CSSF 18/698

7 October 2026, Keltes

A fund that hands anti-money laundering work to a delegate keeps the responsibility for it. The AMLR and the Luxembourg texts Keltes holds say how. The CSSF circular usually named on the subject has not yet been verified.

Two sources this article names are not yet verified: Circular CSSF 18/698 and Circular CSSF 22/806, which Keltes holds as the founder's own copies in English, not retrieved from the publisher by Keltes, so nothing about their content is stated here. Every other footnote quotes a text Keltes holds, and each quote is checked word for word against it. Whether texts later than CSSF Regulation 20-05 changed the provisions quoted has not been verified.

Why delegates matter

Many Luxembourg funds rely on service providers for parts of their anti-money laundering work: a transfer agent and a registrar that onboard and record investors, a portfolio manager that handles the assets, distributors that bring in investors, and the initiator that launches the fund. Keltes' planned delegate due diligence is designed to cover these five kinds of provider. That list is Keltes' own scope, chosen for the work funds hand out, not a list taken from the law. The legal question is always the same: who remains responsible, and what must the fund check?

Outsourcing under the AMLR

From 10 July 2027, for most obliged entities,1 Article 18 of the AMLR allows an obliged entity to outsource tasks under the Regulation to service providers, and requires it to notify the supervisor before the provider starts.2 The entity remains fully liable for any act or omission connected to the outsourced tasks.3

Before outsourcing, the entity must be sure the provider is sufficiently qualified. The conditions must be set out in a written agreement, and the entity must perform regular controls on how the provider applies the entity's policies and procedures, at a frequency set by how critical the outsourced tasks are.4

Some tasks may never be outsourced. Article 18(3) lists six, among them the approval of the business-wide risk assessment, the decision on a customer's risk profile and the decision to enter into a business relationship.5 A collective investment undertaking without legal personality, or with only a board of directors that has delegated the processing of subscriptions and the collection of funds, may outsource three of those six, but only after notifying the supervisor and obtaining its approval.6

Reliance is a different thing

The AMLR treats reliance separately from outsourcing. An obliged entity may rely on another obliged entity for certain customer due diligence measures, but the ultimate responsibility stays with the entity that relies.7 The entity relied upon must provide the information without delay and in any case within five working days.8 Whether a given provider is relied upon or acts as an outsourced service provider changes which rules apply, so the contract and the facts must be read together.

What the Luxembourg texts already say

The Luxembourg law already draws the same line. A professional may rely on third parties for certain due diligence measures, but final responsibility remains with the professional.9 That article does not apply to outsourcing or agency where the contract makes the provider part of the professional.10

For professionals under CSSF supervision, CSSF Regulation 12-02, as amended by CSSF Regulation 20-05 of 14 August 2020, is more specific on outsourcing. Policies and procedures must contain detailed provisions on selecting and assessing delegates, including sub-contractors in a chain, and the professional must regularly check that the delegate keeps its contractual commitments, for example by sampling or on-site visits.11 A risk assessment of the outsourced functions must be done before the contract is signed, and every investment fund manager must apply due diligence, on a risk-based approach, in particular to registrar and transfer agents, to portfolio managers to which it outsources management, and to investment advisers.12 The same provision says the CSSF may specify these conditions by circular.13

For funds supervised by the AED, the RC's yearly report must include the results of controls on third parties to which tasks were delegated, against both the law and the contract, and the reasons for choosing any new third parties during the year.14

Circular CSSF 18/698

Keltes understands that Circular CSSF 18/698, addressed to investment fund managers, is a CSSF text on how they organise themselves, including their anti-money laundering work on delegates, and that Circular CSSF 22/806 is on outsourcing arrangements. The CSSF website refused every request by Keltes on 6 October 2026. Keltes now holds the founder's own copy of each in English, not retrieved from the publisher by Keltes.1516 Keltes has not yet verified its reading of either circular, nothing in this article rests on them, and nothing here should be taken as a statement of what they require.

What this means in practice

Under the texts Keltes holds, a fund or fund manager can hand out the work but not the responsibility.39 It needs to know which provider does what, under which contract, whether that is outsourcing or reliance, and how and how often it checks the provider's work. For funds supervised by the AED, those findings belong in the RC's report.14 What Circular CSSF 18/698 adds must be read in the circular itself.

About this article

This article is general information about the texts it quotes, as they stood when it was written. It is not legal advice and does not replace advice on your own entity's situation. Still awaiting verification: Circulars CSSF 18/698 and 22/806 and everything in them, and whether any text later than CSSF Regulation 20-05 changed the provisions quoted. The Luxembourg law is quoted in French from the Legilux consolidated text, which is documentary only, and the CSSF regulations in French as published in the Journal officiel; the English descriptions are ours, not official translations.

Sources

  1. AMLR Art. 90, second paragraph It shall apply from 10 July 2027, except in relation to obliged entities referred to in Article 3, points (3)(n) and (o), to which it shall apply from 10 July 2029. ↑
  2. AMLR Art. 18(1) Obliged entities may outsource tasks resulting from this Regulation to service providers. The obliged entity shall notify the supervisor of the outsourcing before the service provider starts to carry out the outsourced task. ↑
  3. AMLR Art. 18(2), second subparagraph The obliged entity shall remain fully liable for any action, whether an act of commission or omission, connected to the outsourced tasks that are carried out by service providers. ↑
  4. AMLR Art. 18(4) Before an obliged entity outsources a task pursuant to paragraph 1, it shall assure itself that the service provider is sufficiently qualified to carry out the tasks to be outsourced. Where an obliged entity outsources a task pursuant to paragraph 1, it shall ensure that the service provider, as well as any subsequent sub-outsourcing service provider, applies the policies and procedures adopted by the obliged entity. The conditions for the performance of such tasks shall be laid down in a written agreement between the obliged entity and the service provider. The obliged entity shall perform regular controls to ascertain the effective implementation of such policies and procedures by the service provider. The frequency of such controls shall be determined on the basis of the critical nature of the tasks outsourced. ↑
  5. AMLR Art. 18(3) The following tasks shall not be outsourced under any circumstances: (a) the proposal and approval of the obliged entity’s business-wide risk assessment pursuant to Article 10(2); (b) the approval of the obliged entity’s internal policies, procedures and controls pursuant to Article 9; (c) decision on the risk profile to be attributed to the customer; (d) the decision to enter into a business relationship or carry out an occasional transaction with a client; Points (e), on reporting to the FIU, and (f), on approving the criteria for detecting suspicious or unusual transactions, complete the list of six. ↑
  6. AMLR Art. 18(7) By way of derogation from paragraph 3, where a collective investment undertaking has no legal personality, or has only a board of directors and has delegated the processing of subscriptions and the collection of funds as defined in Article 4, point (25), of Directive (EU) 2015/2366 from investors to another entity, it may outsource the task referred to in paragraph 3, points (c), (d) and (e) to one of its service providers. The outsourcing referred to in the first subparagraph of this paragraph may only take place after the collective investment undertaking has notified its intention to outsource the task to the supervisor pursuant to paragraph 1, and the supervisor has approved such outsourcing ↑
  7. AMLR Art. 48(1) The ultimate responsibility for meeting the customer due diligence requirements shall remain with the obliged entity which relies on another obliged entity. The measures concerned are those of Article 20(1), points (a), (b) and (c), under the conditions of Article 48(1). ↑
  8. AMLR Art. 49(3) The information referred to in paragraphs 1 and 2 shall be provided by the obliged entity relied upon without delay and in any case within 5 working days. ↑
  9. Luxembourg, amended Law of 12 November 2004, Art. 3-3(2), first paragraph Toutefois, la responsabilité finale dans l'exécution de ces obligations continue d'incomber aux professionnels qui recourent à des tiers. Quoted from the Legilux consolidated text applicable from 8 August 2026, which is documentary only: only the texts published in the Journal officiel have legal force (product/sources/lu/README.md). ↑
  10. Luxembourg, amended Law of 12 November 2004, Art. 3-3(5) Le présent article ne s'applique pas aux relations d'externalisation ou d'agence dans le cadre desquelles le fournisseur du service externalisé ou l'agent doit être considéré, en vertu d’un contrat, comme une partie du professionnel soumis à la présente loi. Quoted from the Legilux consolidated text applicable from 8 August 2026, which is documentary only (product/sources/lu/README.md). ↑
  11. CSSF Regulation 20-05, Art. 52, point 3, replacing paragraph 2 of the outsourcing article of CSSF Regulation 12-02 Les politiques relatives à l’externalisation et à la relation d’agence ainsi que les procédures internes du professionnel souhaitant recourir à des tiers délégués doivent notamment contenir des dispositions détaillées sur le processus de sélection et d’évaluation des tiers délégués, y compris des sous-traitants à différents niveaux, en cas d’externalisation en cascade. Art. 52 of Regulation 20-05 does not name the article it amends; its wording and Art. 51 (the sub-section Externalisation) point to Art. 37 of Regulation 12-02. The same replaced paragraph continues: Les professionnels doivent effectuer un contrôle régulier du respect par le tiers délégué de ses engagements découlant du contrat, and gives sampling and on-site visits as examples. Later amendments not verified. ↑
  12. CSSF Regulation 20-05, Art. 52, point 4, inserting paragraph (2 bis) in the outsourcing article of CSSF Regulation 12-02 Une évaluation des risques par rapport aux fonctions externalisées et, le cas échéant, de la chaîne d’externalisation doit avoir été réalisée avant la conclusion du contrat d’externalisation. Plus particulièrement, tout GFI doit mettre en œuvre des mesures de vigilance à l’égard, notamment des agents teneur de registre et agents de transfert, des gestionnaires de portefeuille auxquels il externalise la gestion et des conseillers en investissement et ce, en fonction d’une approche fondée sur les risques. GFI means gestionnaire de fonds d'investissement, investment fund manager (definition added by Regulation 20-05, Art. 2). Later amendments not verified. ↑
  13. CSSF Regulation 20-05, Art. 52, point 6, adding paragraph (6) to the outsourcing article of CSSF Regulation 12-02 (6) La CSSF pourra préciser les conditions citées ci-dessus par voie de circulaire. Which circulars, if any, the CSSF has issued under this paragraph has not been verified. ↑
  14. AED, page RC report FIAR (pfi.public.lu), English version, list of points In case of delegation of tasks concerning professional obligations to third parties, the results of controls performed on the compliance of services made by these third parties, not only with the legal and regulatory provisions, but also with the contractual provisions, if appropriate, the reasons for which the RAIF has chosen new third parties during the year ; The AED's page for the report on 2025, last updated 18/02/2026, retrieved 6 October 2026; the AIF page (page-fia-rc-report.txt) carries the same point. Supervisory information, not law. ↑
  15. Circular CSSF 18/698UNVERIFIED English version from the founder's own copy, downloaded by him and uploaded on 8 October 2026 (UTC); not retrieved from the publisher by Keltes (product/sources/lu/cssf-circ-18-698/manifest.json). That text says: 'In case of discrepancies between the French and the English text, the French text shall prevail.' The French version is not stored. The CSSF website answered every automated request by Keltes on 6 October 2026 with an empty reply or HTTP 400 (attempt-log.txt). Keltes has not yet verified its reading of the circular. No address is given because none was recorded. Nothing on this page rests on its content. ↑
  16. Circular CSSF 22/806UNVERIFIED The CSSF's own English version of the circular as amended by Circulars CSSF 25/883 and 26/915, from the founder's own copy, downloaded by him and uploaded on 8 October 2026 (UTC); not retrieved from the publisher by Keltes (product/sources/lu/cssf-circ-22-806/manifest.json). That version prints no date of its own, and neither the circular as issued nor the two amending circulars is stored. The CSSF website answered every automated request by Keltes on 6 October 2026 with an empty reply (attempt-log.txt). Keltes has not yet verified its reading of the circular. Nothing on this page rests on its content. ↑
Back to insights