I need to bring my Luxembourg organisation into compliance with article II.7.1.1 of CSSF 20/758 (CSSF 20/758). What are the concrete requirements, the sanctions, and how can Luxgap support me?

EU frameworkGDPR NIS 2 DORA AI Act Whistleblowing

CSSF circularsCSSF 26/906 CSSF 25/892 CSSF 25/893 CSSF 26/915CSSF 20/758CSSF 18/698 CSSF 22/806 CSSF 25/883 CSSF 25/880 CSSF 25/881 CSSF 25/882 CSSF 20/750 CSSF 12/552 CSSF 11/504 (repealed)CSSF 24/847

Article II.7.1.1

Section 7.1.1 - Structures complexes et activités inhabituelles

CSSF Circular 20/758 — Central administration, internal governance and risk management (investment firms) · CSSF 20/758

Section 7.1.1. Structures complexes et activités inhabituelles ou potentiellement non transparentes

165. Les activités inhabituelles ou potentiellement non transparentes sont des activités qui sont réalisées à travers des entités ou montages juridiques complexes ou dans des territoires qui accusent des déficits en matière de transparence ou qui ne répondent pas aux normes internationales.

166. Les principes directeurs que le conseil d’administration arrête en matière de gouvernance interne prévoient en particulier que les structures complexes et les activités inhabituelles ou potentiellement non transparentes sont soumises à une analyse approfondie et un suivi continu des risques, en particulier ceux liés à la criminalité financière. Qu’il s’agisse d’activités pour compte propre ou pour compte de clients, l’établissement doit comprendre l’utilité de ces structures et maîtriser les risques accompagnant leur création et leur fonctionnement opérationnel.

Luxgap guidance · DPO & CISO

How to comply

The classic trap

The CSSF does not sanction the mere existence of complex structures, it sanctions the absence of a documented rationale. The trap: your institution holds multi-layered arrangements (SPVs, trusts, holdings in opaque jurisdictions) without a file explaining the genuine economic purpose and without continuous monitoring of financial crime risk. During an on-site inspection, the CSSF requires the board of directors to actually understand these structures; a simple commercial agreement is not enough. The lack of in-depth analysis turns every complex relationship into a presumption of governance and AML/CFT failure.

What the CSSF concretely expects for each complex structure

A written file demonstrating the economic substance and legitimate purpose of the arrangement, not merely tax optimisation.
Identification of the real ultimate beneficial owner across all layers, including in non-cooperative or FATF-listed jurisdictions.
A transparency risk classification by territory, aligned with EU, FATF lists and automatic exchange of information standards.
Continuous monitoring (not one-off at onboarding) of movements and structural changes.
Evidence of approval by the board of directors or a delegated committee for high-risk cases.
An explicit link with the AML/CFT framework and the internal governance guidelines set by the board.

How Luxgap automates this risk

Our Luxgap Complex Structure Sentinel makes it impossible to overlook an undocumented opaque structure: an AI agent continuously maps all your relationships and arrangements, cross-checks each ownership layer against FATF, EU and OECD lists, and blocks any relationship whose economic rationale is not proven. The tool connects to your core banking system, the Luxembourg RBE, your KYC files (Fenergo, Actimize, or internal database) and your transaction flows to rebuild the full ownership tree, without the compliance officer filling in a single spreadsheet.

Automatically rebuilds the ultimate beneficial owner tree across all layers by cross-referencing the Luxembourg RBE, foreign registers and internal KYC data.
Assigns each territory a transparency score based on FATF lists, the EU list of non-cooperative jurisdictions and automatic exchange of information status, updated in real time.
Detects structural changes (new layer, new UBO, transfer to an opaque jurisdiction) and triggers an instant alert to your risk committee.
Generates for each complex arrangement a preformatted economic rationale file, to be validated by the board of directors, compliant with paragraphs 165 and 166 of CSSF 20/758.
Produces a timestamped and sealed PDF report, enforceable before the CSSF during an on-site inspection, demonstrating the in-depth analysis and continuous monitoring required.

Available alongside a Luxgap CISO or DPO mandate or as a dedicated SaaS module depending on your scope. Request a personalised quote and our teams will prepare a demonstration on your real scope, with a free blind audit within 48h to measure your exposure before any commitment.

Need help with this article?

Our team (lawyers + cyber engineers) gives you the concrete stuff. Reply within 24 business hours.

Section 7.1.1 - Structures complexes et activités inhabituelles

They trust us

Before we chat