{"id":"circulars/cssf-25-896","title":"Circular CSSF 25/896","type":"circular","date":"2025-08-18","kind":"circular","html":"

Circular CSSF 25/896 is a CSSF circular, published 18 August 2025. Subject: Adoption of the EBA Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (sanctions).

\n

Relevant for: Credit institutions, Crypto-Assets Service Providers (CASPs), E-money institutions, Investment firms, Payment institutions, Virtual asset service providers (VASPs).

\n

Main topic: Financial crime. Keywords: AML/CFT, International sanctions, Payment services, Restrictive measures.

\n

Text

\n

Circular CSSF 25/896 Adoption of the EBA guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (sanctions)

\n

Circular CSSF 25/896 Adoption of the EBA guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (sanctions) To all credit and financial institutions, payment service providers (“PSPs”) and crypto-assets service providers (“CASPs”) as further defined in Section 2

\n

Luxembourg, 18 August 2025

\n

Ladies and Gentlemen, The purpose of this circular is to inform you that the CSSF, in its capacity as competent authority, applies the European Banking Authority’s guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (“Guidelines”), further detailed below. The CSSF has integrated the Guidelines into its administrative practice and regulatory approach with a view to promoting supervisory convergence in this field at European level.

\n
    \n
  1. The Guidelines On 14 November 2024, the European Banking Authority (“EBA”) issued the Guidelines, which are composed of two sets of specific guidelines - EBA/GL/2024/14 and EBA/GL/2024/15 - to standardise the internal policies, procedures and controls (including screening measures) that financial institutions falling within their scope should implement to comply with Union and national restrictive measures. While the scope of the first set of guidelines is more general, the second set of guidelines adds specific measures when executing transfers of funds or crypto-assets pursuant to Regulation (EU) 2023/1113 on information accompanying transfer of funds and certain crypto-assets (“Regulation (EU) 2023/1113”). These Guidelines emphasise a proportionate approach, considering the institution’s size, nature, complexity of activities and its exposure to restrictive measures. Nevertheless, it shall be stressed that the EBA Guidelines do not dismiss the rules-based approach, applicable regarding the implementation of restrictive measures, i.e. institutions must ensure that they freeze and do not make funds or other assets available (in)directly to designated/sanctioned persons, bodies or entities. Instead, the two approaches complement each other. Based on the findings of a thorough restrictive measures’ exposure assessment, identifying which area of business/activity of the institution is particularly exposed or vulnerable to restrictive measures or the circumvention of restrictive measures, the institutions can take informed decisions and adjust the extent of the implementation measures and types of controls they need to put in place for their compliance with the restrictive measures framework.
    2. \n
\n

CIRCULAR CSSF 25/896 Adoption of the EBA guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures

\n

1.1.

\n

Pursuant to EBA/GL/2024/14 on general Internal Policies, Procedures and Controls, key requirements include points on:

\n

Governance Structure: Establish a clear governance and control framework, including regarding responsibilities for approval, oversight and monitoring of policies, procedures and controls for the implementation of restrictive measures to ensure that they are adequate and implemented effectively and the risk of circumvention mitigated. In addition to the roles to be taken by the management body, a senior staff member in charge of compliance with restrictive measures shall be appointed. The Guidelines envisage proportionality and flexibility for the appointment of this role.

\n

Restrictive measures exposure assessment: Conduct assessments to identify and assess areas where restrictive measures are applicable to the financial institution and importantly, where they are exposed to non-implementation or circumvention of restrictive measures, and implement proportionate controls.

\n

The text above is the opening of the document; the PDF carries the whole.

\n

Document page, PDF. Source: Commission de Surveillance du Secteur Financier (CSSF), reproduced with the CSSF's consent. The French text prevails.

"}