guide

Last updated June 25, 2026

CSSF AMLA Standardised Data Collection 2026: Practical AML/CFT Evidence Guide

Direct answer

Use CSSF AMLA Standardised Data Collection 2026: Practical AML/CFT Evidence Guide when a CSSF-facing question needs a structured file rather than a loose policy summary. It explains understanding the Luxembourg regulatory obligation, supervisory evidence, internal ownership, and escalation points in CSSF AMLA Standardised Data Collection 2026: Practical AML/CFT Evidence Guide, then shows how to map the controlling rule, prepare board or compliance evidence, and know when a CSSF-facing specialist should review the file. The later sections connect official sources used, why amla templates matter, and scope is wider than many teams expect so the next step is easier to judge. Read it before assigning owners or responding to a supervisory request, so the evidence file matches the regulatory question.

Decision matrix

For supervised entities, the practical message is direct: AML/CFT reporting is becoming more standardised, more comparable, and more data-driven. The response should not be treated as a clerical form. It should be treated as a regulatory evidence exercise covering money laundering, terrorist financing, international sanctions, restrictive measures, proliferation financing, customer risk, branch scope, sector profile, and control maturity. A good file connects each answer to source records, accountable owners, data lineage, validation, and senior review.

Official sources used

• CSSF: Circular letter 12 February 2026
• CSSF: Financial crime
• CSSF: International financial sanctions
• CSSF eDesk portal
• CSSF: About the CSSF

Official CSSF, AMLA, EU, and Luxembourg materials can change. Verify the current circular letter, templates, eDesk procedures, deadlines, FAQ, and entity-specific instructions before acting.

Why AMLA templates matter

The most important change is comparability. When national competent authorities use standardised templates developed with AMLA, data becomes easier to compare across institutions and sectors. A firm that previously answered a local questionnaire in familiar wording may now need to provide data in a more structured format. That can reveal previously unresolved inconsistencies: entity classifications, customer categories, geographic exposure, sanctions screening metrics, branch data, beneficial ownership data, suspicious activity metrics, outsourcing arrangements, and control maturity.

The practical answer is to prepare a data lineage map before entering responses. Each field should have a source, owner, date, validation rule, limitation, and reviewer. Without that map, the response may become a last-minute negotiation between compliance, operations, IT, front office, and group reporting.

Scope is wider than many teams expect

The circular letter addresses many categories of supervised entities and branches. This matters because a group may have multiple Luxembourg entities with different activities, systems, data owners, and AML/CFT profiles. A credit institution, investment fund manager, payment institution, VASP, CASP, specialised PFS, and branch may not be able to reuse the same assumptions. Even within one group, customer types, transaction patterns, sanctions exposure, and control arrangements can differ.

The first working session should identify which legal entities and branches are in scope, who owns each response, whether group data can be used, where local data differs, and how consolidated answers are prevented from masking local risk.

From questionnaire thinking to evidence thinking

Questionnaire thinking asks, "What answer should we provide?" Evidence thinking asks, "What record proves the answer?" The second mindset is safer. AML/CFT, sanctions, and proliferation-financing controls depend on facts that should be traceable: customer counts, risk categories, high-risk jurisdictions, PEP exposure, alerts, suspicious activity escalations, training completion, outsourced controls, transaction monitoring scenarios, sanctions screening, branch activity, and remediation items.

A strong response file contains not only the submitted answer but also the source report, extraction date, validation check, owner sign-off, reviewer challenge, assumption log, and limitation note. If the CSSF or internal audit later asks how an answer was produced, the firm should not need to reconstruct it from memory.

Sanctions and proliferation financing

The circular letter keywords include international sanctions, restrictive measures, terrorist financing, and proliferation financing. These areas often create data and governance challenges. A firm may screen names daily but not have clean metrics on false positives, true matches, escalations, list updates, beneficial owner screening, payments screening, securities screening, or post-event remediation. Proliferation-financing risk may require sector, goods, geography, ownership, and counterparty analysis that is not captured by simple name screening.

The data collection exercise should therefore be used to test whether sanctions and proliferation-financing controls are measurable. If management cannot see the volume and quality of screening outcomes, it cannot confidently oversee the control.

VASPs and CASPs

The inclusion of virtual asset service providers and crypto-asset service providers is important. Crypto-asset activity can create fast-moving customer, wallet, transaction, jurisdiction, technology, and sanctions risks. Firms should not assume that traditional banking AML/CFT metrics will capture crypto-specific exposure. Useful controls may include wallet-risk tooling, blockchain analytics limitations, travel-rule handling where applicable, exposure to high-risk jurisdictions, self-hosted wallet policy, transaction monitoring rules, and escalation pathways.

CASPs and VASPs should also align the AML/CFT data collection with MiCA transition work, customer disclosures, outsourcing, custody, incident management, and complaint handling where relevant. Regulatory themes rarely remain isolated.

Branches and group data

Luxembourg branches of listed entities are included in the circular letter's perimeter. Branch reporting often fails when group systems do not produce local views. A branch may rely on head-office tools, group customer classifications, central transaction monitoring, or shared sanctions screening. That can work, but the branch still needs evidence for local supervisory purposes. The file should show which data is local, which is group-sourced, how it is filtered, who validates it, and whether local management has visibility.

Branches should be careful with assumptions such as "group handles it." The CSSF-facing file needs Luxembourg-relevant evidence.

eDesk and access governance

The response process will rely on electronic submission. eDesk access should be tested early. The team should confirm user permissions, LuxTrust authentication, entity context, backup access, delegation, third-party involvement, and revocation after submission. Portal access can be a sensitive permission because it may expose regulatory procedures or information beyond the immediate template.

Access governance should be documented. If a consultant or group user supports the filing, the entity should define scope, confidentiality, approval, and revocation.

Data-quality dry run

A dry run should occur before the official deadline pressure. Pull the expected data fields, identify owners, extract sample data, reconcile against source systems, challenge surprising figures, and log limitations. The dry run should not aim for perfection. It should reveal where the entity is not ready.

Common issues include inconsistent customer-risk categories, stale PEP flags, missing beneficial ownership metrics, unclear branch populations, duplicated customer counts, sanctions alert metrics that cannot distinguish true and false positives, outsourced controls without local evidence, and remediation actions not linked to accountable owners.

Senior management review

The RC, RR, compliance officer, authorised management, board, or relevant committee should see a concise submission pack before final filing. The pack should identify scope, key figures, changes from prior year, high-risk exposures, limitations, open remediation, assumptions, and sign-off. It should not bury decision-makers in raw templates without interpretation.

Senior review matters because AML/CFT data tells a risk story. If the story is inconsistent with what management believes, either the data is wrong or management's view needs updating.

Checklist and next steps

Create a scope register. Build a field-level data map. Confirm eDesk access. Assign owners. Run a dry extraction. Reconcile customer, transaction, sanctions, PEP, high-risk jurisdiction, branch, and remediation data. Document limitations. Challenge outliers. Prepare a management pack. Submit with evidence retained. After submission, hold a lessons-learned session and convert defects into remediation.

The best time to improve next year's filing is immediately after this year's filing, while defects are fresh.

Editorial risk note

This guide is not legal or compliance advice and does not replace the CSSF circular letter, AMLA materials, Luxembourg AML/CFT law, sanctions regulations, or professional advice. Use it as a practical evidence framework and verify current instructions before acting.

Evidence playbook

Evidence control 1: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 2: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 3: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 4: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 5: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 6: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 7: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 8: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 9: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 10: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 11: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 12: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 13: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 14: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 15: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 16: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 17: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 18: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 19: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 20: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 21: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 22: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 23: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 24: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 25: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 26: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 27: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 28: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 29: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 30: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 31: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 32: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 33: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 34: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 35: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 36: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 37: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 38: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 39: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 40: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 41: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 42: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 43: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 44: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 45: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 46: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 47: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 48: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 49: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 50: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 51: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 52: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 53: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 54: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 55: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 56: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 57: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 58: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 59: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 60: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 61: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 62: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 63: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 64: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 65: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 66: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 67: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 68: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 69: exception

For CSSF AMLA standardised AML/CFT data collection 2026, test what happens if the answer is late, incomplete, inconsistent, or unsupported by evidence. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 70: action

For CSSF AMLA standardised AML/CFT data collection 2026, test what the team should do this week to turn regulatory reading into an operating control. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 71: scope

For CSSF AMLA standardised AML/CFT data collection 2026, test which entity, branch, product, portfolio, risk type, customer group, provider, or reporting population is included. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 72: owner

For CSSF AMLA standardised AML/CFT data collection 2026, test who owns the data, who challenges the answer, who approves the submission, and who can evidence the position. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 73: source

For CSSF AMLA standardised AML/CFT data collection 2026, test which system, policy, risk assessment, questionnaire, file, control log, or board paper proves the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 74: materiality

For CSSF AMLA standardised AML/CFT data collection 2026, test what makes the point material, immaterial, emerging, mitigated, or not applicable. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 75: governance

For CSSF AMLA standardised AML/CFT data collection 2026, test which board, management committee, control function, or delegated provider needs visibility. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 76: data quality

For CSSF AMLA standardised AML/CFT data collection 2026, test which fields are system-sourced, manual, estimated, stale, reconciled, incomplete, or subject to remediation. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 77: change

For CSSF AMLA standardised AML/CFT data collection 2026, test what changed since the prior cycle and whether the change alters risk, reporting, controls, or client impact. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

Evidence control 78: testing

For CSSF AMLA standardised AML/CFT data collection 2026, test which sample, dry run, reconciliation, challenge, audit check, or management review tests the answer. The shift to AMLA templates makes source data, comparability, branch scope, and evidence retention more important. A useful response names a record owner, source record, review date, limitation, exception path, and next action. If a second reviewer cannot reproduce the conclusion from the file, the control is not yet strong enough for supervisory use or board-level assurance.

FAQ

What changed in 2026?

The CSSF circular letter says it will deploy data collection templates developed by AMLA and national competent authorities instead of launching the previous historical questionnaire format.

Who is addressed?

The letter addresses a broad set of supervised entities, including banks, investment firms, fund managers, payment and e-money institutions, VASPs, CASPs, specialised PFS, CSDs, and relevant Luxembourg branches.

What is the main operational risk?

Weak data lineage. If the firm cannot prove where each answer came from, the submission is fragile.

What should teams do first?

Map scope, owners, source systems, eDesk access, data fields, validation checks, limitations, and senior sign-off.