CSSF

Commission de Surveillance du Secteur Financier

High Impact

CSSF updates Circular 22/822 annex on FATF high-risk and increased-monitoring jurisdictions

Published

Jun 25, 2026

Topics

AML/CFT, Counter-proliferation financing, FATF high-risk jurisdictions, Enhanced due diligence, Suspicious transaction reporting, Correspondent banking, Country risk controls

Executive Summary

The CSSF has published the 19 June 2026 version of the annex to Circular CSSF 22/822, updating the Luxembourg supervisory reference list for FATF high-risk jurisdictions and jurisdictions under increased monitoring. The annex confirms that professionals must continue to apply enhanced vigilance, monitoring and suspicious-reporting mechanisms for higher-risk exposures, with specific measures for DPRK, Iran and Myanmar. DPRK and Iran remain in the high-risk section where enhanced measures and, where applicable, countermeasures are required; Myanmar remains subject to enhanced due diligence and may face FATF countermeasures if no progress is made by October 2026. The annex also lists jurisdictions under FATF increased monitoring and states that Algeria and Namibia are no longer subject to the ongoing enhanced-monitoring process, while continuing to work with FATF or the relevant FATF-style regional body. Luxembourg firms should treat this as a country-risk and financial-crime control update rather than a new reporting template obligation, with immediate implications for screening, onboarding, correspondent banking, third-party reliance, transaction monitoring and CRF escalation workflows.

What Changed

modifiedHigh-risk jurisdiction handling

Previous annex version under Circular CSSF 22/822; the source does not reproduce the full prior list.

New

DPRK and Iran require enhanced measures and countermeasure consideration; Myanmar requires enhanced due diligence proportionate to risk.

modifiedIran-specific controls

Iran was already subject to FATF action-plan and countermeasure concerns; the source notes its action plan had expired without all deficiencies being remediated.

New

The annex requires effective, proportionate countermeasures and specific enhanced monitoring, notification and CRF-reporting arrangements for Iran exposure.

modifiedDPRK-specific controls

DPRK was already subject to FATF countermeasure calls due to strategic deficiencies and proliferation-financing threats.

New

Professionals must continue enhanced vigilance and monitoring, avoid circumvention of enhanced measures and countermeasures, notify CSSF of DPRK correspondent banking relationships, and maintain enhanced CRF reporting.

modifiedMyanmar treatment and possible future countermeasures

Myanmar committed in February 2020 to address strategic AML/CFT deficiencies; its action plan expired in September 2021, and FATF called for enhanced due diligence in October 2022.

New

Professionals must consider Myanmar-related risks with particular attention, including relationships and operations involving Myanmar entities and those acting on their behalf, and implement enhanced suspicious-reporting mechanisms to the CRF.

removedAlgeria and Namibia from ongoing enhanced monitoring

The source indicates these jurisdictions were previously within the context of FATF enhanced monitoring.

New

Algeria and Namibia are no longer subject to the ongoing enhanced-monitoring process referenced in the annex.

Business Impact

Who is affected

Directly affected

CSSF-supervised professionals subject to Circular CSSF 22/822, including financial institutions, funds and managers where in scope, payment and e-money institutions, credit institutions, and virtual-asset service providers or other AML-obliged professionals.

Indirectly affected

customers, beneficial owners, counterparties, correspondent banks, branches, subsidiaries, outsourced providers, introducers and transaction counterparties with links to the listed jurisdictions.

Jurisdictions

Luxembourg, Democratic People’s Republic of Korea, Iran, Myanmar, Angola, Bolivia, Bosnia and Herzegovina, Bulgaria, Cameroon, Côte d’Ivoire, Haiti, British Virgin Islands, Iraq, Kenya, Kuwait, Lebanon, Monaco, Nepal, Papua New Guinea, Democratic Republic of the Congo, Lao People’s Democratic Republic, South Sudan, Syria, Venezuela, Vietnam, Yemen, Algeria, Namibia

Business processes

Country risk scoring and AML/CFT/CPF risk appetite, Customer onboarding and periodic KYC review, Enhanced due diligence and senior management escalation, Correspondent banking approval and review, Third-party reliance and outsourcing due diligence, Transaction monitoring and payment screening, Suspicious transaction reporting to the CRF, CSSF notification controls for specified correspondent and Iran third-party reliance situations

Estimated effort

Medium

Compliance risk

High

Affected Reports

AML/CFT/CPF country-risk matrix and restricted-jurisdiction listCustomer onboarding and periodic-review EDD control checklistCorrespondent banking relationship inventory and CSSF notification registerThird-party reliance and outsourcing location control registerSuspicious transaction report escalation and CRF filing workflow

Field	Validation rule
Jurisdiction risk status	Classify DPRK, Iran and Myanmar according to the annex’s high-risk treatment; classify the listed jurisdictions as subject to FATF increased monitoring; reflect Algeria and Namibia as no longer under ongoing enhanced monitoring.
Counterparty, customer or beneficial-owner country link	Flag relationships and operations involving DPRK, Iran, Myanmar, and listed monitored jurisdictions, including entities, financial institutions and persons acting on their behalf.
Correspondent banking country	Trigger CSSF notification where a correspondent banking relationship exists with a DPRK credit institution or an Iranian credit institution, as specified in the annex.
Third-party reliance or outsourcing location	Trigger CSSF notification where a third party located in Iran is used for customer due-diligence measures, including introducers and outsourcing arrangements.
Enhanced suspicious-reporting indicator	Maintain or activate enhanced suspicious-reporting mechanisms to the CRF for DPRK, Iran and Myanmar risk exposure.

Recommended Actions

7 suggested next steps· derived from source analysis

1
AI generatedStep 1 of 7
refresh country-risk reference data and screening lists to reflect the 19 June 2026 CSSF annex, including high-risk, increased-monitoring and removed-monitoring statuses.
2
AI generatedStep 2 of 7
re-run exposure reports for customers, beneficial owners, counterparties, correspondents, payment chains and virtual-asset relationships linked to DPRK, Iran and Myanmar.
3
AI generatedStep 3 of 7
validate that Iran and DPRK correspondent banking relationships, and Iran-based third-party reliance or outsourcing arrangements, are captured for CSSF notification where required.
4
AI generatedStep 4 of 7
update enhanced due-diligence procedures so reviewers document transaction purpose, increased control frequency and deeper review of selected Iran-linked transactions.
5
AI generatedStep 5 of 7
test CRF suspicious-reporting escalation rules for DPRK, Iran and Myanmar exposure and confirm that humanitarian, food, medical, diplomatic and personal remittance flows are risk-assessed rather than automatically blocked where the annex calls for appropriate risk-based treatment.
6
AI generatedStep 6 of 7
brief first-line onboarding, payments, correspondent banking and AML investigations teams on the revised annex and the October 2026 Myanmar countermeasure trigger.
7
AI generatedStep 7 of 7
retain an audit trail showing the date of list update, rules changed, alerts generated, and management sign-off.

Timeline

other

Jun 2016

Iran committed to address strategic AML/CFT deficiencies under a FATF action plan, according to the annex.

other

Feb 2020

Myanmar committed to address strategic AML/CFT deficiencies, according to the annex.

other

Sep 2021

Myanmar’s FATF action plan expired, according to the annex.

implementation

Oct 2022

FATF required enhanced due diligence proportionate to Myanmar-related risks, according to the annex.

other

Jun 19, 2026

Version date of the CSSF Circular 22/822 annex.

publication

Jun 22, 2026

CSSF regulatory framework entry indicates publication of the annex.

other

Oct 2026

If no progress is made by October 2026, FATF will consider countermeasures for Myanmar, according to the annex.

Sources

AI-generated analysis is based on the following primary sources. Always verify against the official publication.

Official circular annexCommission de Surveillance du Secteur FinancierJun 19, 2026
Annexe Circulaire CSSF 22/822 – Version du 19 juin 2026 ↗
https://www.cssf.lu/wp-content/uploads/cssf22_822_annexe_240626.pdf
Official regulatory framework webpageCommission de Surveillance du Secteur FinancierJun 22, 2026
Regulatory framework entry for CSSF Circular 22/822 annex ↗
https://www.cssf.lu/en/regulatory-framework/

Related Evidence

Verified source support for this analysis

The evidence agent checks whether the drafted finding is supported by official publications and relevant public source material.

Receive updates like this by email

Get AI-generated analysis for the regulators and topics you care about.