AMLA Data Collection 2026: What Luxembourg Fund Boards Need to Know
- Katia Ciesielska
For years, Luxembourg supervised entities knew the rhythm. Once a year the CSSF’s AML/CFT questionnaire arrived, the Responsable du Contrôle coordinated the answers, and the board took note of the submission. In 2026 that rhythm changed. The new European Anti-Money Laundering Authority, known as AMLA, now shapes how data is collected across the EU, and Luxembourg was among the first markets to feel it.
I follow this transition closely in my work as an independent director and RC for Luxembourg funds. This article sets out what changed, why it matters at board level, and what directors should be asking their compliance teams before the next campaign.
Key takeaways
- From 2026, Luxembourg’s annual AML/CFT data collection runs on AMLA templates rather than the CSSF’s own questionnaire, submitted through eDesk.
- The 2026 campaign had two deadlines: 22 April for entities in AMLA’s calibration sample and 22 May for all other in-scope entities.
- The data is not just filed — it feeds AMLA’s and the CSSF’s risk scoring and helps decide who is supervised, and how closely.
- The board owns the risk profile the data describes. A short, minuted review of what was submitted is the simplest evidence of genuine oversight.
- This is the first step in a supervisory architecture that leads to AMLA direct supervision of around 40 institutions from 2028.
What changed in 2026
In March 2026 the CSSF confirmed that its annual AML/CFT questionnaire would be replaced, for most supervised entities, by standardised data collection templates developed by AMLA. The stated aim is consistency across the EU and, over time, a lighter reporting burden. Entities access the templates through the CSSF’s eDesk portal, the same channel used for other regulatory filings.
The scope is broad. The exercise covers credit institutions, investment firms and investment fund managers, including registered AIFMs and funds that have not designated a manager. It also captures payment institutions, e-money institutions, virtual asset service providers, central securities depositories, and Luxembourg branches of equivalent EU and third country entities. Specialised professionals of the financial sector continue to use the CSSF’s own questionnaire for the time being.
Two deadlines applied in the 2026 campaign, after an initial delay while AMLA finalised the templates. Entities included in AMLA’s data calibration sample had to submit by 22 April 2026. All other in-scope entities had until 22 May 2026.
| Date | Milestone |
|---|---|
| January 2026 | The EBA’s AML/CFT mandates transfer to AMLA (Frankfurt); AMLA becomes operational |
| February 2026 | AMLA publishes its Single Programming Document 2026–2028 |
| March 2026 | CSSF confirms AMLA templates replace its annual questionnaire for most entities |
| 22 April 2026 | Submission deadline — entities in AMLA’s calibration sample |
| 22 May 2026 | Submission deadline — all other in-scope entities |
| Spring 2027 | Next annual data collection expected |
| From 2028 | AMLA begins direct supervision of around 40 institutions |
One further milestone deserves mention. In January 2026 all AML and CFT mandates previously held by the European Banking Authority were transferred to AMLA. The authority, based in Frankfurt, is no longer a project on paper. It is operational, staffed, and already collecting the data that will drive its supervisory choices. Its priorities are set out in its Single Programming Document 2026 to 2028, published in February 2026.
Why this matters at board level
It is tempting to treat the data collection as a compliance formality, a form that the RC or the AML compliance officer fills in each spring. In my view that would be a mistake, for three reasons.
The first is that the data feeds AMLA’s risk scoring. The information submitted is not simply filed away. It is the raw material AMLA and the CSSF use to assess which entities present higher money laundering and terrorist financing risk. During 2026 the CSSF and AMLA set out how the obliged entities eligible for direct supervision are to be identified, with a provisional list expected later in the year. Put simply, what your entity reports today influences who supervises it tomorrow, and how intrusively.
The second reason is that the board owns the risk profile the data describes. The template responses paint a picture of your business model, your distribution channels, your investor base and your control framework. If the board has never seen a summary of what was submitted in its name, it cannot honestly claim to oversee the entity’s AML/CFT risk profile. Supervisors know this, and increasingly ask for evidence of board engagement.
The third reason is comparability. Standardised EU-wide templates make it far easier for supervisors to benchmark entities against their peers, and to spot answers that sit awkwardly next to the entity’s other regulatory filings, its business plan, or last year’s submission. Inconsistency attracts attention, and attention rarely arrives at a convenient moment.
What comes after 2026: direct supervision from 2028
The data collection is the visible part of a much larger construction. From 2028, AMLA will directly supervise around 40 credit and financial institutions selected on the basis of their cross-border footprint and risk profile. The selection exercise itself runs through 2027. For those entities, supervision moves from the national level to Frankfurt.
Most Luxembourg funds and management companies will not be in that first selection. That is not a reason to relax. AMLA also has the power to take over supervision of any obliged entity at the request of a national supervisor, or on its own initiative where there is a Union interest. The European Commission’s own Q&A on AMLA makes this explicit.
Between now and 2028, AMLA is developing around twenty technical standards and guidelines covering risk assessment, customer due diligence, internal controls and reporting, on a staggered timetable running through 2026 and into 2027. Each of those texts will eventually land on a board agenda somewhere. Boards that track them as they emerge will adapt gradually. Boards that wait will face a wall of new requirements all at once.
Practical steps for boards and conducting officers
So what does good practice look like? Based on what I see across the boards I serve, five steps stand out.
Put the submission on the board agenda. A short summary from the RC is enough: the key figures reported, the notable movements against the prior year, and any areas flagged internally as weak. Recording that discussion in the minutes is the simplest available evidence of genuine oversight.
Reconcile before you submit. Investor numbers, distribution jurisdictions and lists of delegates should match what the entity reports elsewhere. Small discrepancies invite large questions.
Understand your sample status. If your entity was included in AMLA’s calibration sample, ask why. Consider whether the risk profile that placed you there calls for reinforced controls, more frequent reporting to the board, or both.
Document remediation. Where the exercise reveals gaps, perhaps an outdated risk assessment or incomplete due diligence files, record the remediation plan and track it to closure. Supervisors judge entities on follow-through rather than intentions.
Build for next year. The templates will evolve as AMLA refines its methodology. Investing now in reliable data infrastructure, so that answers can be produced rather than reconstructed each spring, is the cheapest form of future-proofing available to most entities.
The bigger picture
The 2026 campaign is the first concrete sign of a supervisory architecture that will define the coming decade. National regulators collect harmonised data, and set out their governance expectations in texts such as CSSF Circular 26/906. A European authority uses that data to decide where to look, and in some cases to supervise directly. The logic is familiar to anyone who watched the Single Supervisory Mechanism reshape banking supervision after 2014.
Boards that engage with this shift early will find it entirely manageable. Boards that treat it as paperwork may discover, at an uncomfortable moment, that their entity’s data has already told a story on their behalf. If your board would like an independent perspective on its AML governance, or support in the RC role, I would be glad to have that conversation.
Frequently asked questions
What is AMLA? AMLA is the EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism, based in Frankfurt. It coordinates AML/CFT supervision across member states, develops common standards and templates, and from 2028 will directly supervise a selection of higher risk institutions.
Does the AMLA data collection replace the CSSF questionnaire? For most supervised entities, yes. The CSSF now uses AMLA templates in place of its own annual questionnaire. Specialised professionals of the financial sector continue with the CSSF questionnaire for now.
What were the 2026 deadlines? Entities in AMLA’s calibration sample had to submit by 22 April 2026. All other in-scope entities had until 22 May 2026. Submissions are made through the CSSF’s eDesk portal.
Who signs off on the submission? The entity submits through eDesk, typically coordinated by the RC and RR (Responsable du Contrôle and Responsable du Respect des obligations professionnelles). Good practice is for the board to review a summary before or shortly after submission and to record that review in the minutes.
What role does the independent director play? An independent director should challenge whether the reported risk profile matches reality, verify that the RC has adequate resources, and make sure that remediation of any weaknesses is tracked at board level until closure.
When is the next data collection? The exercise is annual. Entities should expect the next campaign in spring 2027, with templates continuing to evolve as AMLA develops its methodology.