Luxembourg Finalises 1st ML/TF Vertical Risk Assessment on Virtual Asset Service Provider

Luxembourg's Ministry of Justice has confirmed the finalisation of the country's first money laundering and terrorist financing (ML/TF) vertical risk assessment on a virtual asset service provider.

Over the past five years, virtual assets (VAs) have been increasingly adopted for various legitimate activities, including for investments or transactions. Notwithstanding, VAs have certain features that make them vulnerable to abuse by criminals for ML/TF activities. The high adoption of VAs by criminals poses significant challenges to virtual asset service providers (VASPs), financial institutions, supervisors and law enforcement agencies.

Multiple factors contributed to the need for a VASP vertical risk assessment. The 2018 and 2020 Luxembourg National Risk Assessment (NRA) specifically mentioned VAs as an emerging and evolving risk. Furthermore, different international bodies have set standards for the mitigation of ML/TF risks stemming from VAs and VASPs. The Ministry of Justice has conducted the ML/TF vertical risk assessment on VASP in close collaboration with the relevant AML/CFT supervisory authority (CSSF), the Financial Intelligence Unit (CRF) and other private and public sector entities in Luxembourg.

The risk assessment develops a comprehensive taxonomy of different types of VAs and VASPs and describes the main ML/TF threats they pose. It describes the threats posed by VAs and VASPs in various stages of ML and outlines the predicate offences that VAs can facilitate, including drug trafficking, fraud and forgery and theft. The risk assessment identifies the inherent risk of eight VA types and sub-types. Pseudoanonymous VAs, such as Bitcoin, and anonymous VAs, such as Monero, are deemed as having a very high inherent risk level due to their anonymity, usability and security features.

The risk assessment also describes the mitigating factors that VASPs are obliged to implement to reduce ML/TF risk as per the 2004 AML/CFT Law and the different measures implemented by the CSSF, the CRF and prosecution authorities. The CSSF has issued two general warnings on VAs and VASPs and eight warnings on entities, related to VAs, and has developed internal capabilities to deploy AML/CFT supervision of VASPs and is assessing the VASP registration files for several applicants as of mid-November 2020. The CRF has implemented multiple mitigating measures and built up relevant internal capabilities to conduct operational and strategic analyses on VASPs. In 2019, the CRF received 1,622 Suspicious Transaction Reports (STRs) linked to VAs or VASPs on voluntary basis from different entities. Luxembourg prosecution and law enforcement authorities have also implemented necessary internal capabilities to analyse VA-linked cases.

Finally, the risk assessment provides a list of legal obligations for the VASP private sector and presents a list of more than 40 red flag indicators developed jointly with the CRF that should specifically be considered in a VA context. Additionally, the FATF has published red flag indicators on 14 September 2020 which entities should take into account. The list of red flag indicators should support private entities in setting up appropriate transaction-monitoring processes and improving their reporting to the financial intelligence unit. The risk assessment is intended to be updated in the near future when a more complete view of the market becomes attainable.

Regarding areas for further enhancement, this assessment suggests that all institutions conducting VASP activities take a proactive approach to mitigate ML/TF risks. They should use this risk assessment to increase their understanding of ML/TF threats and vulnerabilities of VASPs in Luxembourg. In line with the 2004 AML/CFT Law, regulations, this VASP ML/TF vertical risk assessment and the FATF Recommendations, the Ministry of Justice identified several key obligations to entities seeking to obtain a VASP registration and conducting VASP activities.

The full report can be downloaded from mj.gouvernement.lu/dam-assets/dossiers/blanchiment/ML-TF-vertical-risk-assessment-on-VASPs.pdf.