International sanctions compliance in Luxembourg: update on recent EU measures and CSSF guidance

The last quarter of 2025 has brought several material changes to the international sanctions landscape that affect natural and legal persons established in Luxembourg, the most important of which are discussed below. In particular, following reactivation by the United Nations (“UN”) of certain nuclear‑related measures against Iran, the European Union (“EU”) responded with parallel measures and additional autonomous restrictions in September 2025 (I). In addition, on 23 October 2025, the EU adopted the 19th package of restrictive measures directed at Russia, with a particular emphasis on energy, finance and anti‑circumvention measures (II). 

At Luxembourg level, the Commission de Surveillance du Secteur Financier (“CSSF”) issued Circular 25/896 to adopt the European Banking Authority (“EBA”) Guidelines on internal policies, procedures and controls for sanctions implementation (“CSSF Circular 25/896”) for certain regulated entities (III). On 3 November 2025, the CSSF also published an updated Q&A on international financial sanctions (the “Q&A”) to clarify its expectations with respect to international sanctions compliance for all entities subject to its supervision (IV). 

These developments expand the practical scope of sanctions risk, sharpen enforcement tools and raise the standard of compliance for persons subject to the Luxembourg Law of 19 December 2020 on restrictive measures (“Restrictive Measures Law”). Further legislative developments are forthcoming in Luxembourg since Bill of Law N°8579 (the “Bill of Law”) (available in French only) is currently pending before Parliament. It aims to transpose into national law certain provisions of Directive (EU) 2024/1226 on the definition of criminal offences and sanctions for violations of Union restrictive measures (V).

I. Iran - reactivated listings, prohibitions and effects for trade and finance

On 27 September 2025, following restoration of the UN nuclear-related measures that had been lifted in 2015, the EU also reintroduced autonomous measures and amended existing Regulation (EU) 267/2012 concerning restricting measures against Iran (“Regulation 267/2012”) through: 

Regulation 267/2012, as amended, has reinstated asset freeze measures against more than 50 natural persons and 200 legal persons, entities or bodies. The designated persons include key actors of the Iranian economy and nuclear activities, including, inter alia, the Central Bank of Iran, many Iranian banks, the Ministry of Energy and leading Iranian companies operating in the oil and gas sector. 

Sectorial sanctions have also been fully reinstated and expanded, including import, export and sales restrictions related to dual use items in the energy sector, naval equipment, certain types of industrial software, crude oil, natural gas, petrochemical and petroleum products and related services, gold and other precious metals and diamonds. 

In addition, specific finance-related restrictions have been reinstated. These include, inter alia, (i) an investment ban and a prohibition to provide financing to certain sectors of the Iranian economy that could be used for nuclear proliferation purposes, (ii) a prohibition to purchase bonds from the Iranian government and contribute to its financing, and (iii) restrictions on banking, insurance or re-insurance services. Iranian financial institutions are also targeted as the processing of payments or transfer of funds between EU and Iranian financial institutions is generally restricted and specific exemptions and derogations apply. 

To date, a fully consolidated version of Regulation 267/2012, as amended, is not available. Luxembourg business operators should review the individual amending EU regulations and update their screening lists and risk assessments accordingly.

II. Russia - new energy and finance measures with sharpened anti‑circumvention measures

The 19th sanctions package builds on earlier rounds of EU sanctions and steps up pressure to cut Russia’s ability to finance and sustain the war in Ukraine. Its main measures are summarised below. It also applies parallel restrictive measures to Belarus for its material support to the Russian effort.

Through the new package, the EU adopts 69 new individual listings and broad economic measures targeting core revenue and supply chains in energy, finance and the military‑industrial complex. Energy measures include a phased ban on certain LNG imports, tighter transaction bans on major state oil producers, listings of oil‑sector enablers and a ban on reinsuring and servicing designated shadow‑fleet vessels, plus port‑access bans on hundreds of tankers.

Financial and crypto-related measures (i) expand sanctions on additional banks, traders and payment‑systems (including, inter alia, the issuance of payment instruments and electronic money), (ii) ban the Russia‑linked stablecoin A7A5 and related operators and prohibit transactions in that token across the EU, and (iii) block the use of certain Russian payment systems. 

In addition, Regulation (EU) No 269/2014 related to asset freeze measures is amended to clarify the criteria of ownership and control: 

  • “owning” is defined as possession of 50% or more of proprietary rights or a majority interest; and 
  • “controlling” is expanded to cover a range of factual and legal mechanisms (appointment or removal of governing bodies, voting‑right arrangements, dominant influence, use of assets, unified management, joint liability and similar de facto powers).

Furthermore, export controls are expanded to cover microelectronics, CNC machine tools, UAV components and other dual‑use items, together with new bans on a range of materials and components that support military manufacture.

Finally, the 19th package constrains third‑country enablers by listing non‑EU entities and individuals (including in China, the UAE, Tajikistan, Kyrgyzstan and elsewhere) that facilitate circumvention, and imposes service and export restrictions on companies that support Russia’s defence and industrial capacity. Also, controls are tightened on Russian diplomatic movements across the Schengen area and listings added for those involved in the abduction, forced assimilation and indoctrination of Ukrainian children. 

III. CSSF Circular 25/896 – adoption of EBA guidelines affecting sanctions compliance

CSSF Circular 25/896 has adopted two sets of EBA guidelines related to internal policies, procedures and controls (including screening) to implement EU and national restrictive measures (“Guidelines”):

  • general rules on internal policies, procedures and controls for all in‑scope financial institutions, i.e. credit institutions, investment firms, payment institutions and electronic money institutions (“General Rules”); and
  • specific rules for payment service providers (PSPs) and crypto‑asset service providers (CASPs) when executing transfers of funds and certain crypto‑assets (“PSPs and CASPs Specificities”).

The General Rules put governance at the centre of sanctions compliance. Accordingly, boards and senior management are expected to exercise effective oversight of sanctions risk and to appoint a senior compliance lead who has the authority and resources proportionate to the entity’s size and risk. Amongst other obligations, in‑scope entities must carry out an annual restrictive‑measures exposure assessment and repeat it after material events, and they must use the results to design proportionate policies, role-specific trainings, screening, transaction‑monitoring and escalation procedures. 

With respect to PSPs and CASPs Specificities, the CSSF and EBA stress that sanctions lists should be kept current and screening systems should be reliable, calibrated and tested regularly. If a match is confirmed, in-scope entities must freeze the relevant funds or crypto‑assets, suspend related transfers and notify the competent authorities. Furthermore, the CSSF reiterates that outsourcing does not remove liability and service providers must be monitored to ensure equivalent restrictive‑measures controls.

Although CSSF Circular 25/896 is now the supervisory baseline applicable as of 30 December 2025, the CSSF indicates that it expects the Guidelines to be adapted following the entry into force of relevant rules of the AML 6 EU legal framework. Also, it does not override but complements the current AML/CFT framework: in-scope entities remain subject to their obligations under the Luxembourg Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (“AML Law”), and related CSSF circulars. 

IV. Updated CSSF Q&A on international financial sanctions

The Q&A clarifies supervised entities’ practical obligations with respect to international restrictive measures. 

It notably adds guidance on indirect ownership, control and influence, and how those concepts affect designation and freezing decisions. With respect to enforcement, the Q&A clarifies notification and freezing procedures, including expected timing and the forms to use, and states that in-scope entities must notify the Ministry of Finance and simultaneously send a copy to the CSSF without delay. 

Also, question 18 of the Q&A advises professionals to use their restrictive measures exposure assessment to adopt targeted controls regarding proliferation financing such as stronger risk assessments, enhanced detection for dual use goods and illicit procurement networks, and to improve data sharing and cooperation with other professionals and authorities.

V. Specification of sanctions for non-compliance through the Bill of Law

In line with Directive (EU) 2024/1226, the Bill of Law seeks to extend relevant Luxembourg criminal and administrative law provisions to capture sophisticated facilitation and circumvention schemes that undermine the EU’s restrictive measures. 

Indeed, the purpose of the Bill of Law is to transpose into national law the Directive’s provisions relating to the definitions of criminal offences linked to the violation of restrictive measures, as well as the associated criminal penalties, and certain other provisions that require transposition. Most of the new provisions are incorporated into the existing legal framework for the implementation of restrictive measures, in particular the Law of 27 June 2018 on export controls, as regards the implementation of restrictive measures in the commercial field, and the amended Law of 19 December 2020 on the implementation of restrictive measures in the financial field. The transposition is supplemented by the amendment of other legislative texts and the creation of a new committee for coordination and cooperation on restrictive measures, responsible in particular for ensuring coordination and cooperation between law enforcement authorities and the authorities responsible for applying restrictive measures, as required by the Directive. For professionals of the financial sector within the meaning of the AML Law, the Bill of Law provides for the possible doubling of the applicable criminal sanctions in the case of a violation of the sanctions regime in the context of the exercise of their professional activity.

Key takeaways

As the international sanctions framework grows more complex and enforcement becomes more coordinated across jurisdictions, compliance expectations are evolving in parallel. In response, business operators established in Luxembourg must remain alert and continuously adapt their internal processes, not only to reflect changing legal definitions and supervisory guidance, but also to manage emerging risks such as proliferation financing and sanctions circumvention.

For any questions, please contact

Related expertise

EU & competition law

Regulatory & compliance