- Australia
- Austria
- Bangladesh
- Belgium
- Brazil
- Bulgaria
- Canada
- China
- Croatia
- Cyprus
- Czech Republic
- Denmark
- Egypt
- Estonia
- Eswatini
- Ethiopia
- Finland
- France
- Germany
- Greece
- Haiti
- Hong Kong
- Hungary
- India
- Iraq
- Ireland
- Indonesia
- Italy
- Japan
- Jordan
- Kazakhstan
- Kenya
- Kosovo
- Kuwait
- Latvia
- Lithuania
- Luxembourg
- Malaysia
- Malta
- Mauritius
- Mexico
- Micronesia
- Moldova
- Mongolia
- Montenegro
- Morocco
- Mozambique
- Myanmar
- Namibia
- Nauru
- Nepal
- Nigeria
- Nicaragua
- Niue
- Norway
- Netherlands
- New Zealand
- Oman
- Pakistan
- Palau
- Palestine
- Panama
- Papua New Guinea
- Paraguay
- Peru
- Puerto Rico
- Philippines
- Portugal
- Poland
- Qatar
- Republic of Congo
- Romania
- Russia
- Rwanda
- Samoa
- San Marino
- Senegal
- Serbia
- Seychelles
- Sierra Leone
- Singapore
- Slovakia
- Slovenia
- Somalia
- South Africa
- South Korea
- South Sudan
- Spain
- Sri Lanka
- St Kitts and Nevis
- St Maarten
- St Lucia
- Sweden
- Switzerland `
- Syria
- Taiwan
- Tajikistan
- Tanzania
- Thailand
- Timor Leste
- Togo
- Tonga
- Trinidad and Tobago
- Turkey
- Turks and Caicos
- Turkmenistan
- Tunisia
- Tuvalu
- Uganda
- Ukraine
- UK
- USA
- Vietnam
LUXEMBOURG KYC, KYB AND AML
Scale Identity Verification and KYC Operations in Luxembourg
Verify Luxembourg customers and businesses through the notified Luxembourg eID, NFC chip reading, QES, identity documents, biometrics and KYB. Reduce manual review, maintain consistent audit evidence and run one connected workflow designed to support the Law of 12 November 2004 today and AMLR from 10 July 2027.
Operational Performance for Luxembourg KYC
Our Numbers Speak Volumes
99.9%
First-pass
verification rate
< 10 sec
Median
verification time
7
Luxembourg ID methods
supported
Luxembourg IDV/KYC Challenges
The Notified eID Is Not the Everyday Login
Luxembourg notified its national identity card at the highest eIDAS assurance level, and LuxTrust products stay widely used for banking and public service logins. A flow built on one route alone loses the applicants who reach for the other one.
Almost Half Your Applicants Carry a Foreign Document
Foreign nationals make up close to half of Luxembourg residents, and they arrive from right across the EU and well beyond it. A single onboarding flow has to read a Luxembourg carte d'identité, a Portuguese passport and a French residence card without losing completions.
Names Arrive in Three Languages and Two Forms
Luxembourgish, French and German all appear on official documents, and a Luxembourg surname can be two names joined by a space in either order. A naturalised citizen keeps the name borne under the law of their former country, so one person carries two lawful name forms.
Ownership Is Registered But Not Open
The Registre des Bénéficiaires Effectifs is no longer open to the general public. Professionals under the Law of 12 November 2004 reach it on registration with Luxembourg Business Registers. An RCS extract proves a company exists, not who controls it.
Regulatory Update
What AMLR Changes for Identity Verification in Luxembourg
The EU Anti-Money Laundering Regulation (EU) 2024/1624 applies directly in Luxembourg from 10 July 2027, so the Regulation itself needs no transposition law. It sets the due diligence rules the Law of 12 November 2004 will operate under, with AMLA, the new EU-level supervisor, established in Frankfurt.
Timeline
- End of 2026 Member State wallet issuance target
- 10 July 2027 AMLR applies, no transposition
- Dec 2027 Private relying parties using strong user authentication, excluding micro and small firms, must accept EU wallets on a user's request. eIDAS Art. 5f(2); 36 months from the implementing acts' entry into force.
- 2028 AMLA direct supervision begins
eIDAS Becomes an Explicit Route
Article 22(6) gives obliged entities two equal means, an identity document or passport with reliable independent sources, or eIDAS electronic identification at substantial or high plus relevant qualified trust services. Luxembourg notified its eID scheme at level high, so that route is open today.
The Ownership Test Tightens
AMLR sets the beneficial-ownership test at 25% or more under Article 52(1), and control can also confer it, so RCS and RBE records plus KYB checks should confirm both.
Existing Customers Get Re-Checked
Existing records must be brought up to standard, not just new onboarding. Article 26(2) caps updates at one year for higher-risk customers and five years for others.
Accountability Stays With You
Article 18 keeps customer due diligence accountable with the obliged entity even when verification is outsourced, and Article 3-3(2) of the Law of 12 November 2004 already leaves ultimate responsibility with the professional.
FOR CSSF-SUPERVISED BUSINESSES
Streamline CSSF-Supervised Onboarding in Luxembourg
Connect identity verification, QES, Penny Drop and compliance evidence in one configurable workflow for businesses operating within the supervisory remit of the CSSF. Reduce customer drop-off and manual handovers while giving compliance teams a review-ready record of every decision.
1. Verify the customer
Verify identity using the configured route, such as the notified Luxembourg eID, NFC chip reading of the carte d'identité, attended video identification or document and biometric checks.
2. Complete qualified signing
Apply and validate the QES within the same journey, keeping the signed document, verification result and supporting evidence together.
3. Confirm the payment account
Penny Drop Verification confirms the account belongs to the customer, supporting the first-payment measure in Article 27 of CSSF Regulation N° 12-02.
Shufti's IDV/KYC Solutions for Luxembourg
KYC Solutions
Clear onboarding for Luxembourg customers under the Law of 12 November 2004, with age and address checked in the same flow as identity, each check completing in seconds.
Explore MoreIdentity Verification
Shufti confirms every customer is real and present, not a spoofed or synthetic identity. Biometric face matching and liveness detection run against 10,000+ actively processed document types.
.Face Verification
Face verification binds the live person to the document with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness, stopping spoofs, masks and deepfakes.
.Age Verification
Selfie-based age estimation combined with document verification fallback where higher assurance is required, such as online gambling and other age-restricted services.
.Address Verification
Shufti verifies Luxembourg address-bearing documents, including energy invoices, telecom bills and bank statements from major Luxembourg issuers.
.Document Verification
Verification of the Luxembourg carte d'identité, the biometric passport, the titre de séjour and the permis de conduire, including NFC chip reading on the identity card, the residence permit and the ePassport.
.Bank Account Verification
Confirms a Luxembourg bank account (LU IBAN) belongs to the customer, returning the registered account holder name for matching against the verified identity.
.KYB Solutions
The Law of 12 November 2004 requires risk-based checks on the business and on the people behind it. Shufti checks RCS records, beneficial ownership and VAT details in real time, then screens UBOs against 4,000+ global watchlists for sanctions and adverse media exposure.
Explore MoreBusiness Verification
Automated validation of Registre de Commerce et des Sociétés data held by Luxembourg Business Registers, the RCS number in its section-letter and digits form such as the B series for commercial companies, the VAT number in the LU plus eight digits format, and the directors entitled to bind the entity.
.Enhanced Due Diligence (EDD)
Risk profiling for complex ownership chains and higher-risk sectors, with PEP screening covering the Chambre des Députés and source of wealth checks.
.AML Screening
Shufti screens customers and transactions in 240+ countries and territories, flagging sanctions, PEP, and adverse media matches as they happen. Ongoing monitoring surfaces suspicious activity in time to meet local reporting obligations.
Explore More
AI Compliance Copilot
Helps compliance teams review verification and AML data, investigate alerts, and understand the reasoning behind risk signals. It brings relevant case information together to support faster, more consistent compliance decisions.
.
Transaction Monitoring
Ongoing transaction monitoring calibrated to Luxembourg financial flows flags anomalies against AML rules, supporting the controls expected by the CSSF and the Cellule de Renseignement Financier.
.Supported Verification Methods for Luxembourg
Every Verification Route Luxembourg Uses, in One Platform
Shufti supports the full range of remote verification routes used in Luxembourg, from the notified Luxembourg eID and NFC chip reading to attended video identification, with the EU Digital Identity Wallet supported once it goes live. Each method below shows what is live today and what is ready for the 2027 rollout.
EUDI Wallet
Wallet-ready · from 2027AMLR Article 22(6) points to electronic identification means at the eIDAS substantial or high levels, which is the route the EU Digital Identity Wallet falls under. Shufti is built to accept wallet-based verification as the Luxembourg wallet goes live.
Notified eID
LiveeIDAS HighThe Luxembourg national identity card is the country's only notified eID, published on 7 November 2018 at eIDAS level high, used through GouvID, the state app reading the card over NFC. Shufti verifies it today, alongside LuxTrust, outside that scheme.
Docless Database eIDV
LiveDatabase-driven verification confirms identity in seconds for low-risk onboarding, with no document upload. Shufti confirms which sources are available for Luxembourg at scoping and escalates as risk rises.
NFC Chip Verification
LiveShufti reads the secure chip in the Luxembourg carte d'identité, the biometric passport and the titre de séjour. Chip reading gives the strongest document-based assurance where an eID session is not available.
Document and Face Biometric
LiveA route named in AMLR Article 22(6)(a). Document authentication of the carte d'identité, the biometric passport, the titre de séjour and the permis de conduire, paired with iBeta Level 3 Conformance to ISO/IEC 30107-3 liveness to confirm a real, present person.
Video Identification
LiveArticle 18(1) of CSSF Regulation N° 12-02 accepts any secure remote identification process the national authorities accept, and a CSSF FAQ sets the conditions. A trained operator runs a live video session, checks the document security features on camera, and verifies a one-time code the customer states during the session.
Qualified Electronic Signature
LiveArticle 18(1) of CSSF Regulation N° 12-02 accepts relevant qualified trust services under Regulation (EU) 910/2014. Shufti runs eIDAS-qualified signing powered by Evrotrust, an EU qualified trust service provider, producing PAdES-LTV signatures. For Luxembourg the signing check runs through NFC and face biometrics.
Independent Validation
Shufti's Recognition Across Independent Evaluations

Ranked Exceptional in the Liminal Index 2026 for age estimation
View Report
Differentiated by Gartner on document diversity and country coverage
Read more
Certified at iBeta Level 3 PAD with 0% APCER
Read Blog
Broadest global reach in the 2025 KuppingerCole Extended IDV report
Download Report
Ranked Top 5 in the DHS RIVR 2025 for identity validation
Read Blog
Top Vendor for Product Execution in the Liminal Index for KYC 2026
View Report
Ranked Exceptional for age verification by Liminal Index 2026
View Report
Recognised as a Leader in G2 Fall 2026 reports
Read MoreEvidence-Ready Checks Across People & Businesses
Verifications with robust evidentiary support
Individual Documents We Verify
Shufti verifies 5+ individual Luxembourg documents.
View All Supported DocumentsCarte d'Identité (Luxembourg National Identity Card)
Compulsory from age 15 for Luxembourg nationals habitually resident in a commune, under Article 15(1) of the Law of 19 June 2013. Its contactless chip carries optional authentication and signature certificates, which make it the notified Luxembourg eID.
Passeport Biométrique (Luxembourg Biometric Passport)
ICAO-compliant biometric passport issued by the Bureau des passeports, visas et légalisations at the Ministry of Foreign and European Affairs. Its contactless chip holds the digital facial image, so Shufti reads the chip, not just the printed page.
Permis de Conduire (Luxembourg Driving Licence)
EU-format photocard licence issued through the Service des permis de conduire at the Société Nationale de Circulation Automobile. Article 18(1) of CSSF Regulation N° 12-02 names the driving licence among the valid official identification documents, so Shufti verifies it as identity evidence.
Entity Identity
RCS Registration Extract
Registre de Commerce et des Sociétés record held by Luxembourg Business Registers. It evidences legal existence, legal form, registered office and the persons appointed to manage and represent the entity in the KYB file.
Articles Of Association
Coordinated articles filed with the register and published through RESA. Shufti reconciles signing authority against the register so director, shareholder and signatory records stay complete for audit and refresh cycles.
Tax Identity
VAT Registration Certificate
Luxembourg VAT identification issued by the AED, carrying the LU prefix ahead of an eight-digit number. Shufti validates it to confirm invoice-facing identity during KYB.
Tax Identification Number (Matricule)
The national identification number allocated under the Law of 19 June 2013, thirteen digits for a natural person and held in the electronically readable data on the identity card. Shufti attaches it to the file and re-checks it on the refresh cycle.
Ownership & Control (UBO)
Register Of Beneficial Owners (RBE) Extract
Declared beneficial owners and the nature and extent of the interests held,filed under Articles 4(1) and 8(1) of the Law of 13 January 2019. A change must be filed within one month, and anyone with register access must report a discrepancy within 30 days.
Languages We Cover
Multilingual Document Handling
The Luxembourg identity card carries its title in French, English and German, and names the issuing state in Luxembourgish as well. Shufti extracts each form and preserves accented characters in the audit record.
Name Matching Controls
A Luxembourg double surname is two names joined by a space with no hyphen and no fixed order, and a naturalised citizen keeps the name borne under foreign law. Matching resolves both orders and both name forms to one person.
Regulatory Text Consistency
Luxembourg legislation is authentic in French while administrative dealings run in French, German or Luxembourgish. Shufti keeps identity data linked across document checks, face verification and screening outputs, so a CSSF inspection is answered from one file.
Governance & Controls
Audit-Ready Decisions, Lower Operational Drag
Fewer avoidable re-submissions
Capture tuned to the Luxembourg carte d'identité, biometric passport and titre de séjour designs in circulation, plus NFC chip reading, cuts re-uploads and manual review.
Cleaner audit trails
Structured logs aligned to Article 3(6) retention and goAML reporting keep every decision ready for inspection.
Better name matching outcomes
Matching handles French, German and Luxembourgish spellings of the same name, unhyphenated double surnames and the particles common in Luxembourg records, reducing false positives.
One workflow, one back office
KYC, KYB and AML screening are consolidated in one operational case view, so one back office team works on every customer file.
National ID-first flow design
Flows lead with the Luxembourg carte d'identité and its eID for residents, then fall back to passports and titres de séjour for cross-border workers and foreign nationals.
Continuous Compliance
Compliance that does not stop at onboarding
AMLR treats customer due diligence as a continuing obligation. Perpetual monitoring keeps the customer picture current between reviews, so risk is caught when it appears, not at the next annual check.
Surface Changes as it happens
DetectPerpetual monitoring flags risk when it appears, not at the next annual review. Behavioural biometrics, background fraud signals, and ongoing sanctions and PEP screening watch every active relationship.
Step up when the signal fires
VerifyWhen a signal fires, re-verification confirms the person or the ownership change using the same live methods above, so a flag turns into a resolved decision.
Keep the file audit-ready
ComplyEvery check and decision is logged to the record-keeping standard in Article 3(6) of the Law of 12 November 2004, so the file is organised and retrievable for supervisory review.
Perpetual KYC
pKYCKeeps individual customer risk current with behavioural biometrics, background fraud signals and ongoing AML screening, so back-book records stay standard-ready.
Perpetual KYB
pKYBMonitors Registre de Commerce et des Sociétés filings and Registre des Bénéficiaires Effectifs records for shareholding and control changes, so a shift past 25% or a change of control is caught between reviews.
Built To Fit Luxembourg's Compliance Landscape
Commission de Surveillance du Secteur Financier (CSSF)
AML and CFT supervisor for the professionals it supervises, authorises or registers under Article 2-1(1) of the Law of 12 November 2004, including credit institutions, investment firms, fund managers, payment institutions and crypto-asset service providers. Shufti aligns identity evidence, risk classification logs and ongoing monitoring to CSSF Regulation N° 12-02.
Cellule de Renseignement Financier (CRF)
Luxembourg's financial intelligence unit, placed under the administrative supervision of the Procureur général d'État. It receives suspicious transaction reports through goAML. Decision audit trails, hit rationale and escalation logs support reporting.
Commission Nationale pour la Protection des Données (CNPD)
Supervises GDPR in Luxembourg. Data minimisation, lawful-basis processing and EU-region hosting keep Luxembourg personal data handling defensible, and the CSSF recommends clearing remote identification processes with the CNPD on the data protection side.
Administration de l'Enregistrement, des Domaines et de la TVA (AED)
Issues VAT identification numbers and acts as the residual AML supervisor under Article 2-1(8) of the Law of 12 November 2004, covering real estate agents, dealers in goods, art dealers and gambling operators. Shufti attaches VAT evidence to company files.
Ministry of Justice, Directorate for Combating Money Laundering and Terrorist Financing
Coordinates national AML and CFT policy, represents Luxembourg at FATF and runs the executive secretariat of the prevention committee created by the Law of 4 December 2024. Shufti supports risk-based-approach documentation and record retention.
Ministry of Finance, International Financial Sanctions
The Minister of Finance is the competent authority for financial restrictive measures under the Law of 19 December 2020, including derogation authorisations. Screening covers EU and UN designations applied in Luxembourg alongside national measures.
AMLA (EU Anti-Money Laundering Authority)
The new EU-level supervisor has been established in Frankfurt since July 2025. It begins direct supervision of selected credit and financial institutions with high residual risk operating cross-border
Deployment Option
Cloud in EU regions or on-premise hosts Luxembourg customer data in-region and supports GDPR accountability. Deployments use nearby EU regions or local providers.
Regulatory Alignment
Supports the due diligence, beneficial ownership and record-keeping duties in the Law of 12 November 2004, CSSF Regulation N° 12-02, GDPR, and AMLR from 10 July 2027. Shufti is a data processor, not a legal adviser; due diligence and the choice of method stay with the obliged entity under Article 3-3(2).
Retention Controls
Article 3(6) of the Law of 12 November 2004 sets a five-year minimum after the relationship ends or the transaction occurs; data must then be deleted, though a supervisor may require five more years. From 10 July 2027, AMLR Article 77 applies a five-year baseline.
Encryption & Security
Encryption in transit and at rest, with access controls and audit logging, supports Article 32 GDPR obligations, under our ISO 27001 certification.
Data and Privacy Controls in Luxembourg
Luxembourg AML Sources That Strengthen Decisions
We screen against 215+ sanction regimes, 4,000+ watchlists, 100,000+ adverse-media sources, and 6M+ PEPs across Luxembourg and globally. A few of them are:
Commission de Surveillance du Secteur Financier (CSSF)
Cellule de Renseignement Financier (CRF), the FIU
Commissariat aux Assurances (CAA)
Administration de l'Enregistrement, des Domaines et de la TVA (AED)
Luxembourg Business Registers (RCS)
Registre des Bénéficiaires Effectifs (RBE)
Ministry of Finance, international financial sanctions
Grand Ducal Police, Judicial Police (financial crime)
Ordre des Avocats du Barreau de Luxembourg
AML Law of 12 November 2004 (as amended), via CSSF
EU Consolidated Financial Sanctions List
UN Security Council Consolidated Sanctions List
Financial Action Task Force (FATF)
EU Authority for Anti-Money Laundering (AMLA)
European Banking Authority (EBA)
SEE SHUFTI IN YOUR LUXEMBOURG WORKFLOW
Turn Luxembourg Verification Requirements into a Smoother Customer Journey
Share your customer types, risk rules and current onboarding process. A Shufti specialist will show you how to connect identity verification, KYB, QES, Penny Drop and ongoing monitoring, reducing operational hand-offs while keeping decision evidence organised for compliance review.
Frequently Asked Questions
Which identity documents can be used for KYC in Luxembourg?
Article 18(1) of CSSF Regulation N° 12-02 names the passport, the identity card, the residence permit and the driving licence as valid identification documents. Customers can use the Luxembourg carte d'identité, the biometric passport, the titre de séjour or the permis de conduire, and Shufti verifies all four in one workflow.
How does Shufti support CSSF-supervised businesses?
Shufti connects identity verification, KYB, AML screening, QES, account verification and decision evidence in one configurable workflow. The CSSF is the AML supervisor for banks, investment firms, fund managers, payment institutions and crypto-asset service providers, and the workflow gives those firms standardised records and clearer evidence for review.
What documents are required for KYB in Luxembourg?
Typically an RCS extract from Luxembourg Business Registers, the coordinated articles of association, a VAT registration record from the AED and the beneficial ownership record held in the Registre des Bénéficiaires Effectifs. Shufti verifies these in real time and screens the UBOs behind them against sanctions and PEP lists.
How are Luxembourg name variants handled in screening?
Luxembourg records carry French, German and Luxembourgish spellings of the same name, and a Luxembourg double surname is two names joined by a space with no hyphen and no fixed order. A naturalised citizen keeps the name borne under the law of their former country. Matching resolves these variants together and keeps false positives down.
How long must AML records be retained in Luxembourg?
Five years. Article 3(6) of the Law of 12 November 2004 requires customer due diligence records, transaction records and business correspondence to be kept for five years after the business relationship ends or the occasional transaction is carried out. A supervisory authority may require a further period of up to five years in specific cases.
Is EU-region data hosting available for Luxembourg customer data?
Yes. Shufti offers EU-based cloud regions, so Luxembourg customer data stays in-region in line with GDPR as supervised by the Commission Nationale pour la Protection des Données. On-premise deployment is available where residency requirements are stricter.
What changes for Luxembourg under AMLR from July 2027?
Article 22(6) gives obliged entities either a document-based route or eIDAS electronic identification means and qualified trust services, and the beneficial ownership test moves to 25% or more under Article 52(1).
How do QES and account verification work together in Luxembourg?
Where a customer is not physically present and the guarantees in Annex IV(2)(c) to the Law are absent, Article 27 of CSSF Regulation N° 12-02 requires compensating measures. One is a first payment through an account in the customer's name at an institution subject to the Law or equivalent obligations. Shufti connects QES, account verification and evidence in one workflow.
When will the EU Digital Identity Wallet be usable for onboarding in Luxembourg?
Under eIDAS 2.0, member states target wallet issuance from end 2026. Private relying parties using strong user authentication, excluding micro and small firms, accept wallets on a user's request. Luxembourg has not published a launch date for its national wallet. Shufti is built to accept wallet-based verification as the Luxembourg wallet goes live.
Can we keep using video identification in Luxembourg after July 2027?
Yes. AMLR does not mention video identification, so the route continues to rest on national rules. In Luxembourg that route rests on Article 18(1) of CSSF Regulation N° 12-02 and the CSSF FAQ on customer onboarding and KYC methods.
Let’s Build Trust Into Your Business
1B+Verifications Processed
240+Regions Actively Processed
99.7%Accuracy Rate
Samer Al Tamimi
CEO of Safwa Bank
“We take our client’s privacy very seriously and always look for new innovative solutions to ensure a safe banking experience. Working with Shufti feels like a breath of fresh air, as their 100% in-house tech keeps our customer’s data free from vulnerabilities and fully safe and protected.”
Trusted. Compliant. Certified
Explore Shufti For Your Business
Get a personalised demo from our experts.
PROVEN PLAYBOOKS
Explore Practical KYC & AML Resources
10 July, 2026
Identity Verification in Europe: eIDAS 2.0 & EUDI Wallet
A practitioner's guide to verifying identity in Europe, covering eIDAS 2.0, the EUDI Wallet, docless eIDV and how to choose an eID provider for onboarding in the EU.
Product Guide





