Luxembourg has completed its first ML/TF vertical risk assessment on virtual asset service providers (VASPs). The legitimacy of usage of virtual assets (VAs) for investments and transactions has increased in the recent years. However, VAs are susceptible to ML/TF by criminals. This is an important challenge that impacts VASPs, financial institutions and law enforcement agencies alike.
Luxembourg’s National Risk Assessment (NRA)s in 2018 and 2020 had identified VAs as an emerging and evolving risk. The present vertical risk assessment comprehensively discusses the different types of VAs and VASPs and the ML/TF threats they pose. It further specifies the predicate offences that VAs can enable, including drug trafficking and fraud. The risk assessment identifies the inherent risk of 8 types and sub-types of Vas and discusses the mitigating measures that VASPs must implement to reduce ML/TF risk.
The risk assessment further mentions the different measures that Luxembourg’s authorities have implemented in this regard. For example, the Commission de Surveillance du Secteur Financier (CSSF) has issued two general warnings on VAs and VASPs. It has also developed internal capabilities for AML/CFT supervision of VASPs. Other authorities have taken similar measures. The risk assessment also provides a list of legal obligations for the VASP private sector. It further enlists more than 40 VA-related red flag indicators.