Administrative sanction of 5 March 2026

Administrative sanction of 5 March 2026 for non-compliance with professional obligations related to anti-money laundering / counter financing of terrorism Luxembourg, 09 June 2026 Administrative decision On 5 March 2026, further to an on-site inspection on the professional obligations related to anti- money laundering and counter financing of terrorism (“AML/CFT”), the CSSF imposed an administrative fine amounting to EUR 56,000 (fifty-six thousand) on Stonehage Fleming Luxembourg S.A. (the “PFS”), authorised as a specialised PFS in accordance with the provisions of Articles 25, 28-6, 28-9, 28-10, 29-1 and 29-2 of the amended Law of 5 April 1993 on the financial sector (“LFS”), representing approximately two percent (2%) of its total annual turnover as of 31 March 2022 adjusted for the purpose of the calculation. Legal framework/motivation The administrative fine was imposed by the CSSF pursuant to the provisions of Article 2-1(1) of the Law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (“AML/CFT Law”) read in conjunction with the provisions of Article 8-4(1), (2) point (f) and (3) point (a) of the AML/CFT Law for non-compliance with AML/CFT professional obligations. In order to determine the type and amount of the administrative sanction, the CSSF duly took into account all the legal and factual elements set out and discussed as part of the contradictory procedure, including the gravity and duration of the breaches existing at the time of the on-site inspection, the financial situation of the legal person held responsible for the breach in accordance with the provisions of Article 8-5(1) of the AML/CFT Law. The CSSF also considered the limited scope of the on-site inspection as well as the fact that the PFS has acknowledged the findings and observations, has provided a general action plan and initiated corrective measures after the on-site inspection in order to remedy the breaches detected. The professional obligations of the PFS in relation to which the breaches were observed are namely quoted in the relevant provisions of: • the AML/CFT Law; • the amended Grand-ducal Regulation of 1 February 2010 (“AML/CFT Grand-ducal Regulation”) providing details on certain provisions of the AML/CFT Law; and • CSSF Regulation No 12-02 of 14 December 2012, as amended, on the fight against money laundering and terrorist financing (“CSSF Regulation No 12-02”) which constitutes an implementing measure of the AML/CFT Law in their version applicable at the time of the on-site inspection. ADMINISTRATIVE SANCTION 1/4 Legal bases for the publication This publication is made on a nominative basis in accordance with the provisions of Article 8-6(1) of the AML/CFT Law, the CSSF having considered that none of the legal exceptions provided for under this provision applies. Context and major cases of non-compliance with the professional obligations identified This administrative fine is the result of an on-site inspection carried out by the CSSF on the PFS between March 2023 and June 2024 covering the domiciliation activity of the PFS and more specifically the customer due diligence measures name screening controls and cooperation with the authorities. During the on-site inspection, the CSSF identified important breaches by the PSF of its professional obligations in relation to AML/CFT which related in particular to the following points: • Although the PFS had identified indicators that generated suspicions of money laundering / associated predicate offence in four cases based on adverse media detected in relation with potential corruption, or drug trafficking, prior to the on-site inspection, it did not sufficiently investigate the adverse elements it had identified to exclude suspicions and filed Suspicious Activity Report / Suspicious Transaction Report (“SAR/STR”) to the Financial Intelligence Unit (“FIU”) only following queries of the CSSF at the time of the on-site inspection, which constitutes late declarations. In addition, those declarations were too brief and incomplete as they did not include all key indicators of suspicions detected by the PFS nor the relevant supporting documentation. Furthermore, the PFS failed to submit declarations to the FIU in six cases despite indicators of money laundering related to corruption, bribery and primary tax offences. Those cases constitute a breach of the obligations foreseen in Article 5(1) point (a) of the AML/CFT Law to inform promptly and on its own initiative the FIU when there are reasonable grounds of suspicion of money laundering or an associated predicate offence and to include in the report all relevant supporting information and documents. • On 1 February 2022, the PFS took over a number of clients from another Luxembourg domiciled PFS (“the former PFS”). Although two regulatory due diligence assessments had been conducted by a third-party service provider prior to the takeover highlighting major deficiencies with regards to the former PFS’ clients, it neglected to implement measures to ensure efficient and adequate remediation. As a result, breaches were observed with regards to insufficient customer due diligence measures at the time of the takeover, lack of enhanced due diligence measures in the presence of high risk indicators for two clients of the former PFS, insufficient information on the source of funds for two clients and insufficient due diligence measures to reasonably exclude the risk related to the laundering of money resulting from a predicate tax offence for three clients. The lack of adequate customer due diligence measures applied to the clients of the former PFS constitute a breach of the obligation foreseen in Article 3(1) of the AML/CFT Law requiring professionals to apply such measures when establishing new business relationship, such as the takeover of a client portfolio but is also the root cause of the other above-described AML/CFT breaches related ADMINISTRATIVE SANCTION 2/4 to clients of the former PFS. Such cases illustrate the importance for professionals to adequately assess money laundering and terrorist financing risks related to the takeover of a client portfolio to enable them to implement an appropriate remediation plan. • The CSSF identified that the PFS had accumulated significant delays in processing alerts relating to customer screening against lists of persons subject to restrictive measures in financial matters, lists of Politically Exposed Persons (“PEPs”) and the detection of persons subject to adverse media. At the time of the on-site inspection, hundreds of name screening alerts had been treated with significant delays and 42 alerts remained unnoticed by the PFS. These delays constitute a breach of the obligations foreseen in Article 3(2) point (d) of the AML/CFT Law and in Article 33(1) of CSSF Regulation No 12-02, as the PFS was unable to identify “without delay” persons subject to restrictive measures in financial matters and therefore apply “without delay” potential restrictive measures in financial matters as the case may be. The delay in processing PEP alerts (and thus the lack of detection of these persons) also prevented the identification of those persons and the application of enhanced due diligence measures, as the case may be, which constitutes a breach of the obligations foreseen in Article 3-2(4) point (a) of the AML/CFT Law, Article 3(4) of the AML/CFT Grand- ducal Regulation and in Article 30(1) of CSSF Regulation No 12-02. Alerts concerning adverse media about certain business relationships being analysed late by the PFS also breached the obligations foreseen in Article 39(5) of CSSF Regulation No 12-02 requiring that the monitoring system enables the necessary measures to be taken rapidly where elements that could reasonably indicate the presence of suspicious behavior or suspicious activity impacting the PFS are identified. In addition, the CSSF identified that some alerts generated were closed based on incorrect analysis, hence constituting a breach of the obligations foreseen in Article 39(3) and (5) of CSSF Regulation No 12-02 requiring professionals to conduct appropriate investigation and rapidly take the necessary measures in the presence of suspicious behavior or suspicious activity and duly document those investigations. • Client data used for name screening purpose was input by an entity of the group in Switzerland without regular controls on completeness and correctness of the client data performed by the PFS on this outsourced task. This constitutes a failure to comply with the provisions of Article 37(2) of CSSF Regulation No 12-02 which foresee that in accordance with the risk-based approach, the regular control shall ensure that the professional is provided with means to test and to monitor regularly and occasionally compliance with the obligations incumbent upon the third-party delegate. Furthermore, data changes related to clients of the former PFS, for which a separate database was used until full remediation, did not follow the 4 eyes principles and no second level review was performed. The absence of such review could lead to incorrect and incomplete client database and constitutes a failure to comply with the provisions of Article 42(5) of CSSF Regulation No 12-02 requiring professionals to regularly verify the controls carried out by the first line of defence to ensure compliance with the AML/CFT policy. • The CSSF finally identified that a number of client data was either missing or incorrect in the PFS’ own existing client database and in the former PFS’ client database. The two databases ADMINISTRATIVE SANCTION 3/4 were considered incomplete, thus constituting a breach of the obligations foreseen in Article 39(2) of CSSF Regulation No 12-02 requiring professionals to have a complete customer database and in Article 4(3) of the AML/CFT Law requesting the professionals to be able to answer to the requests of the competent authorities, which cannot be done if the database is not complete. Such missing data may also lead the PFS to non-detection of a potential hit, hence constituting a breach of the obligations foreseen in Article 39(1) of CSSF Regulation No 12-02 requiring professionals to implement control mechanisms that allow them to be able to identify, without delay, persons subject to restrictive measures in financial matters. This further constitutes a breach of the obligations foreseen in Article 47 of CSSF Regulation No 12-02 requiring professionals to be able to respond promptly to a request from the competent authorities asking whether it had a business relationship with a specific person. ADMINISTRATIVE SANCTION 4/4