PwC Warns Luxembourg Risks Falling Behind on EU AML Rules

On Tuesday 19 May 2026, PwC Luxembourg released its EMEA AML Survey 2026 which examines how financial institutions are preparing for the EU Anti-Money Laundering (AML) Package ahead of the July 2027 implementation deadline.

The report highlights a widening gap between firms’ confidence in their AML frameworks and the concrete actions taken to prepare for upcoming regulatory changes.

The survey aims to assess the operational readiness of Luxembourg financial institutions as the EU introduces what PwC describes as the “most far-reaching” reform of Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT) regulation in the European Union (EU)’s history.

The package introduces a single EU rulebook, stronger supervisory powers through the Anti-Money Laundering Authority (AMLA) and strict implementation deadlines. 

According to the survey, 59% of respondents have not yet fully analysed the impact of the EU AML Package, while 42% have no plans to update their AML operating model in Luxembourg. In addition, 40% of firms still rely on fully manual risk assessments and 59% use no digital tools to detect forged or fraudulent documents. 

The report noted that Luxembourg is entering this transition from a strong position due to its mature AML frameworks, experience in cross-border supervision and “established compliance culture”. However, PwC stated that the findings reveal increasing tension between this confidence and the level of concrete action firms have taken to prepare for the new framework.

Three quarters of Luxembourg respondents expect the EU AML Package to have at least a medium impact on their operations, implying a reallocation of AML resources of 5% or more. Despite this expectation, only a minority of institutions have completed a full impact assessment and Luxembourg ranked as the least active EU country in updating AML operating models.

Based on responses from a highly representative sample of Luxembourg financial institutions and benchmarked against EU and international peers, the report highlights where Luxembourg is well positioned and where inaction, underinvestment and overreliance on manual processes may expose firms to regulatory, operational and strategic risk as the July 2027 deadline approaches.

Further the report stated that Luxembourg institutions widely acknowledge that the EU AML Package will have a material impact on their operations. Despite this, many firms have yet to translate awareness into concrete preparation.

Only a minority of Luxembourg respondents have conducted a full impact assessment and Luxembourg ranks as the most inactive EU country in terms of updating AML operating models. The report warned that this gap between perceived impact and action suggests a risk of overconfidence, compounded by reliance on group-level instructions and “wait-and-see” strategies.

PwC added that with regulatory scrutiny increasing and hard deadlines approaching, delayed decision-making may significantly constrain firms’ ability to adapt smoothly and cost-efficiently.

Regarding operational pressure points, the report stated that the EU AML Package does not represent a complete overhaul for Luxembourg, but rather a series of targeted yet impactful changes. The survey identifies Customer Due Diligence (CDD) onboarding and periodic reviews as the controls most affected by the new framework.

Despite this awareness, alignment with the CDD regulatory technical standards remains limited and remediation efforts are predominantly planned in-house, even as many firms report no intention to increase headcount or outsource activities. In parallel, risk assessment and fraud prevention processes remain highly manual compared with EU peers.

PwC warned that these factors create a cumulative operational risk, with incremental regulatory changes potentially triggering significant strain on already stretched AML functions if left unaddressed.

The report also identified technology and data readiness as critical weaknesses in the Luxembourg market. Firms reported strong concerns around data collection and reporting requirements, yet continued underinvestment in digital tools. On average, Luxembourg firms allocate less of their AML budget to technology than EU peers and investment in artificial intelligence (AI) for AML has declined further since 2024.

While some institutions are exploring the use of AI, adoption remains cautious and focused on relatively basic solutions. Advanced use cases, particularly for transaction monitoring and fraud detection, remain limited. At the same time, many firms expressed confidence in systems that still rely heavily on manual processes.

Claude Marx, Director General, Commission de Surveillance du Secteur Financier (CSSF) said:  “It is urgent for Luxembourg entities to get educated about the possibilities that technology offers to make AML/CFT future-fit and live up to expectations of recent regulatory requirements. Besides fulfilling regulatory expectations and safeguarding the entities’ reputation, the increased use of modern technology in compliance also allows entities to operate at scale without slowing legitimate customer activity, which is increasingly becoming a concern for bona fide customers.”

Michael Weis, Advisory Partner, Forensics & Anti-Financial Crime Leader, PwC Luxembourg added: “The question for Luxembourg firms is no longer whether change is required, but how decisively and how early they choose to act.”

To read the full report, visit https://www.pwc.lu/en/financial-crime/anti-money-laundering/lux-aml-survey-2026.html.