CSSF Circular 21/788: the AML/CFT external report, who files it and when
By the RC Insight team, practitioners who have helped more than 80 fund promoters set up their AML/CFT framework since 2020.
Published Last reviewed: 10 min read
CSSF Circular 21/788 of 17 December 2021 requires an annual AML/CFT external report, prepared by the réviseur d'entreprises agréé and filed via eDesk within six months after year-end. It concerns Luxembourg investment fund managers (IFMs) and self-managed CSSF-supervised funds: funds that have appointed an IFM, established in Luxembourg or abroad, are exempt.
The réviseur writes the report, and the RC is one of the persons who may submit it on eDesk. In our view, the RC should also gather the documents the réviseur needs and prepare the entity's comments on the results. This guide covers scope, content, deadlines and the open question raised by the latest filing season. For how the report fits with the SRRC and the AED filings, see our guide to annual AML/CFT reporting for Luxembourg funds.
Key takeaways
- CSSF Circular 21/788 requires an annual AML/CFT external report, prepared by the réviseur d'entreprises agréé and filed via eDesk within six months after year-end.
- It concerns Luxembourg IFMs and self-managed CSSF-supervised funds: funds that have appointed an IFM, established in Luxembourg or abroad, are exempt.
- An entity that must have its annual accounts audited appoints the same REA; an entity without that legal requirement must mandate a REA for this specific purpose.
- In our practice, the report was filed in 2026 for the registered AIFMs we follow, but the corroboration section was not performed because the CSSF replaced its questionnaire with the AMLA templates.
- The report is submitted only via eDesk, by the RC, the RR or a board member, under the board's responsibility.
On this page
- Who must file the 21/788 external report, and who is exempt
- Who prepares the report: the réviseur d'entreprises agréé
- What the 21/788 external report contains
- The corroboration section and the AMLA templates
- Deadline and eDesk submission: the calendar by year-end
- The RC's role: documents, comments and eDesk submission
- What happens if the report is not filed
- How RC Insight helps
- FAQ
- Sources
Who must file the 21/788 external report, and who is exempt
The 21/788 external report concerns Luxembourg IFMs and self-managed CSSF-supervised funds. Funds that have appointed an IFM, established in Luxembourg or abroad, are exempt under section 1.2 of the circular. Luxembourg IFMs include UCITS management companies, authorised AIFMs and registered AIFMs.
| Entity | 21/788 external report | Why |
|---|---|---|
| Luxembourg IFM: UCITS management company, authorised AIFM or registered AIFM | Files the report | The circular concerns Luxembourg IFMs, including registered AIFMs |
| Self-managed fund supervised by the CSSF | Files the report | In scope as a self-managed CSSF-supervised fund |
| CSSF-supervised fund with a Luxembourg IFM | Exempt | Exempt under section 1.2; its auditor must still perform AML work under Article 49(1) of CSSF Regulation 12-02 |
| CSSF-supervised fund with a foreign IFM | Exempt | Files its own SRRC, but has no 21/788 external report to file |
| RAIF or other AIF supervised by the AED | Not in scope | Supervised for AML/CFT by the AED, not by the CSSF |
Does a fund with a ManCo need a 21/788 report?
No: a fund that has appointed an IFM, established in Luxembourg or abroad, is exempt under section 1.2 of Circular 21/788. A Luxembourg IFM is itself in scope of the circular. The exemption does not end the auditor's AML work: for exempt funds, the external auditor must still perform AML work under Article 49(1) of CSSF Regulation 12-02, and significant deficiencies are reported in management letters.
A fund with a foreign IFM is in a different position for the SRRC: it files its own SRRC, which its foreign IFM does not, but it has no 21/788 external report to file. Our SRRC guide covers that filing.
RAIFs and other AED-supervised AIFs
A RAIF is supervised by the AED for AML/CFT even when its AIFM is CSSF-authorised: the AIFM is supervised by the CSSF, the RAIF by the AED. The RAIF is therefore outside the scope of Circular 21/788, while its Luxembourg AIFM is in scope as an IFM. The split between the CSSF and the AED is explained in CSSF or AED: who supervises your fund.
Who prepares the report: the réviseur d'entreprises agréé
An entity that must appoint a réviseur d'entreprises agréé (REA) to audit its annual accounts appoints the same REA to prepare the external report. An entity without that legal requirement must mandate a REA for this specific purpose. We recommend that registered AIFMs check early which of these cases applies to them. The REA answers questions that are in principle closed, which do not result in an opinion under audit, assurance or agreed-upon-procedures standards. Sample sizes are set by the CSSF on a risk basis.
In our view, this makes the report closer to a structured set of answers and test results than to a narrative audit report. Where the same firm audits the accounts, we recommend agreeing the AML/CFT fieldwork and its timetable when the audit is planned.
What the 21/788 external report contains
The report has a section corroborating the entity's answers to the CSSF annual AML/CFT online survey and a section on sample testing or specific work. Both the REA and the entity may comment on the results.
- Corroboration section: the REA corroborates the entity's answers to the CSSF annual AML/CFT online survey.
- Sample testing or specific work: the REA performs sample testing or specific work, with sample sizes set by the CSSF on a risk basis.
- Comments: the REA and the entity may both comment on the results.
- Management letters: significant deficiencies are reported in management letters, including for exempt funds.
We recommend that the RC records every point raised in the report or in the management letter in the findings register, with an owner, an action and a target date. For entities that file an SRRC, the findings register of the SRRC template lists the statutory auditor's management letter among its sources, and prior-period findings keep their tracking code.
The corroboration section and the AMLA templates
In our practice, the 21/788 external report was filed in 2026 (financial years 2025) for the registered AIFMs we follow. Because the CSSF replaced its Financial Crime Questionnaire with the AMLA templates that year, the section corroborating the questionnaire answers was not performed.
The background is the CSSF annual data collection. For its 2026 campaign (reference year 2025), the CSSF replaced its annual Questionnaire on Financial Crime with AMLA data-collection templates (circular letter of 12 February 2026), filed on eDesk by the RC or the RR. The corroboration section of the circular refers to the entity's answers to the CSSF annual AML/CFT online survey. The data collection itself is covered in our guide to the CSSF annual AML/CFT data collection.
An open question for the next reports
Whether auditors will be asked to corroborate the AMLA template answers in future years is an open question. We see it as a topic for discussion between RCs, réviseurs and boards. In our view, if the AMLA templates become the CSSF's yearly exercise, the CSSF could ask réviseurs to corroborate those answers.
Nothing had been published on this point at 4 October 2026. We make no forecast. In the meantime, we recommend the following precautions:
- Keep the evidence behind each AMLA template answer as if a réviseur could test it.
- Ask the REA, at the audit planning meeting, which sections the next report is expected to cover.
- Watch CSSF publications before each filing season, and update your planning when the CSSF speaks.
Deadline and eDesk submission: the calendar by year-end
The external report is due within six months after year-end and is submitted only via eDesk. Circular 21/788 applies to financial years ending on or after 31 December 2021. For the reports due in 2027 and early 2028, the six-month rule gives the following dates.
| Financial year-end | 21/788 report due (six months) |
|---|---|
| 31/12/2026 | 30/06/2027 |
| 31/03/2027 | 30/09/2027 |
| 30/06/2027 | 30/12/2027 |
| 30/09/2027 | 30/03/2028 |
We recommend entering each entity's date in the reporting calendar at the start of its financial year.
The external report is not the SRRC, which is due within five months after the closing of the annual accounts. Nor is it the CSSF annual data collection, whose dates change every year: the dates for reference year 2026 had not been published when this guide was reviewed.
The RC's role: documents, comments and eDesk submission
Under the circular, the report is submitted only via eDesk, by the RC, the RR or a board member, under the board's responsibility: the RC may submit it in its own right. The RR sits at the level of the authorised management or the board of directors. On top of the circular's rule, our internal practice is to keep every communication with the supervisors under the RR's responsibility; the RR may mandate the RC to send it.
| Step | Who |
|---|---|
| Appoint the REA | The entity: the REA that audits its annual accounts or, without that legal requirement, a REA mandated for this purpose |
| Prepare the report | The REA |
| Gather procedures, files and evidence for the REA | The RC, as the entity's contact (our recommendation) |
| Comment on the results | The entity and the REA may both comment |
| Submit on eDesk | The RC, the RR or a board member |
| Responsibility for the submission | The board |
| Follow up the deficiencies raised | The RC, through the findings register (our recommendation) |
We recommend that the RC prepares a document pack before fieldwork starts: AML/CFT procedures, the latest risk assessment, the list of due diligence files, delegate oversight records and the findings register. We also recommend that the RC drafts the entity's comments on the results and has them reviewed by the RR before submission. Where the RR mandates the RC under our internal rule, we recommend keeping that mandate in writing with the file. The circular itself does not make the RC's submission subject to a mandate.
What happens if the report is not filed
The CSSF has sanctioned non-filing. By a CSSF decision of 17 January 2024, published 14 June 2024, one AIFM was fined EUR 10,000 for not filing the 21/788 external report for year-end 31 December 2022. The same day, the CSSF reprimanded three other AIFMs; that decision is listed in the sources below. We do not name the entity that was fined. Other CSSF and AED decisions on AML/CFT filings are covered in our overview of AML/CFT sanctions for funds.
How RC Insight helps
RC Insight is software for the RC. The monitoring plan keeps each test with its evidence and follows findings to closure. The audit trail logs every action with its author and date, so you can show the board or the réviseur who did what, and when. Questionnaires to the transfer agent and other delegates go out through a secure link, and alerts and the RC calendar bring each entity's reporting dates into a single view. See our RC software page.
To prepare the next season, download the free playbook:
FAQ
What is the CSSF 21/788 external report?
It is an annual AML/CFT report prepared by the réviseur d'entreprises agréé under CSSF Circular 21/788 of 17 December 2021 and filed via eDesk within six months after year-end. It has a section corroborating the entity's answers to the CSSF annual AML/CFT online survey and a section on sample testing or specific work.
Does a fund with a ManCo need a 21/788 report?
No. Funds that have appointed an IFM, established in Luxembourg or abroad, are exempt under section 1.2 of Circular 21/788. Their auditor must still perform AML work under Article 49(1) of CSSF Regulation 12-02, and significant deficiencies are reported in management letters. The Luxembourg IFM itself is in scope.
Who prepares the 21/788 external report?
An entity that must have its annual accounts audited appoints that same réviseur d'entreprises agréé; an entity without that legal requirement must mandate a REA for this specific purpose. The REA answers questions that are in principle closed, which do not result in an opinion under audit, assurance or agreed-upon-procedures standards.
When is the 21/788 report due?
The report is due within six months after year-end, via eDesk. For year-ends on 31/12/2026, 31/03/2027, 30/06/2027 and 30/09/2027, the deadlines are 30/06/2027, 30/09/2027, 30/12/2027 and 30/03/2028. The circular applies to financial years ending on or after 31 December 2021. The SRRC, by contrast, is due within five months after the closing of the annual accounts.
Who submits the report on eDesk?
The report is submitted only via eDesk, by the RC, the RR or a board member, under the board's responsibility; the RC may submit it in its own right. On top of that rule, our internal practice is to keep every communication with the supervisors under the RR's responsibility, and the RR may mandate the RC to send it.
Was the report filed after the AMLA templates replaced the questionnaire?
In our practice, yes: the report was filed in 2026 (financial years 2025) for the registered AIFMs we follow. Because the CSSF replaced its Financial Crime Questionnaire with the AMLA templates that year, the corroboration section was not performed. Whether auditors will be asked to corroborate the AMLA template answers in future years is an open question.
What happens if the report is not filed?
The CSSF has sanctioned non-filing. By a decision of 17 January 2024, published 14 June 2024, it fined one AIFM EUR 10,000 for not filing the 21/788 external report for year-end 31 December 2022; the same day, it reprimanded three other AIFMs. The circular places the submission under the board's responsibility.
Sources
- CSSF Circular 21/788 (17 December 2021), sections 1.1 to 1.6: https://www.cssf.lu/wp-content/uploads/cssf21_788eng.pdf
- CSSF Regulation No 12-02 (Article 49(1)): https://www.cssf.lu/wp-content/uploads/RCSSF_No12-02eng.pdf
- CSSF circular letter of 12 February 2026 (AMLA data-collection templates): https://www.cssf.lu/wp-content/uploads/circular_letter_120226_AML_CFT.pdf
- CSSF circular letter of 16 March 2026 (2026 deadlines): https://www.cssf.lu/wp-content/uploads/circular_letter_170326_AML_CFT.pdf
- CSSF Circular 24/854 (SRRC): https://www.cssf.lu/wp-content/uploads/cssf24_854eng.pdf
- CSSF decision of 17 January 2024, published 14 June 2024 (reprimands of three AIFMs): https://www.cssf.lu/wp-content/uploads/S_67_GFI_X_2024.01.17_en.pdf
- AED, AML/CFT supervision of RAIFs: https://pfi.public.lu/fr/blanchiment/sf/fiar.html