Pillar guide

RR and RC in Luxembourg: roles, liability and the documents they sign off

The RR and RC under the 2004 Law and CSSF Regulation 12-02: appointment, duties, Luxembourg location rule, liability and the documents each one signs off.

Draft — under review by the ComplyKit editorial team.

Every Luxembourg professional subject to the AML/CFT framework must designate two people: a member of the management body who answers for compliance, and a compliance officer who runs it day to day. The Law calls them the responsable du respect des obligations and the responsable du contrôle du respect des obligations; the market calls them the RR and the RC. This guide sets out what each one does, where the requirements come from, and which documents carry their signature.

Legal basis

The obligation comes from Law of 12 November 2004, art. 4(1), which requires an adequate internal organisation and the designation of both functions. Articles 40 to 43 of CSSF Regulation 12-02 specify appointment, experience, hierarchical position, access, availability, delegation and the combination of functions. For investment fund managers, sub-chapter 5.4 of Circular CSSF 18/698, from point 282, adds the sector rules on the RR and RC, and Circular 24/854 organises the RC's annual summary report for the collective investment sector.

The names of both persons are communicated to the CSSF under Art. 40. A change of RR or RC is a notification, not an internal matter.

The RR, responsable du respect des obligations

The RR is a member of the management body: a director for a fund company, a member of the authorised management for an IFM, a PFS or a credit institution. The function is personal. The RR is accountable for the entity's compliance with its AML/CFT obligations, receives the RC's reports and the internal audit reports, and signs the regulatory filings. Art. 43 of the Regulation protects the RR's independence and objectivity; points 284 and 285 of Circular 18/698 restate the designation at management level for IFMs.

What the RR cannot do is treat the role as honorary. The CSSF's sanction decisions are published nominatively under Art. 8-6 of the Law, and the failure to file an annual questionnaire has been enough to attract a fine: nine AIFMs were fined EUR 10,000 each by decisions of 11 September 2025 for that failure alone.

The RC, responsable du contrôle du respect des obligations

The RC is the compliance officer. Art. 42 of the Regulation lists the duties: apply the policies and procedures, propose measures, act as the first- and second-line control point, supervise branches and subsidiaries, ensure group-wide compliance, keep training current, act as the contact point for the CRF and the CSSF, report regularly to management, and deliver the annual AML/CFT summary report to the CSSF within five months of the financial year end.

Three constraints shape who can hold the role:

A natural person. Circular 18/698, point 286, for IFMs; the same expectation applies across the CSSF-supervised sector.
Located in Luxembourg. Point 287 requires the RC of an IFM to be permanently located in Luxembourg and reachable during business hours, mirroring the general key-function rule at point 127. The CSSF FAQ tolerates an RC outside Luxembourg only where both the IFM and the individual are non-Luxembourg domiciled, case by case.
Experience, position and availability. Art. 40 requires appropriate experience, a hierarchical position that gives access to all information, and enough time. Art. 43 allows the RC function to be combined with other functions only where workload and independence permit; an RC who is also the sole conducting officer for portfolio management is a recurring finding.

Art. 41 lets the RC delegate tasks to qualified employees, and Art. 40 lets an IFM or a fund use a third party for the function. Delegation of tasks does not delegate the responsibility: the RC still owns the outcome and the RR still answers for it.

The two roles in a fund structure

In a fund with an authorised IFM, the IFM is the obliged entity that carries the organisational obligations; the fund is relieved of separate filings under Circular 21/788. The RR and RC are then the IFM's. A self-managed SICAV or a SICAR marketing its own shares designates its own.

The most common error is treating the registrar and transfer agent as the responsible party. The transfer agent performs customer due diligence on investors as a delegate under Art. 37 of the Regulation and sub-section 5.4.2 of Circular 18/698. The IFM must have a written agreement allocating responsibilities, perform due diligence on the delegate, monitor it on an ongoing basis and be able to obtain the underlying KYC documentation without delay. The RC signs off on that oversight; the delegate does not sign off on the IFM's compliance.

For a RAIF or an unregulated SCSp the RR and RC exist just the same, but the supervisor is the AED, the filing is the AED questionnaire and the signed RC report, and the deadline was 31 May 2026 for RAIFs on financial year 2025 data.

The documents the RR and RC sign off

Document	Who approves or signs	Basis
AML/CFT policy	Board or authorised management, on the RC's proposal; RR accountable	Reg. 12-02 Art. 6, 38
Business-wide risk assessment and risk appetite	Board approval of the conclusion and the appetite	Reg. 12-02 Art. 4
AML/CFT procedure and forms	RC validates; authorised management approves	Reg. 12-02 Art. 38
High-risk relationships, PEPs, correspondent relationships	Authorised management approval, RC involvement	Reg. 12-02 Art. 26, 28, 30, 31
Suspicious transaction reports	RC decides and files with the CRF through goAML	Law Art. 5(1)(a); Circ. 11/528
Annual AML/CFT summary report	RC writes; RR receives and signs the filing	Reg. 12-02 Art. 42; Circ. 24/854
Self-assessment questionnaire	RC prepares; RR or RC submits	Circ. 21/789 as updated by 23/839; 21/790
Training programme and attendance record	RC owns	Reg. 12-02 Art. 46
Record of steps and retention log	RC attests annually	Law Art. 3(6); Reg. 12-02 Art. 25

The record of steps deserves a word. An inspection does not stop at reading the policy; it asks for evidence that each step was taken, when, and by whom. A register the RC signs off once a year closes that gap.

Liability and sanctions

Administrative sanctions are set by Art. 8-4 of the Law, graded under Art. 8-5 and published nominatively under Art. 8-6. They can be imposed on the entity and on the persons responsible for the breach, which is why the RR is named. Criminal penalties for breach of the professional obligations sit in Art. 9 of the Law. The CSSF's recurring findings are procedural rather than exotic: delegation oversight that exists on paper only, generic training, thin source-of-wealth documentation, a risk assessment that does not describe the entity's actual activity, and late or missing filings.

Checklist for the RR and RC

Both persons designated by the board and notified to the CSSF or the AED (Art. 40).
RC is a natural person, located in Luxembourg where Circular 18/698 requires it, with documented experience and time.
Reporting line from the RC to the management body, with regular written reports (Art. 42).
Annual summary report calendared within five months of year end; questionnaire and, where applicable, the réviseur's external report within six months (Circ. 21/788).
Written delegation agreements with every registrar agent and distributor, with a monitoring plan and access to KYC files (Art. 37; Circ. 18/698 sub-section 5.4.2).
STR decisions documented, including decisions not to report, without tipping off (Law Art. 5(5)).
Training programme approved and attendance recorded (Art. 46).

This article is general information for compliance practitioners. It is not legal advice.