Adaptive Quiz
Anti-Money Laundering and Counter-Terrorist Financing (AML/CFT)
Q1. According to the amended Law of 12 November 2004, a person is considered a beneficial owner when their ownership in an entity exceeds:
10% of the capital or voting rights
15% of the capital or voting rights
25% of the capital or voting rights
50% of the capital or voting rights
Q2. The AML/CFT activity report submitted to the CSSF by professionals of the financial sector must be:
Submitted before 30 June each year
Submitted before 31 March each year
Submitted only in case of a change in shareholding
Submitted only upon express request from the CSSF
Q3. A Suspicious Activity Report (SAR) to the FIU (Financial Intelligence Unit) must be filed:
Only after confirmation of the offence
Before executing the suspicious transaction
After validation by the Compliance Officer (RCC)
Within 10 business days following the transaction
Calculation A
Back
Next
Personal Data Protection (GDPR)
Q1. Under the GDPR, a Data Protection Officer (DPO) is mandatory for:
Any company with more than 50 employees
Entities whose core activities involve large-scale regular and systematic monitoring
Public entities only
Financial institutions supervised by the CSSF exclusively
Q2. When transferring personal data to a third country lacking an adequate level of protection, the data controller must:
Obtain the written consent of the Data Protection Correspondent (CIL)
Conclude standard contractual clauses approved by the European Commission
Declare the transfer to the CNPD
Notify the transfer to the CSSF
Q3. A personal data breach must be notified to the CNPD within a maximum of:
24 hours
48 hours
72 hours
7 business days
Calculation B
Back
Next
MiFID II (Markets in Financial Instruments Directive II)
Q1. Under MiFID II, a marketing communication is compliant when it:
Mentions only the product’s past performance
Is fair, clear, and not misleading
Is approved by the Board of Directors
Is addressed to professional clients only
Q2. The suitability test applies:
To retail and professional clients receiving investment advice
To execution-only transactions
To eligible counterparties only
To non-complex products exclusively
Q3. The obligation to record telephone conversations relating to financial transactions requires a minimum retention period of::
1 year
3 years
5 years
7 years
Calculation C
Back
Next
MAR (Market Abuse Regulation – Regulation (EU) No 596/2014)
Q1. A “permanent insider” under MAR is:
Any person with occasional access to inside information
A back-office employee
A manager or employee with regular access to inside information
Any retail investor
Q2. In Luxembourg, the obligation for a Person Discharging Managerial Responsibilities (PDMR) to notify transactions on financial instruments applies once the total annual amount reaches:
€1,000
€5,000
€20,000
€50,000
Q3. Inside information must be made public:
Immediately after its internal creation
As soon as it is sufficiently precise and likely to affect the price of a financial instrument
At market close
Only upon the regulator’s instruction
Calculation D
Back
Next
Anti-Bribery and Corruption (ABC)
Q1. Under Luxembourg law, passive corruption is defined as:
Offering an undue advantage
Accepting or soliciting an undue advantage in exchange for an act
Reporting a corruption act
Witnessing an offered advantage
Q2. An effective anti-corruption policy within a financial institution must necessarily include:
A general ethical statement
A donations and sponsorship programme
Due diligence procedures on third parties and intermediaries
A professional dress code
Q3. Failure to comply with anti-corruption prevention obligations within an entity may result in:
An internal warning only
An administrative fine with no criminal effect
Criminal liability of the legal entity
Temporary suspension from the commercial register
Calculation E
Back
Next
Whistleblowers (Directive (EU) 2019/1937, Luxembourg Law of 16 May 2023)
Q1. Whistleblower protection applies when the report concerns:
A contractual dispute between employees
An actual or potential breach of EU law or national transposing law
A personal opinion on company strategy
A personal conflict of interest
Q2. Public disclosure (e.g. through the media) is protected:
Only after notification to the CSSF
When the internal or external report has remained unanswered
In all circumstances
After Board approval
Q3. A company with more than 250 employees must establish an internal reporting channel:
Optional
Mandatory
Subject to regulator approval
Recommended but not binding
Calculation F
Back
Next
MiCA (Markets in Crypto-Assets Regulation – Regulation (EU) 2023/1114)
Q1. MiCA mainly applies to:
Commodity derivatives
Financial instruments as defined by MiFID II
Issuers and service providers of crypto-assets
UCITS management companies
Q2. Under MiCA, the issuance of e-money tokens requires:
Prior authorisation as an electronic money institution
Simple notification to the CSSF
Registration as a digital asset service provider (PSAN)
Registration on a public blockchain
Q3. Crypto-asset service providers (CASPs) must:
Comply with AML/CFT and governance requirements
Hold only a general commercial licence
Report their activities to the Central Bank
Be established in any recognised third country
Calculation G
Back
Next
EMIR
Q1. Under EMIR, within what maximum time must a derivative transaction be reported to an authorised Trade Repository?
On the execution day
On the next business day after execution
Within three business days
Before month-end
Q2. A Luxembourg non-financial counterparty exceeds the clearing threshold for interest rate derivatives. Which additional obligation now automatically applies?
Daily reporting to the local regulator (CSSF)
Mandatory central clearing through an authorised CCP
Reporting obligation to ESMA
Exemption from bilateral margin if the counterparty is European
Q3. When a financial counterparty (FC) and a non-financial counterparty (NFC–) enter into an OTC derivative and the FC delegates reporting to the NFC–, who remains legally responsible for EMIR reporting compliance?
The NFC–, as it performs the reporting
Both counterparties jointly
The FC, as the delegating party
ESMA, as the supervisory authority
Calculation H
Back
Next
Beneficial Ownership (BO) Identification
Q1. Under Luxembourg Law of 13 January 2019, at what ownership threshold is a natural person presumed to be the beneficial owner of a company?
10% of the capital or voting rights
15% of the capital or voting rights
25% + 1 share of the capital or voting rights
50% of the capital or voting rights
Q2. A Luxembourg company is 100% owned by a Cypriot holding company, which is itself 100% owned by Ms. Z (a natural person). Who must be declared as the beneficial owner of the Luxembourg company?
The Cypriot holding company
The director of the Luxembourg company
Ms. Z, as the indirect beneficial owner
None, as the ownership is foreign
Q3. In the case of a Luxembourg trust, which of the following parties must be considered beneficial owners under AML/CFT law?
The trustee only
The settlor, trustee(s), designated beneficiaries, any person exercising effective control, and the protector, if applicable
The designated beneficiaries only
The settlor and the trust manager only
Calculation I
Back
Next
Cybersecurity – Introduction
Q1. What is the main cause of most cybersecurity incidents within organisations?
Unpatched hardware vulnerabilities
Human error
Large-scale DDoS attacks
Failures of external providers
Q2. During a ransomware attack, which protection measure truly enables a company to recover its operations without paying ransom?
A well-configured firewall
Multi-factor authentication
Regular, tested, and network-isolated backups
A strengthened password policy
Q3. In a mature cybersecurity governance plan, which role translates technical risks into business impacts and ensures coordination among management, IT, and compliance?
DPO (Data Protection Officer)
CISO (Chief Information Security Officer / RSSI)
CIO (Chief Information Officer)
Compliance Officer
Calculation J
Back
Next
DAC6 – Introduction
Q1. What is the main objective of the European DAC6 Directive (EU 2018/822)?
Harmonise tax rates among Member States
Ensure tax transparency and detect aggressive tax planning arrangements
Create a single European corporate tax
Abolish professional secrecy across Member States
Q2. Which of the following hallmarks belongs to Category C (cross-border arrangements) and is not subject to the main benefit test?
Deduction of a payment to a zero-tax jurisdiction
Deduction of a payment to a non-cooperative jurisdiction (ETNC)
Arrangement with a confidentiality clause
Conversion of income into lightly taxed capital
Q3. An intermediary bound by professional secrecy (e.g. a lawyer) identifies a reportable cross-border arrangement but does not obtain the taxpayer’s consent to disclose it. What must they do to comply with DAC6?
Do nothing and invoke absolute professional secrecy
Report the arrangement anonymously to the Tax Administration
Notify the reporting obligation to another intermediary or, failing that, to the taxpayer concerned
Wait until the fiscal year-end to submit a consolidated report
Calculation K
Back
Next
Trusts – Introduction
Q1. What is the main role of the trustee in a trust?
Hold the assets for their own benefit
Manage the assets according to the trust deed, in the interest of the beneficiaries
Supervise the protector and the settlor
Freely determine the trust’s beneficiaries
Q2. Under AML/CFT obligations, which natural persons must be considered beneficial owners (BOs) of a trust according to FATF recommendations and Luxembourg law?
The settlor, the trustee, the beneficiaries, and any person exercising effective control
Only the beneficiaries named in the trust deed
The trustee and the protector only
The settlor and the trustee only
Q3. In a discretionary trust, beneficiaries are not always named in the trust deed. How should beneficial owners be identified and documented for compliance purposes?
Wait until the trustee designates the beneficiaries before any identification
Identify the category of potential beneficiaries (e.g., children, heirs, employees) and apply enhanced due diligence
Do not declare them since they are not yet known
Consider only the settlor as the beneficial owner
Calculation L
Back
Next
Operational Risk
Q1. According to the Basel Committee definition, what is operational risk?
The risk of losses due to market fluctuations
The risk of losses resulting from inadequate or failed internal processes, people, systems, or from external events
The risk related to regulatory non-compliance
Counterparty risk in a credit operation
Q2. In the Caritas Luxembourg (2024) case mentioned in the training, which type of control could have prevented the CFO fraud (fraudulent payments to third parties)?
A corrective control based on post-incident reports
A preventive control involving segregation of duties and independent payment validation
An automatic detection control after funds transfer
An annual internal audit control
Q3. According to the Basel Committee definition, what is operational risk?
Maintain a loss register and appoint an IT manager
Identify, measure, monitor, and manage operational risk through an independent risk management function, covering ICT risk and outsourcing
Centralise all operational decisions in general management
Limit operational risk management to the compliance department
Calculation M
Total Score
Total Score
Global Score
Submit
Should be Empty: