€170,000 for criminal immunity? A CSSF fine bars criminal prosecution in compliance

Introduction — when a Swiss bank sets Luxembourg criminal law alight

An ordinary case? Not quite

At first sight, the case decided by the Luxembourg Court of Appeal on 26 February 2025 might pass for one more technical dispute in the often discreet field of anti-money laundering and counter-terrorist financing (AML/CFT).

Everything is there: a Swiss bank, through the Luxembourg branch of a substantial financial institution, is accused of failing to meet the due diligence obligations imposed by the Law of 12 November 2004.

In 2020, the Commission de Surveillance du Secteur Financier (CSSF) imposed a financial penalty of €170,000 for breaches identified following an on-site inspection. Some years later, the public prosecutor decided to bring criminal proceedings on the same facts. Routine? Apparently so — this is a frequent situation.

Yet what looked like a straightforward compliance file in fact led to a decision of far wider resonance: the Court of Appeal held that the criminal proceedings were inadmissible, because an administrative penalty had already been imposed.

In short, a strict application of the ne bis in idem principle — and this in relation to an administrative fine, in the AML/CFT field, a highly strategic subject in the Grand Duchy.

What is really at stake: the fate of the dual administrative and criminal net

The ruling’s main significance lies in the central question it raises: in economic criminal law, is it still possible to combine an administrative penalty imposed by a sectoral supervisory authority with criminal proceedings brought by the public prosecutor, where both concern the same facts?

The Court’s answer is clear and precise: in the absence of a formalised coordination mechanism between the two limbs, that combination breaches the ne bis in idem principle as interpreted under European law.

In other words, Luxembourg cannot both allow its administrative regulation to evolve towards quasi-criminal enforcement and retain an autonomous criminal route, without organising how the two fit together.

Behind this case, then, it is the entire institutional architecture of compliance that is called into question.

It brings to light the growing tension between enforcement effectiveness, the protection of fundamental rights, and international obligations in the fight against financial crime.

An issue at the crossroads of European law and financial criminal law

This dispute is neither isolated nor specific to the Luxembourg financial centre. It reaches well beyond the national frame, forming part of a broader Europeanisation of economic criminal law, in which the dividing lines between administrative penalties, criminal penalties and regulatory sanctions are increasingly porous.

Through the Engel criteria and rulings such as A and B v Norway, Menci and Grande Stevens v Italy, European case law has imposed safeguards on the combination of proceedings — and the Luxembourg Court of Appeal takes them up in full.

The debate is therefore only beginning, because the ruling poses a formidable question:

If enforcement routes can no longer be combined, how can both the effectiveness of AML/CFT and respect for fundamental rights be guaranteed?

And above all: is Luxembourg currently equipped to meet that requirement of articulating enforcement powers?

This article sets out to answer those questions, returning to the decision of 26 February 2025, its scope, how it compares with neighbouring systems, and its consequences for the balance between compliance and enforcement.

The ruling of 26 February 2025: anatomy of an inadmissibility

A Swiss bank branch in the crosshairs twice over

It begins with a sectoral inspection carried out between May and June 2018 by the CSSF at the Luxembourg branch of a Swiss banking institution.

The inspection revealed serious shortcomings in the implementation of due diligence obligations, ongoing monitoring and analysis of atypical transactions, as provided for by the Law of 12 November 2004 on the fight against money laundering and terrorist financing (the “2004 Law”).

Specifically, breaches were found of Article 2-2 (due diligence framework), Article 3 (customer analysis and classification) and Article 5 (obligation to report suspicions).

On 27 July 2020, the CSSF therefore decided to sanction. An administrative fine of €170,000 was imposed.

No appeal was lodged against that decision, which became final.

Yet a few months later, the public prosecutor brought proceedings for the same breaches, under Article 9 of the 2004 Law, which imposes criminal penalties on those who have “knowingly” contravened the obligations laid down in the above articles.

The bank then astutely raised a procedural objection: those criminal proceedings were inadmissible under the ne bis in idem principle, since the facts had already been sanctioned, albeit by an administrative authority.

The stage was set.

The dilemma: punish twice, or respect fundamental rights?

The question is not new, but it arises here with particular sharpness:

Can the same facts be sanctioned twice under different legal characterisations, in the absence of any explicit coordination mechanism? And above all: must the penalty imposed by the CSSF be regarded as “criminal”, even though it is handed down by an administrative authority within an internal financial regulation process?

The prosecution sought to sidestep the obstacle.

It argued that the administrative and criminal proceedings pursue different objectives and that the CSSF penalty is not criminal in nature within the meaning of European case law. It also invoked the general interest in combating money laundering effectively, including by criminal means.

The defence replied that the nature of the CSSF penalty, its amount, its subject matter and its deterrent effect go beyond a purely administrative framework.

The Court resolved the matter by applying the broad principles established in the ECtHR’s Engel case law and reaffirmed in A and B v Norway and Menci.

The Court’s forensic analysis: criminal penalty + absence of coordination = nullity

The Court’s reasoning is methodical.

It begins by characterising the CSSF penalty as criminal in nature, notwithstanding its administrative appearance. To do so, it applies the Engel criteria:

• Nature of the offence: AML/CFT obligations apply generally to all financial sector professionals and fall within economic public order;
• Nature and purpose of the penalty: the CSSF imposes a fine with a deterrent and punitive reach, not a purely preventive or corrective one;
• Degree of severity: although moderate (€170,000), it forms part of a punitive regime providing for very high ceilings (up to €5 million or 10% of annual turnover).

The Court then notes that the facts underlying the CSSF penalty and those underlying the criminal proceedings are, at the very least, partially identical. That is enough for it to find a double prosecution on the same subject matter.

The central question then remains:

Was there sufficient coordination between the two sets of proceedings to make the combination lawful?

The answer is a clear and documented no.

The Court points to:

• The absence of any legal provision requiring dialogue or an information-sharing mechanism between the CSSF and the public prosecutor;
• The absence of synchronisation or articulation between the two sets of proceedings;
• The absence of complementary purpose between the penalties (they target the same entity, the same facts, the same deterrent objectives).

It therefore rules out any justified combination and finds a breach of the ne bis in idem principle.

The axe falls: criminal proceedings held inadmissible

The decision is unequivocal: the criminal proceedings are inadmissible.

The Court set aside the committal order, upheld the procedural objection raised by the defence, and ordered the costs to be borne by the State.

The message is clear.

Without a legal framework for coordination or a solid justification for combining the two, Luxembourg cannot sanction the same facts twice, even in a field as sensitive as AML/CFT.

Not even the argument of an overriding interest in economic enforcement is enough to displace a fundamental protection enshrined in European law.

What comes next?

It promises to be decisive. This ruling calls for a thorough rethink of how enforcement powers are articulated, particularly in regimes with dual administrative and judicial channels. It may well set a precedent — or, conversely, prompt swift reform to prevent a repeat.

A decision that resonates beyond borders: scope and principles

The Engel criteria, Luxembourg edition

If the ruling of 26 February 2025 marks a break, it is above all because of the clarity with which the Court of Appeal applies the criteria laid down in the Engel case law.

Although those criteria are well known to European lawyers, their application in the specific field of banking regulation was far from obvious.

By declaring the CSSF penalty criminal in nature, the Court crosses a symbolic threshold: it acknowledges that a regulatory authority may, without saying so expressly, exercise a power that is punitive within the meaning of European law.

The fact that the penalty is formally administrative, decided without any involvement of the judiciary, does not preclude its characterisation as criminal.

In so doing, the Court reaffirms the autonomy of the notion of “criminal matter”: what counts is not the classification adopted in national law, but the reality of the punitive mechanism.

That semantic and legal shift is central. It opens the way to a critical re-reading of every administrative sanctioning regime in the financial, tax and prudential fields.

Complementarity and coordination: the two missing pillars

To be clear, European law does not in itself prohibit combining penalties, but it strictly frames the conditions. The following must be present:

• A general interest objective sufficient to justify the combination (accepted here);
• Genuine complementarity between the penalties (they must address different aspects of the conduct, or distinct effects);
• Effective procedural and temporal coordination (in particular through mechanisms for articulation, mutual information and overall proportionality).

In this case, the Court finds that only the first condition is met: the objective of combating money laundering is indeed a major public interest. The other two are absent:

• There is no tangible justification for the combination in the light of the intended effects;
• No coordination mechanism between the CSSF and the prosecution service is provided for or implemented.

The Court does not therefore require the proceedings to be merged, but at least a legal architecture ensuring that the two routes, administrative and criminal, do not overlap arbitrarily. It is the absence of that procedural safety net that brings down the prosecution here.

An implicit endorsement of the trial judge’s constitutional role

Beyond its rigorous application of European law, the ruling carries an institutional message.

National courts must themselves guarantee fundamental rights, even against the will of the prosecution or in the absence of any clear national provision.

The Court of Appeal thus fully assumes its function of reviewing compliance with international conventions in concreto. It does not wait for legislative reform, nor for a ruling from the CJEU or the ECtHR: it applies the principles drawn from the treaties and European case law directly in order to bar the prosecution.

That judicial stance deserves emphasis. It reflects a maturity in the proportionality review carried out by national courts, particularly in relation to multiple penalties. It is also a reminder that in a dual-liability system, it is often the national judge — not the legislature — who acts as the ultimate bulwark against infringements of fundamental rights.

In that sense, the ruling of 26 February 2025 goes beyond the case at hand: it illustrates the gradual transformation of the criminal judge into an arbiter of the dialogue between fundamental rights, financial regulation and enforcement effectiveness.

A tour of European models: what our neighbours do

It is always instructive to look at neighbouring practice, in order to understand what may happen in the near future.

If the ruling of 26 February 2025 came as a shock in Luxembourg, it is partly because it contrasts with the mechanisms in force in other EU Member States.

France: the art of filtering by the AMF and the PNF

France is an interesting example of a State that has reshaped its practice to take account of European case law, while preserving its ability to sanction financial breaches heavily.

The turning point came with the Constitutional Council’s decision of 18 March 2015, which, concerning the combination of AMF penalties and criminal penalties for insider dealing, set limits on the dual enforcement net.

The principle established: a combination is acceptable only if the penalties pursue distinct purposes, are complementary and proportionate, and the law guarantees that the same facts cannot give rise to redundant punishment.

Since then, cooperation protocols have been put in place between the AMF and the national financial prosecutor’s office (PNF). In practice, the AMF refers a matter to the prosecutor where it considers the facts serious enough to warrant criminal enforcement, and vice versa. Where one of the two authorities has opened proceedings, the other generally refrains from acting, unless complementarity is expressly justified. That coordination is institutionalised, documented, and rests on a genuine filter.

Case law has upheld the system, finding that it satisfies the ECtHR and CJEU criteria. The result is a relatively stable balance between enforcement effectiveness and respect for fundamental guarantees.

Italy: from Grande Stevens to Menci, a school of procedural rigour

Italy experienced a halt similar to Luxembourg’s with Grande Stevens v Italy, which concerned the combination of a penalty imposed by CONSOB (the securities regulator) and a criminal conviction for market manipulation.

In that case, the ECtHR held that the administrative penalty imposed by CONSOB was criminal in nature (within the meaning of Engel) and that the subsequent criminal conviction breached the ne bis in idem principle.

In response, Italy adapted its legislation and procedures. A combination is now possible only where the proceedings are conducted in a coordinated manner, with distinct purposes and overall proportionality.

The CJEU’s Menci ruling, concerning the combination of administrative and criminal penalties in VAT matters, confirmed that combination remains permissible under certain conditions, but also required a robust procedural architecture.

Since then, Italian case law has tended to frame cases of combination strictly and to favour a single route of prosecution where the facts are identical.

Belgium: FSMA penalties under close scrutiny

Belgium, like Luxembourg, has faced criticism from the Council of State and the Constitutional Court concerning the regime for combining FSMA (Financial Services and Markets Authority) penalties with criminal proceedings.

The courts upheld the principle of combination, but subject to coordination and proportionality. Belgian regulators have since equipped themselves with internal filtering procedures: where an administrative penalty is contemplated, it is preceded by consultation with the prosecutor in order to avoid any illegitimate duplication.

The FSMA and the public prosecutor also have a mutual notification tool, making it possible to ensure that the same facts are not prosecuted twice without justification. The system is not yet perfect, but it shows that procedural coordination has become an unavoidable requirement.

Where does Luxembourg stand? A telling singularity

Against those examples, Luxembourg appears a notable exception: legislation silent on coordination, compartmentalised institutional practice, and increasingly muscular administrative regulation, but without procedural safeguards.

The ruling of 26 February 2025 exposes that anomaly.

The Grand Duchy has not yet formalised the instruments needed to avoid uncontrolled overlap between the administrative and criminal routes. The case thus reveals an institutional blind spot: in a State heavily exposed to cross-border financial flows, coherence between enforcement and regulation remains, for the time being, incomplete.

Put differently, the ruling lays the groundwork for a reform to come, whether by legislation, regulation, or the conclusion of inter-institutional protocols.

A breath of air for fundamental rights

The ruling of 26 February 2025 does more than penalise a procedural gap. It is also a strong signal in terms of protecting individuals and entities against the potential abuses of combined enforcement routes.

Far from a mere procedural victory, the decision stands as an exemplary illustration of the judge’s role in defending fundamental rights within a multi-layered enforcement system.

The return to favour of ne bis in idem

For several years, the ne bis in idem principle — no one may be prosecuted or punished twice for the same facts — had been eroded by a pragmatic reading of enforcement effectiveness. European case law had itself softened its position, allowing a degree of combination subject to conditions.

The Luxembourg ruling returns to a more demanding conception: respect for the principle is not a mere adjustment variable of enforcement, but an autonomous requirement, capable of being invoked and applied, which may render criminal proceedings inadmissible once an administrative limb has already sanctioned the same facts.

The reminder is salutary: respect for fundamental rights cannot be made subordinate to the political or economic objectives of the fight against financial crime, however pressing those may be.

A wake-up call for regulatory authorities

The ruling sets a binding but useful framework: administrative authorities cannot claim a monopoly on sanctioning without surrounding themselves with guarantees, and the prosecutor cannot ignore regulators’ decisions.

That accountability runs both ways:

• It requires the CSSF (and regulators generally) to recognise that their decisions may be criminal in nature under European law, with all that this implies in terms of guarantees, reasoning and coordination.
• It requires prosecuting authorities (public prosecutor, judicial police) to assess upstream the risk of inadmissibility based on ne bis in idem, and to organise their relations with administrative authorities accordingly.

This mechanism does not preclude all enforcement, but it forces institutions to articulate their actions in accordance with fundamental principles — a two-step dance in which every “enforcement” step must be matched by a “rights-protecting” one, in a legal choreography as demanding as it is essential to the rule of law.

An invitation to reform the legal framework

Although the Court confines itself here to noting the absence of procedural coordination, the underlying message is clear:

The Luxembourg legal system must evolve.

The ruling acts as a catalyst: it exposes a flaw in the criminal regulation of economic activity and calls for institutional reform.

That reform could take several forms:

• Introducing an obligation of mutual notification between the CSSF (and, why not, other authorities) and the prosecution service;
• Establishing a judicial filter or an arbitration mechanism between proceedings;
• A statutory definition of the scope of ne bis in idem in financial matters, to clarify the conditions for combination and avoid judicial censure.

The legislature is thus sent back to its responsibilities: without coordination tools, the system exposes itself to the repeated invalidation of criminal proceedings, which undermines both the credibility of regulators and confidence in the enforcement arsenal.

A setback for enforcement effectiveness?

While the ruling of 26 February 2025 marks clear progress in protecting fundamental rights, it is not beyond criticism.

Several observers will see in it an excessively formalistic decision that weakens financial enforcement in an international context where zero tolerance towards money laundering and terrorist financing is a political and diplomatic requirement.

The risk of an AML/CFT enforcement blind spot

As Luxembourg law currently stands, the absence of coordination between the CSSF and the public prosecutor is not an isolated anomaly but an institutional reality. In other words, each time the CSSF imposes a “criminal” penalty within the meaning of the Engel criteria — which is increasingly frequent — it potentially neutralises any subsequent criminal prosecution on the same facts.

The result?

A paradox: institutions at fault might strategically prefer to be sanctioned swiftly by the CSSF — a procedure that is often less intrusive and more technical — in order to escape heavier and more stigmatising criminal proceedings. In the end, this amounts to organising a form of de facto self-amnesty through regulation.

In the most serious cases — complicity in money laundering, systemic failings in transnational crime matters — this creates a worrying blind spot for criminal justice. The fight against money laundering becomes a variable-geometry exercise, depending less on the seriousness of the facts than on the authorities’ timing.

A potential brake on tackling white-collar crime

Beyond this case, the ruling might lead prosecuting authorities to drop certain files for fear of an inadmissibility founded on ne bis in idem. That institutional caution could turn into inertia. Yet the most complex economic offences often require lengthy investigations, intrusive investigative measures, and recourse to exemplary penalties.

Setting aside the criminal route too readily in favour of a more flexible administrative penalty risks:

• Weakening the deterrent reach of the system;
• Depriving the criminal judge of the power to impose ancillary penalties (exclusion from an activity, confiscation, publication, disqualification);
• Sustaining the image of a second-tier economic criminal law, reserved for the least sensitive breaches.

Proportionality and respect for fundamental rights must of course be preserved, but they cannot become an absolute shield against any structured judicial response.

When form prevails over substance: the proportionality debate

A further, more legal criticism concerns the implicit hierarchy the ruling creates between administrative and criminal action. By holding that the former “blocks” the latter, the Court turns the CSSF into a de facto court, capable of extinguishing any subsequent prosecution. That reasoning may appear excessively formalistic.

It could be argued that:

• The CSSF penalty is, despite its amount, limited in reach: no moral stigma, no adversarial procedure equivalent to that before a criminal judge, no systematic publicity;
• The criminal proceedings could have pursued different objectives: for example, holding specific directors to account, establishing individual liability, or making good the harm to economic public order;
• A more flexible interpretation of ne bis in idem would have allowed the combination where the two sets of proceedings targeted different effects, even if only partly.

In other words, the concern to protect fundamental rights, laudable though it is, must not lead to excessive procedural timidity, at the risk of hampering the State’s capacity to punish serious breaches of economic public order effectively.

What we did not expect to read: the ruling’s surprises

While the ruling of 26 February 2025 is legally sound, it remains in some respects disconcerting. Beyond its rigorous reasoning, the decision brings out several lines of doctrinal tension that may unsettle practitioners. Between conceptual shifts and interpretative boldness, here are the points that give pause.

The CSSF treated as a quasi-criminal authority?

One of the most unexpected aspects of the ruling lies in how the Court characterises the CSSF: no longer merely an administrative regulator, but a body capable of imposing penalties that are criminal in nature.

That semantic shift is far from trivial: it radically changes how the supervisory authority’s disciplinary action must be understood.

Put differently, the system of financial penalties established by the CSSF no longer falls exclusively within administrative law, but encroaches on substantive and procedural criminal law.

That observation compels an uncomfortable question: is the CSSF, as currently configured, legally equipped to exercise what is in effect a criminal function? And what of the other authorities?

• Do their procedures guarantee equality of arms?
• Is their independence from the executive equivalent to that of a court?
• Are the remedies they provide sufficient to guarantee the rights of the defence?

If the answer to any of those questions is no, then the legitimacy of the entire Luxembourg administrative sanctioning regime must be reconsidered. It is not only the prosecution that this case law neutralises: indirectly, it also obliges the CSSF and other authorities to change their status or their way of operating.

Identity of facts: an expansive reading of ne bis in idem

Another surprise is the way the Court of Appeal interprets the identity of facts between the administrative and criminal proceedings. It holds that the facts covered by the two sets of proceedings are “at the very least partially identical”, and that this suffices to bar the prosecution.

That very broad assessment breaks with a stricter tendency, under which ne bis in idem applies only where the facts, the persons and the legal characterisation are identical or nearly so.

Here, the Court adopts a more flexible approach, favouring a material reading of the facts.

That choice may be debatable: it could have been considered that the CSSF penalties target the institution’s internal control system, whereas the criminal proceedings target specific individual conduct (for example, failure to report a suspicion, or failure to carry out an analysis).

Merging the subject matter of the two procedures, without a fine-grained demonstration of their actual identity, potentially weakens the reach of criminal enforcement by indefinitely widening the zone in which combination is excluded.

A protective decision, but perhaps too rigid

Finally, what surprises is the Court’s refusal to assess the complementarity of the penalties in concreto.

It could have taken a more nuanced position: recognising the criminal nature of the CSSF penalty, finding a degree of identity of facts, but holding that the combination was nonetheless justified because the proceedings were conducted at different times, pursued complementary purposes and produced distinct effects.

What the Court does instead is apply literally and rigidly the three-part test required by European case law: it demands a visible, explicit and coherent articulation of the two sets of proceedings.

That requirement of absolute formalisation is all the more surprising in that it leaves the authorities little margin of appreciation, even where there is a manifest general interest in prosecuting certain facts.

In other words, the ruling defends a maximalist reading of ne bis in idem, perhaps at the expense of a more purposive logic that would seek to balance enforcement effectiveness against the protection of fundamental rights.

What now? Rethinking the regulator–prosecutor pairing

The ruling of 26 February 2025 acts as a revealer. It does not merely penalise a procedural irregularity: it lays bare a structural failing in Luxembourg’s institutional architecture for enforcing AML/CFT breaches.

If administrative authorities can impose penalties that are criminal in character, then the system must organise how they articulate with public prosecution.

Failing that, it exposes itself to the systematic invalidation of proceedings.

Coordination mechanisms to be formalised

The first priority is institutional. A formal framework for coordination between sectoral regulators (CSSF, CAA and others) and the public prosecutor could be created. It might comprise several complementary tools:

• A statutory obligation of mutual notification between the authorities and the prosecutor: as soon as administrative proceedings are opened on facts capable of criminal characterisation, the prosecutor must be informed, and vice versa.
• A shared register of enforcement proceedings, administrative or judicial, in AML/CFT matters, accessible to all competent authorities, making it possible to prevent uncoordinated double prosecutions.
• A dedicated contact point within each authority, responsible for liaison between regulators and the prosecutor, under defined arrangements.

These measures are not intended to merge the enforcement routes, but to ensure mutual visibility of ongoing proceedings. They would form a first line of defence against breaches of ne bis in idem.

Towards a principle of subsidiarity between penalties?

Beyond coordination, it is time to consider a functional hierarchy between enforcement routes. One option would be to establish a principle of subsidiarity: where the administrative penalty is capable of restoring economic public order and is sufficiently deterrent, the criminal route could stand back, save in exceptional circumstances.

That principle might be framed as follows:

• For a technical or isolated breach, the authorities retain the lead, in a logic of regulation and guidance;
• For a systemic or intentional breach, or one with an interpersonal dimension (directors’ liability, complicity, concealment), priority goes to the prosecutor;
• In case of doubt, a mandatory consultation procedure must be triggered.

Such an arrangement would ensure targeted use of the criminal route, while avoiding the “circuit-breaker” effect currently produced by the regulator acting first.

An idea worth exploring: a judicial filter ahead of combination

To secure combined penalties, a more ambitious option would be to establish a judicial filter. Before a prosecutor could bring proceedings on facts already sanctioned administratively (or vice versa), an independent court — for example the Chambre du Conseil or a specialised liaison judge — would be seised in order to:

• Verify the identity of the facts;
• Assess the complementarity of the purposes;
• Evaluate the proportionality of the penalties contemplated as a whole.

That “judicial visa” would not block the prosecutor’s action, but would guarantee compliance with European requirements upstream, while giving the proceedings legal security. It would also serve to harmonise practice.

Several countries have already experimented with similar mechanisms; Luxembourg could draw on them to reconcile procedural rigour with enforcement effectiveness.

Conclusion: a pivotal ruling to watch closely

A victory of principle with questionable practical effects

The Court of Appeal’s ruling of 26 February 2025 is a strong, lucid and legally well-founded decision.

It firmly restates that the protection of fundamental rights is not optional, even in the face of the imperatives of fighting financial crime. Applying the criteria of European case law rigorously, the Court draws a clear line: any administrative penalty of a criminal character must, in order to coexist with a criminal penalty, form part of a coordinated, proportionate and justified system.

But this victory of principle poses a paradox: by invalidating the criminal proceedings without offering an equivalent enforcement alternative, the decision in fact weakens the prosecutor’s capacity to act. That procedural disarmament — legally unavoidable as Luxembourg law currently stands — raises legitimate questions about the overall effectiveness of the institutional response to serious AML/CFT breaches.

Case law that may inspire, or unsettle

Given its reach, the ruling could serve as a reference in other jurisdictions confronting dual-prosecution mechanisms.

It highlights the systemic flaws that every advanced democracy must now confront:

• How can the effectiveness of penalties be reconciled with the procedural rigour required by the ECHR and the Charter of Fundamental Rights of the European Union?
• How can hybrid arrangements be built that guarantee both the punishment of wrongful conduct and respect for the procedural rights of those prosecuted?

But this case law may also unsettle: applied expansively, it could paralyse efforts to tackle complex economic offences, where regulators and prosecutors sometimes act in parallel out of necessity.

A test for the legislature: fill the gap, or change paradigm?

The ball is now in the Luxembourg legislature’s court.

The ruling does not say that combining penalties is prohibited; it says that such a combination cannot be improvised. To be legally valid, it must be organised, articulated and framed. In other words, what is censured is the absence of a mechanism, not the combination itself.

The policy choice is therefore clear. Either we accept giving up combination and rethink the routes of financial enforcement along a single, clear and exclusive model — regulatory or criminal; or we maintain the logic of the dual net, but equip it with a formal, inter-institutional and legally robust architecture.

In either case, the status quo is no longer tenable.

General conclusion

The ruling of 26 February 2025 will probably be remembered as a landmark departure.

By the subtlety of its reasoning and the reach of its implications, it calls for an aggiornamento of Luxembourg economic enforcement law.

It calls for moving beyond a culture of institutional compartmentalisation towards a logic of structured cooperation between regulators and judicial authorities.

That transition will not be simple: it will require an effort of normative clarification, cultural openness between institutions, and a thorough revision of practice.

But it is also an opportunity: the opportunity to build a modern, coherent model of financial enforcement, respectful of fundamental rights and capable of responding effectively to the challenges of ever more sophisticated economic crime — while engaging obliged entities on clear ground, guided by common sense and by a shared will to act in a common interest: the fight against money laundering and terrorist financing.