Is Crypto Legal in Luxembourg?
Cryptocurrency is legal but only partially regulated in Luxembourg. The jurisdiction has a partial framework with significant gaps remaining. European Parliament and of the Council is the responsible authority. Primary legislation: AML law Art 24-1. The FATF Travel Rule is adopted.
Derived from 428 sourced facts for Luxembourg · last updated · primary sources
Overview
Luxembourg regulates crypto through a dual-track framework: VASP registration under the Law of 12 November 2004 on the fight against money laundering and terrorist financing (as amended by the Law of 25 March 2020) covers custodian wallet services and exchange activities, while MiCA (Regulation EU 2023/1114), applicable from December 2024, requires full CASP authorization for custody and administration of crypto-assets on behalf of third parties. The CSSF serves as the competent authority for both tracks, with obligations spanning AML/KYC customer due diligence, ongoing monitoring, suspicious transaction reporting, and internal controls frameworks per CSSF Circular 22/811. The critical transition to note is that MiCA upgrades the requirement from registration to full authorization, representing a materially higher compliance threshold for firms already registered as VASPs under the AML Law. (eur-lex.europa.eu, curia.europa.eu)
Regulatory Bodies
Name: Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets, and amending Regulations (EU) No 1093/2010 and (EU) No 1095/2010 and Directives 2013/36/EU and (EU) 2019/1937.
Operating Models
9/9 verdictsCan specific business models operate in Luxembourg? Each card answers the operational question for one kind of operator. Curated cells reflect counsel-grade review; AI-generated cells should be confirmed before relying on them.
Conditional · medium burden.
AI · UnreviewedConditional · medium burden.
AI · UnreviewedConditional · low burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · high burden.
AI · UnreviewedConditional · medium burden.
AI · UnreviewedConditional · medium burden.
AI · UnreviewedConditional · medium burden.
AI · UnreviewedPrimary Legislation
| Law / Regulation | Year | Scope |
|---|---|---|
| AML law Art 24-1 | 2026 | Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed… |
| Directive 2018/843 | 2004 | Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive… |
| Art 20-27 of the amended Law of 16 July 2019 | 2019 | Crypto custody in Luxembourg requires MiCA authorisation from the CSSF (Art 20-27 of the amended Law of 16 July 2019) or, for entities such as banks and CSDs, a MiCA Art 60 notification: Clearstream Banking S.A. notified the CSSF on 7… |
| Blockchain Law I (Loi du 1er mars 2019) added Art 18bis to the Law of 1 August 2 | 2019 | Blockchain Law I (Loi du 1er mars 2019) added Art 18bis to the Law of 1 August 2001 on the circulation of securities: account keepers may hold securities accounts and record securities within secure electronic recording devices, including… |
Licensing Requirements
Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed by the Loi du 6 février 2025, so crypto custody now requires a MiCA authorisation or notification.
Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive 2018/843); Art 7-1 was repealed by Art 17 of the Loi du 6 février 2025.
Crypto-asset service providers are obliged professionals under Art 2(1) point 20 of the Luxembourg AML law and must meet its professional obligations (risk assessment, customer due diligence, internal organisation, cooperation and suspicious-transaction reporting, Arts 2-2 to 5), supervised by the CSSF (Art 2-1).
MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24-1 a VASP's CSSF registration ended when the CSSF granted or refused authorisation under MiCA Art 63, and in any event on 1 July 2026; the CSSF is the competent authority under Art 20-27 of the amended Law of 16 July 2019.
Since the VASP regime ended, crypto custody in Luxembourg is the MiCA service "custody and administration of crypto-assets on behalf of clients"; on 14 October 2026 the ESMA interim register listed 10 Luxembourg entries offering it, out of 13 Luxembourg CASP entries supervised by the CSSF.
Crypto custody in Luxembourg requires MiCA authorisation from the CSSF (Art 20-27 of the amended Law of 16 July 2019) or, for entities such as banks and CSDs, a MiCA Art 60 notification: Clearstream Banking S.A. notified the CSSF on 7 February 2025 of its intention to provide custody.
The CSSF is Luxembourg's competent authority for MiCA (Art 20-27) and for the transfer-of-funds Regulation 2023/1113 (Art 20-38) under the amended Law of 16 July 2019, as inserted by the Loi du 6 février 2025 (Mémorial A n° 38, in force 10 February 2025).
Luxembourg payment and electronic money institutions are governed by the amended Law of 10 November 2009 on payment services; PSD2 was transposed by the Loi du 20 juillet 2018 and EMD2 by the Loi du 20 mai 2011, both amending that law. No Law of 13 July 2018 on payment services exists.
The Law of 12 November 2004 is frequently amended (consolidated text of 8 August 2026); VASPs entered it through two laws of 25 March 2020: Mémorial A n° 194 (AMLD5 transposition, VASP definitions) and Mémorial A n° 193 (VASP registration, Art 7-1).
The Luxembourg AML law of 12 November 2004 is ELI /eli/etat/leg/loi/2004/11/12/n1/jo on Legilux; its latest consolidated version is dated 8 August 2026. The ELI /2004/11/12/n6/jo has no record.
Under Art 8-6 of the Luxembourg AML law, the CSSF must publish on its website each final decision imposing an AML sanction or measure, stating the type and nature of the breach and the person responsible, with identity published case by case on proportionality.
The CSSF supervises AML/CFT compliance of the professionals it authorises or registers, including crypto-asset service providers (AML law Arts 2(1) point 20 and 2-1), and is the competent authority for MiCA under Art 20-27 of the amended Law of 16 July 2019.
The AMLD5 law is the Loi du 25 mars 2020 (Mémorial A n° 194) amending the Law of 12 November 2004, the 1976 notariat law, the 1990 bailiffs law, the 1991 lawyers law, the 1999 accountants law and the 2016 audit law; it does not amend the Law of 5 April 1993.
The Loi du 25 mars 2020 (Mémorial A n° 194) transposed parts of AMLD5 (Directive 2018/843) and added virtual-asset service providers to the AML law definitions (Art 1(20quater)); their CSSF registration came from the companion Loi du 25 mars 2020 (Mémorial A n° 193, Art 7-1).
The Legilux reference for the Luxembourg AMLD5 law of 25 March 2020 is /eli/etat/leg/loi/2020/03/25/a194/jo; the cited /2020/03/25/a189/jo has no record.
Blockchain Law I is officially the "Loi du 1er mars 2019 portant modification de la loi modifiée du 1er août 2001 concernant la circulation de titres" (Mémorial A n° 111, published 5 March 2019); the corpus title on distributed-ledger use in the financial sector is not its title.
Blockchain Law I (Loi du 1er mars 2019) added Art 18bis to the Law of 1 August 2001 on the circulation of securities: account keepers may hold securities accounts and record securities within secure electronic recording devices, including distributed ledgers, and transfers recorded there count as account-to-account transfers.
The Legilux reference for Blockchain Law I of 1 March 2019 is /eli/etat/leg/loi/2019/03/01/a111/jo; the cited /2019/03/01/a127/jo has no record.
Blockchain Law II is officially the "Loi du 22 janvier 2021 portant modification : 1° de la loi modifiée du 5 avril 1993 relative au secteur financier ; 2° de la loi du 6 avril 2013 relative aux titres dématérialisés" (Mémorial A n° 43); it does not amend the 1 March 2019 law.
Blockchain Law II (Loi du 22 janvier 2021) let the issuance account for dematerialised securities be kept on secure electronic recording devices, including distributed ledgers, and allowed investment firms and credit institutions to act as central account keepers for unlisted debt securities.
Luxembourg permits crypto trading and exchanges under MiCA: on 14 October 2026 the ESMA interim register listed 13 Luxembourg CASP entries supervised by the CSSF, including Bitstamp Europe S.A. for operating a crypto-asset trading platform.
The Luxembourg VASP definition (AML law Art 1(20quater), inserted by the Loi du 25 mars 2020, Mémorial A n° 194) covered exchange between virtual assets and fiat, exchange between virtual assets, transfer and custody; Art 11 of the Loi du 6 février 2025 repealed it and defined crypto-asset service providers by reference to MiCA Art 3(1)(15).
AML/KYC Requirements
The Law of 12 November 2004 on the fight against money laundering and terrorist financing (ELI /eli/etat/leg/loi/2004/11/12/n1/jo) is Luxembourg's core AML/CFT statute. A Law of 25 March 2020 (a194) transposing Directive (EU) 2018/843 added virtual asset service providers to it, and a second Law of 25 March 2020 (a193) inserted the CSSF VASP registration (Art 7-1). Since the loi du 6 février 2025, Art 2(1) point 20 covers crypto-asset service providers and Art 7-1 is repealed.
CSSF Regulation N° 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing is published in the Journal officiel (ELI /eli/etat/leg/rcsf/2012/12/14/n1/jo) and is listed as in force by Legilux; it details the AML/CFT professional obligations of the AML law of 12 November 2004 for professionals supervised by the CSSF, including reporting to the "responsable du contrôle de la LBC/FT" (AML/CFT compliance officer).
Under Art 3(2)(b) of the Luxembourg AML law of 12 November 2004, customer due diligence includes identifying the beneficial owner and taking reasonable measures to verify their identity. Art 1(7) treats a shareholding of 25% of the shares plus one, or an ownership interest of more than 25%, held by a natural person as an indication of direct ownership; for trusts and fiducies the beneficial owners include the settlor, trustees, beneficiaries and any person exercising ultimate control.
Luxembourg's Register of Beneficial Owners (RBE) was instituted by the Law of 13 January 2019; Art 12 opens the listed beneficial-owner data to any person. Under Art 3(2) of the AML law of 12 November 2004, professionals including crypto-asset service providers must not rely exclusively on central registers such as the RBE to meet their customer due diligence obligations.
Suspicious transaction reports in Luxembourg go to the Cellule de renseignement financier (CRF), the financial intelligence unit: professionals, including crypto-asset service providers, must inform the CRF without delay when they know or suspect money laundering or terrorist financing (AML law of 12 November 2004, Art 1(28) and Art 5(1)(a)).
Under Art 5(5) of the Luxembourg AML law of 12 November 2004, professionals, including crypto-asset service providers, and their managers and employees must not disclose to the customer or to third parties that information has been or will be reported to the authorities or that a CRF investigation is under way or may be opened.
The CSSF supervises banks, investment firms, payment and e-money institutions and other professionals of the financial sector; it is the AML/CFT supervisor for the professionals it supervises, authorises or registers (AML law of 12 November 2004, Art 2-1(1)) and the competent authority for MiCA (Art 20-27) and the Transfer of Funds Regulation (Art 20-38) under the law of 16 July 2019 as amended by the loi du 6 février 2025. VASPs registered under the AML law could continue only until 1 July 2026 (Art 24-1).
The CSSF is the AML/CFT supervisory authority for the professionals it supervises, authorises or registers, including crypto-asset service providers (AML law of 12 November 2004, Art 2-1(1)), and can impose administrative sanctions under Art 8-4. The CSSF VASP registration under former Art 7-1 was repealed by the loi du 6 février 2025; registered VASPs could continue only until 1 July 2026 (Art 24-1), and crypto-asset services now require CSSF authorisation under MiCA (Art 20-27, law of 16 July 2019).
Since MiCA (Regulation (EU) 2023/1114) e-money tokens are deemed electronic money (Art 48(2)) and may be offered to the public only by their issuer authorised as a credit institution or an electronic money institution (Art 48(1)); in Luxembourg the CSSF is the competent authority under Art 20-27 of the law of 16 July 2019 as inserted by the loi du 6 février 2025. The national e-money statute is the Loi du 20 mai 2011 transposing Directive 2009/110/EC.
Under MiCA Art 48(1) an e-money token may be offered to the public only by its issuer authorised as a credit institution or an electronic money institution that has notified a white paper; in Luxembourg the CSSF supervises these issuers (Art 20-27, law of 16 July 2019 as inserted by the loi du 6 février 2025). On 14 October 2026 the ESMA interim register listed 5 e-money-token white papers from 3 Luxembourg issuers (Banking Circle S.A., AIEU Services Limited S.A., Bridge Building S.A.).
Issuers of asset-referenced tokens must be authorised by the competent authority of their home Member State under MiCA Art 21, or be a credit institution complying with Art 17 (MiCA Art 16(1)); in Luxembourg that authority is the CSSF (Art 20-27 of the law of 16 July 2019 as inserted by the loi du 6 février 2025).
The Loi du 12 novembre 2004 relative à la lutte contre le blanchiment et contre le financement du terrorisme (ELI /eli/etat/leg/loi/2004/11/12/n1/jo; consolidated version of 8 August 2026) transposes the EU AML directives and, under Art 2(1) point 20, applies to crypto-asset service providers.
In Luxembourg, issuers of e-money tokens must be credit institutions or electronic money institutions (MiCA Art 48(1)), which are professionals subject to the AML law of 12 November 2004 under Art 2(1) point 1; crypto-asset service providers are professionals under Art 2(1) point 20. Art 2(1) does not list issuers of asset-referenced tokens as a separate category.
Travel Rule
Travel-rule obligations for crypto-asset service providers in Luxembourg apply since 30 December 2024 under Regulation (EU) 2023/1113, not from 10 July 2027; the CSSF is the competent authority (Art 20-38 of the law of 16 July 2019 as inserted by the loi du 6 février 2025) and may impose fines under Art 20-41.
Luxembourg licenses crypto-asset service providers: the CSSF is the competent authority for MiCA (Art 20-27 of the law of 16 July 2019 as inserted by the loi du 6 février 2025) and can impose administrative fines (Art 20-31). Separately, the Law of 19 December 2020 on financial restrictive measures applies to all persons operating in or from Luxembourg (Art 3).
The CSSF (Commission de Surveillance du Secteur Financier) is the AML/CFT supervisory authority for credit institutions and the professionals it supervises, authorises or registers (AML law of 12 November 2004, Art 2-1(1)) and a supervisory authority for financial restrictive measures under the Law of 19 December 2020 (Art 2(8), 6(2)).
Under Art 3 of the Luxembourg Law of 19 December 2020, financial restrictive measures bind Luxembourg nationals residing or operating in Luxembourg or abroad, legal persons with their seat, a permanent establishment or centre of main interests in Luxembourg, branches of Luxembourg legal persons abroad and of foreign legal persons in Luxembourg, and any other person operating on Luxembourg territory.
Luxembourg's regime for crypto-asset service providers is CSSF authorisation under MiCA (law of 16 July 2019, Art 20-27, inserted by the loi du 6 février 2025). The earlier CSSF registration of virtual asset service providers (AML law Art 7-1) was repealed; registered VASPs could operate until 1 July 2026 or an earlier MiCA decision (Art 24-1).
Under the Luxembourg Law of 19 December 2020 the CSSF is a supervisory authority (Art 2(8)) that monitors implementation of financial restrictive measures by the persons it supervises, with the AML-law powers of Art 8-2 and sanctions of Art 8-4 (Art 6(2), 6(4)). The CSSF is also the licensing authority for crypto-asset service providers under MiCA (law of 16 July 2019, Art 20-27).
The Luxembourg Law of 19 December 2020 on the implementation of financial restrictive measures (Mémorial A n° 1072) applies to Luxembourg nationals, Luxembourg legal persons and their branches, and any person operating in Luxembourg (Art 3). The Grand-ducal Regulation of 14 November 2022 requires the measures to be executed without delay and without prior notification, and the Minister of Finance to be informed without delay.
Luxembourg has a crypto-asset licensing regime: the CSSF authorises crypto-asset service providers under MiCA (Art 20-27 of the law of 16 July 2019 as inserted by the loi du 6 février 2025). On 14 October 2026 the ESMA interim MiCA register listed 13 entries with home Member State Luxembourg, including Bitstamp Europe S.A., Coinbase Luxembourg S.A. and Clearstream Banking S.A. (an Art 60 notification).
Luxembourg enacted several laws on 27 October 2010: the omnibus law strengthening the AML/CFT framework (ELI …/2010/10/27/n1/jo) amended the AML law and other acts, while the separate law implementing UN Security Council resolutions and EU financial restrictive measures (…/n3/jo) was repealed by Art 11 of the Law of 19 December 2020, which now governs financial sanctions.
Luxembourg's central electronic data retrieval system was set up by the Law of 25 March 2020 (Mémorial A n° 193) for payment accounts and bank accounts identified by an IBAN and safe-deposit boxes held by credit institutions in Luxembourg; account-keeping professionals must hold a data file the CSSF can access. The 2020 law does not cover crypto-asset accounts.
Breaches of financial restrictive measures in Luxembourg are criminal offences punishable by imprisonment of eight days to five years and a fine of €12,500 to €5,000,000, or one of them (Law of 19 December 2020, Art 10); the CSSF monitors implementation by the persons it supervises with the AML-law powers and administrative sanctions of Art 8-2 and 8-4 (Art 6(2), 6(4)).
Luxembourg's tax administration issued guidance on virtual currencies in circular L.I.R. n° 14/5 – 99/3 – 99bis/3 of 26 July 2018: virtual currencies are not a currency but intangible assets, gains on disposals within six months are speculation gains under Art 99bis L.I.R., untaxed if the year's total gain is under €500, with weighted-average cost where individual identification is impossible.
The EU Transfer of Funds Regulation (EU) 2023/1113 has applied to crypto-asset transfers in Luxembourg since 30 December 2024; the loi du 6 février 2025 made the CSSF its competent authority (Art 20-38 of the law of 16 July 2019) and set CSSF fines (Art 20-41), and AML law Art 7-1bis requires CASPs to assess and mitigate the risk of transfers to or from self-hosted addresses.
The CSSF is Luxembourg's national competent authority for authorising crypto-asset service providers under MiCA (Art 20-27 of the law of 16 July 2019, inserted by the loi du 6 février 2025); its decisions can be appealed to the administrative tribunal within one month (Art 20-36).
Tax Reporting
For individual income tax, income realised with a virtual currency is taxable only if it falls within commercial profit (Art. 14 L.I.R.) or revenus nets divers (Art. 99 L.I.R.); paying in a virtual currency does not change the tax nature of the income received (ACD circular of 26 July 2018).
Exchanging a virtual currency for another virtual currency, for euros, or for goods or services is a disposal for consideration (Art. 102(1a) L.I.R.); for individuals the gain is a speculation gain under Art. 99bis L.I.R. if held six months or less, untaxed when the year’s total is under €500 (ACD circular of 26 July 2018).
A loss on exchanging a virtual currency held six months or less is a speculation loss within Art. 99bis L.I.R. (ACD circular of 26 July 2018); the circular sets no rule on offsetting such losses.
Crypto income is commercial profit under Art. 14 L.I.R. when there is an independent, permanent profit-seeking activity; the ACD circular of 26 July 2018 lists as indicators dedicated premises or organisation, borrowed capital, frequent turnover of holdings and trading for third parties.
Virtual-currency income from a commercial activity is commercial profit under Art. 14 L.I.R. irrespective of holding period, since the Art. 99bis six-month rule applies only absent a commercial enterprise; a commercial enterprise located in Luxembourg is also subject to municipal business tax (ACD circular of 26 July 2018).
Virtual-currency mining regularly meets the Art. 14 L.I.R. conditions for commercial profit; mining that does not meet all those criteria may produce miscellaneous income under Art. 99 no. 3 L.I.R. (ACD circular of 26 July 2018).
In a commercial crypto activity, operating expenses such as electricity for mining or exchange-platform conversion fees, and depreciation of IT infrastructure, are deductible only if caused exclusively by the business (Art. 45 L.I.R.; ACD circular of 26 July 2018).
For Luxembourg income tax, municipal business tax and net wealth tax, virtual currencies such as bitcoin are intangible assets (biens incorporels) and are not a currency (ACD circular L.I.R. n° 14/5 – 99/3 – 99bis/3 of 26 July 2018).
For individuals outside a commercial activity, a gain on a virtual currency sold or exchanged within six months of acquisition is a speculation gain under Art. 99bis L.I.R. (revenus nets divers) and is not taxable when the year’s total speculation gain is under €500 (ACD circular L.I.R. n° 14/5 – 99/3 – 99bis/3 of 26 July 2018).
Outside a commercial activity, a gain on a virtual currency held for more than six months is not a speculation gain under Art. 99bis L.I.R.; the ACD circular of 26 July 2018 taxes virtual-currency income only as commercial profit (Art. 14) or as revenus nets divers (Art. 99).
Income of Luxembourg companies (collective entities under Art. 159 A nos. 1–2 L.I.R.), including gains on virtual currencies, is always commercial profit (Art. 162(3) L.I.R.) and, for an enterprise located in Luxembourg, is also subject to municipal business tax (ACD circular of 26 July 2018).
Taxpayers must keep coherent, continuous records of the acquisition date and costs of each virtual currency (§ 171 of the Abgabenordnung of 22 May 1931), and the burden of proving the holding period on disposal lies with the taxpayer (ACD circular of 26 July 2018).
Luxembourg taxpayers may not draw up annual accounts or declare taxable income in a virtual currency; income and expenses denominated in a virtual currency must be determined in euros or an ECB-quoted currency at the exchange rate of the transaction date (ACD circular of 26 July 2018).
Under the loi du 27 mars 2026 (DAC8), reporting crypto-asset service providers report to the Administration des contributions directes by 30 June of the following year, first for calendar year 2026; failure to register or report carries a €5,000 fixed fine (Art. 8).
Luxembourg’s income tax statute (L.I.R.) is the loi modifiée du 4 décembre 1967 concernant l’impôt sur le revenu, the basis of the ACD virtual-currency circular of 26 July 2018 (Arts 14, 99, 99bis, 102 L.I.R.).
Luxembourg’s VAT statute is the loi modifiée du 12 février 1979 concernant la taxe sur la valeur ajoutée (published 19 February 1979, in force 1 January 1980).
The Luxembourg AML law of 12 November 2004 applies to crypto-asset service providers (Art 2(1) point 20, as amended by the loi du 6 février 2025); virtual asset service providers registered on 30 December 2024 remained subject to it until 1 July 2026 or an earlier MiCA decision (Art 24-1).
Custody Requirements
Custody regulation data collection in progress.
Stablecoin Regulation
Stablecoin regulation data collection in progress.
Securities Classification
Luxembourg has no 0–33% capital gains tax scale with a 12-month threshold for crypto-assets: under ACD circular L.I.R. n° 14/5 – 99/3 – 99bis/3 of 26 July 2018, a private gain on a virtual currency is a speculation gain (Art. 99bis L.I.R.) only if held six months or less, and is untaxed when the year’s total speculation gain is under €500.
Sanctions & Restrictions
Under Art 6(1) of the Luxembourg Law of 19 December 2020, persons applying financial restrictive measures must inform the Minister of Finance of each measure taken, including attempted transactions, without delay (Grand-ducal Regulation of 14 November 2022, Art 2); the CSSF supervises compliance by the professionals it oversees (Art 6(2)). Suspicions of money laundering or terrorist financing are reported to the CRF under Art 5(1) of the AML law.
Under Art 4(1) of the Luxembourg AML law of 12 November 2004, professionals designate among their management body or effective management the person responsible for compliance with AML/CFT professional obligations (responsable du respect, RR) and appoint, at an appropriate level, a compliance officer (responsable du contrôle du respect des obligations, RC).
Under Art 8-4 of the Luxembourg AML law of 12 November 2004, administrative fines reach twice the benefit derived from the breach where determinable, or €1,000,000; for credit and financial institutions the ceiling rises to €5,000,000 or 10% of total annual turnover for legal persons and €5,000,000 for natural persons. Obstruction fines range from €250 to €250,000.
The Luxembourg AML law of 12 November 2004 provides no prison term for professionals: knowing breaches of the listed obligations are punished by a fine of €12,500 to €5,000,000 (Art 9). Breaching financial restrictive measures (sanctions) is punished by imprisonment of eight days to five years and a fine of €12,500 to €5,000,000, or one of them (Law of 19 December 2020, Art 10).
The €1,250,000 figure is the ceiling of administrative fines (€1,250 to €1,250,000, or twice the benefit) that the CSSF can impose under Art 5 of the Law of 25 March 2020 on account-keeping professionals that breach the IBAN account and safe-deposit-box data-file obligations; it is not an AML-law or sanctions-law ceiling, where the general AML administrative maximum is €1,000,000 (AML law Art 8-4(2)(f)).
In the Luxembourg AML law of 12 November 2004 (consolidated 8 August 2026), administrative sanctions and measures are in Art 8-4 to 8-9 and the criminal fine of €12,500 to €5,000,000 for knowing breaches is in Art 9, all in Title I.
Enforcement Actions
Until 1 July 2026 the CSSF kept a register of virtual asset service providers under former Art 7-1 of the AML law of 12 November 2004 (registration conditions in Art 7-1(3)–(6) applied until that date under Art 24-1). Art 7-1 was repealed by the loi du 6 février 2025; crypto-asset service providers now need CSSF authorisation under MiCA, and the ESMA interim register listed 13 Luxembourg entries on 14 October 2026.
Two Luxembourg laws of 25 March 2020 amended the AML law of 12 November 2004 for virtual asset service providers: one (Mémorial A n° 194) transposed Directive (EU) 2018/843 and defined VASPs, the other (Mémorial A n° 193) inserted Art 7-1 requiring VASPs to register with a CSSF register. Art 7-1 was repealed by the loi du 6 février 2025, and the register ran only until 1 July 2026 (AML law Art 24-1).
The CSSF register of virtual asset service providers lost its legal basis: the loi du 6 février 2025 repealed the VASP registration article (AML law Art 7-1), and VASPs registered on 30 December 2024 stayed on the register only until 1 July 2026 or an earlier MiCA decision (AML law Art 24-1). Authorised crypto-asset service providers appear in the ESMA interim MiCA register, which listed 13 entries with home Member State Luxembourg on 14 October 2026.
Research & Articles
Regulatory Forecast
high confidenceLikely enforcement action expected around 2026-08-13
Based on 42 historical regulatory events for Luxembourg, averaging every 32 days, with increasing regulatory activity.
Recent Updates
Key Impact on Custody: MiCA will introduce a harmonized, comprehensive regulatory framework for crypto-assets and...
Key Impact on Custody: MiCA will introduce a harmonized, comprehensive regulatory framework for crypto-assets and crypto-asset service providers across the EU.
CSSF Press Releases / News (General): Regularly updated with guidance and warnings, rather than specific enforcem...
CSSF Press Releases / News (General): Regularly updated with guidance and warnings, rather than specific enforcement actions with fines.
CSSF Warnings for Unlicensed Entities: The CSSF frequently issues warnings against entities that purport to offer...
CSSF Warnings for Unlicensed Entities: The CSSF frequently issues warnings against entities that purport to offer financial services in Luxembourg without proper authorization, including those related to crypto. These are general warnings rather than specific enforcement actions against a regulated VASP.
Not Banned: Luxembourg permits crypto trading and the operation of crypto exchanges.
Not Banned: Luxembourg permits crypto trading and the operation of crypto exchanges.
This means crypto exchanges, custodians, and other VASPs are subject to strict registration, licensing, and ongoing s...
This means crypto exchanges, custodians, and other VASPs are subject to strict registration, licensing, and ongoing supervisory requirements by the CSSF. While not directly tax law, this regulatory framework indirectly contributes to transparency and data collection relevant to potential tax compliance.
Powers: The CSSF may access any relevant documents, summon individuals for information, perform on‑site inspections, ...
Powers: The CSSF may access any relevant documents, summon individuals for information, perform on‑site inspections, issue injunctions, and impose administrative sanctions—including warnings, reprimands, fines, or occupational prohibitions. These actions are public and do not preclude criminal penalties for deliberate violations.
This profile is maintained by AI research workers and updated regularly. Connect via MCP for programmatic access.