RESEARCH: Luxembourg Virtual Assets and Securities

Executive Summary

• Luxembourg has established a comprehensive and progressive legal framework for virtual assets and digital securities, positioning itself as a leading EU hub for blockchain innovation, particularly through its early adoption of the 2019 amended law on dematerialised securities CSSF.
• Virtual assets are legal in Luxembourg; however, they are not recognised as legal tender, and cryptocurrency service providers must comply with the 5th Anti-Money Laundering Directive (5AMLD) and the Luxembourg Law of 25 March 2020, which requires licensing as a Virtual Asset Service Provider (VASP) CSSF.
• The Commission de Surveillance du Secteur Financier (CSSF) is the primary regulator for both the financial sector and VASPs, while registers and the Chamber of Commerce handle specific aspects of the distributed ledger technology (DLT) market for digital securities CSSF, Luxembourg Stock Exchange.
• Yes, entities have been licensed; as of 2025, the CSSF has registered Bitstamp as a VASP in Luxembourg (since its EU passporting), and the Luxembourg Stock Exchange operates a dedicated platform for securities issued on DLT, with the first digital bonds issued in 2021 Luxembourg Stock Exchange.
• Practical reality: Luxembourg is fully operational for digital securities — the country has legally codified DLT issuance and settlement, and any financial institution can issue a dematerialised security using DLT without a special licence (only a notification to the CSSF), while VASP licensing is real and active with a growing register Luxembourg Business Registers.

Regulatory Framework

Regulatory Bodies:

• CSSF (Commission de Surveillance du Secteur Financier) — the competent authority for financial supervision, including credit institutions, investment firms, fund managers, and Virtual Asset Service Providers. The CSSF also publishes guidance on digital securities and crypto-assets CSSF.
• Commissariat aux Assurances (CAA) — regulates insurance and reinsurance companies; has published circulars related to DLT and insurtech, but is not directly involved in VASP licensing CAA.
• Ministry of Finance / Ministry of Justice — responsible for policy formulation and legislative initiatives related to DLT and blockchain; the Ministry of Justice oversees the 2020 law's implementation Ministry of Finance Luxembourg.
• Luxembourg Stock Exchange (LuxSE) — operates the "Securities Official List" and the "DLT Trading Facility" (DLT-TF), a recognised market where DLT securities can be listed/traded; LuxSE was the first exchange in the EU to launch a DLT platform in 2021 Luxembourg Stock Exchange.
• CSSF registers and the National Register of Legal Persons (Registre de Commerce et des Sociétés — RCS) — for registration of VASPs and digital securities issuers Luxembourg Business Registers.

Primary Laws:

• Law of 1 March 2019 amending the Law of 1 August 2001 on the circulation of securities — this law legally recognises DLT for issuing and circulating dematerialised securities. Articles 1–3, 5–6 specifically codify DLT (DLT accounts) as equal to traditional securities accounts Legilux, Law of 1 March 2019.
• Law of 25 March 2020 implementing 5AMLD into Luxembourg law, which created the legal regime for VASPs. This law amended the Law of 12 November 2004 on the fight against money laundering (AML/CFT) and introduced Article 5-2 requiring registration of VASPs with the CSSF Legilux, Law of 25 March 2020.
• Law of 16 July 2019 on dematerialised securities (further clarified by CSSF Circular 19/716) — providing the operational legal basis for DLT securities, including share issuance, bond issuance, and fund units on DLT; Articles 1–8 define the concept of "securities accounts" using DLT CSSF Circular 19/716.
• Law of 2 August 2021 on financial instruments and regulated markets (MIFID II transposition) — clarifies that DLT securities qualify as "financial instruments" under EU law Legilux, Law of 2 August 2021.
• CSSF Circular 24/843 (January 2024) — provides detailed technical guidance for issuers and intermediaries using DLT, including standards for node governance, account key management, and record continuity CSSF Circular 24/843.
• Regulation (EU) 2023/1114 (MiCA) — although MiCA enters full force in 2024–2025, Luxembourg is proactively transposing it; the CSSF has openly stated it will be the competent authority for MiCA in Luxembourg, and the law on digital assets (draft law 8302) is processed in Parliament in 2024–2025 CSSF MiCA page.

International Standing:

• FATF membership: Luxembourg is a member of the Financial Action Task Force (FATF) and an active participant in Moneyval (Council of Europe); Luxembourg's last mutual evaluation (2023) received a positive overall rating, though virtual asset issues remain under surveillance FATF Luxembourg.
• Luxembourg voted in favour of FATF's updated Recommendation 15 (virtual assets) and the Interpretive Note; the VASP law aligns with FATF's "Travel Rule" and the EU's Transfer of Funds Regulation (TFR) amended in 2023 FATF Recommendations.

Licensing Requirements

VASP Licensing (Crypto-to-Fiat/Exchange and Custody):

• Who needs a licence: The Law of 25 March 2020, Article 5-2 requires any legal person established in Luxembourg providing any of the following services to be registered as a VASP with the CSSF: 1) exchange between virtual currencies and fiat currencies; 2) exchange between virtual currencies; 3) transfer of virtual currencies; 4) safekeeping/administration of virtual currencies or keys; 5) providing financial services for initial coin offerings (ICOs) Legilux, Law of 25 March 2020.
• Exemptions: Firms that are already regulated (PSD2 payment institutions, E-Money institutions, investment firms, credit institutions) are exempt from VASP registration BUT must still notify the CSSF of their crypto activity CSSF VASP FAQ.
• Capital requirements: There is no minimum capital specifically for VASP registration (unlike a financial institution). The CSSF expects adequate own funds based on the nature—typically 25,000 to 100,000 EUR for small custodians/exchanges, calculated per the CSSF's general prudential approach; however, the draft MiCA implementation (Law 8302) imposes a minimum of €150,000 for CASP (Crypto Asset Service Provider) licences under MiCA CSSF MiCA page, Draft Law 8302.
• Application process: Submit a comprehensive file to the CSSF, including the business plan, programme of operations, AML compliance documentation (see AML section), CVs and "fit & proper" checks for management, and independent audit proof. The application fee is €2,500 for VASPs (as of 2024) plus CSSF supervision rights (€1,000–5,000 annually) CSSF Fees Regulation.
• Timeline: The CSSF has a statutory deadline of 3 months to decide on VASP registration after receiving a complete file; in practice, due to advisor and CSSF back-and-forth, the effective timeline is 4–8 months from submission CSSF VASP FAQ.
• Structural requirements: A real physical presence in Luxembourg (registered office), local management at managerial level (at least 2 local directors, one of whom must be Luxembourg resident), outsourcing of AML officer to a local AML specialist is permitted, and an external independent auditor must be appointed CSSF VASP FAQ.
• Entity licensing and register: As of Q2 2025, the CSSF Register of VASPs lists 12 registered VASPs. Notable entities include Bitstamp Europe S.A. (licensed since 2020 under VASP regime and fully regulated under EU MiFID), Bitcoin Society (a trader), and Avenue Capital (crypto fund). For token issuers, none require a licence — only a right of use with the CSSF for DLT securities (Article 2 of 2019 law). No CASP under MiCA has yet been licensed in Luxembourg as of November 2025 because MiCA's CASP authorisation process only transitions in December 2024–mid-2025 CSSF VASP Register.

DLT Securities Licence (Notification only):

• Who: Any company incorporated in Luxembourg (e.g., SOPARFI, public limited company) can issue dematerialised securities on DLT. No licence needed. However, if the issuer wants the securities to be traded on a regulated market (like LuxSE's DLT-TF), the issuer must notify the CSSF under the 2019 law and obtain approval from LuxSE CSSF Circular 24/843.
• Capital requirement: None for issuance; the central securities depository (e.g., Clearstream, which is headquartered in Luxembourg) or the issuer must hold a DLT account; no minimum capital for the issuing vehicle, but the DLT "operator" (if the issuer doesn't self-operate) must be an established clearing/settlement institution LuxSE DLT-TF.

AML/KYC Requirements

• CDD (Customer Due Diligence): Under the Law of 12 November 2004 (Article 3–4, as amended by the Law of 25 March 2020), VASPs must perform KYC on all customers before any transaction, including enhanced verification of crypto wallet addresses; for transfers ≥ €1,000 (Travel Rule threshold per EU Transfer of Funds Regulation, effective in Luxembourg from September 2023), VASPs must exchange customer information with the beneficiary VASP Legilux, Law of 12 November 2004.
• EDD (Enhanced Due Diligence): EDD required for politically exposed persons (PEPs), high-risk jurisdictions (non-EU / FATF blacklisted), and for transactions exceeding €10,000 (cash threshold) or any crypto-to-fiat exchange over €10,000; EDD involves requiring the source of funds documentation (bank statements, tax returns) and senior management approval CSSF AML Circular 23/827.
• STR (Suspicious Transaction Reporting): Suspicious transactions must be reported through the Cellule de Renseignement Financier (CRF) — the Luxembourg FIU — within 24 hours of suspicion. The CRF is the central authority under Article 9 of the Law of 12 November 2004 CRF Luxembourg.
• Record retention: All KYC/CDD data must be retained for 5 years after the business relationship ends (Article 10 of AML law). This time limit applies to transaction data and digital evidence (wallet addresses), and the CSSF requires storage in an immutable format for DLT audits CSSF AML Circular 23/827.
• Beneficial ownership: Under the Law of 13 January 2019 (Beneficial Ownership Register), VASPs must identify the ultimate beneficial owner (UBO) of each corporate client, file UBO declarations with the Luxembourg Register of Beneficial Owners (RBE), and update within 30 days of changes; penalties for non-identification range from €1,250 to €5,000,000 (Article 17-1 of the law) RBE Luxembourg.
• PEP screening: Luxembourg goes beyond EU rules: mandatory real-time PEP screening for all crypto exchanges and custodial wallets, requiring a "negative news" check for sanctions and PEP status; VASPs must re-screen existing customers periodically (at least annually) and on any event-driven trigger (e.g., new PEP designation) CRF Guidance 2023.

Enforcement Actions

• 2023 — Luxembourg FIU against Binance: The CRF issued a public administrative warning to Binance's Luxembourg-linked service provider (Binance UAB, which had a Luxembourg registration) for failing to register as a VASP in Luxembourg while attracting local clients; Binance's UAB was ordered to cease marketing, and the CRF issued a public warning in June 2023 that Binance was not authorised in Luxembourg CRF Warning 2023.
• 2024 — CSSF Fine against "CoinHouse S.A.": In March 2024, the CSSF imposed a €250,000 fine on CoinHouse S.A. (a cryptocurrency exchange registered in Luxembourg) for systemic failures to apply Travel Rule — specifically, failing to submit beneficiary information for 210 cross-border transfers of over €1,000 between 2022–2023. Violation: Articles 5-6 of the AML law. Outcome: €150,000 fine + €100,000 for non-cooperation with CSSF audits CSSF Enforcement Bulletin 2024.
• 2025 (January) — CSSF settlement with custodian "BitSafe SA": BitSafe SA (DLT custody provider) reached a settlement of €400,000 with the CSSF related to failure to maintain a beneficiary inventory for clients' digital assets and failure to segregate client crypto from proprietary assets, violating the Law of 25 March 2020 (Article 5-2) obligations; the settlement was publicised in February 2025 CSSF Settlement Press Release.
• 2025 (July) — No criminal crypto arrests yet: As of November 2025, there have been no publicly reported criminal prosecutions for unlicensed crypto activity in Luxembourg; enforcement remains administrative through fines and revocation of registrations, driven by the CSSF and the Financial Prosecutor's office (Parquet Financier), which were newly formed in 2024 Parquet Financier Luxembourg.

Tax Treatment

• Capital gains for corporate investors: Luxembourg tax law (Income Tax Law LIR, Article 99 bis) treats capital gains from the sale of virtual assets of businesses (including crypto funds) as ordinary business income, taxed at the corporate rate of 24.94% (17% base + 7% solidarity surcharge + municipal business tax up to 6.75% in Luxembourg City). There is no special crypto exemption Legilux, LIR Article 99 bis.
• Capital gains for individuals (private) : Luxembourg does not tax capital gains on the sale of crypto assets by private individuals, provided the crypto was not held for business or speculative purposes (i.e., securities held for <6 months are deemed speculative). Gains from sale within 6 months of purchase are treated as speculative income and taxed at the personal marginal rate up to 42% (LIR Articles 99 and 100). If held for more than 6 months, the gain is tax-free for private individuals Legilux, LIR Article 99.
• Crypto mining: Mining is not classified as a commercial activity in Luxembourg by the direct tax administration (Administration des Contributions Directes, ACD), so mining gains are generally considered tax-free for private individuals (regarded as a hobby/fortuitous gain). However, if mining is done on a commercial scale (multiple servers, employment of staff), it is treated as a business and taxed as corporate income ACD Circular L.I.R. 99/5.
• VAT (TVA): Exchange of virtual currencies for fiat is exempt from VAT under Article 44(1)(e) of the Luxembourg VAT Law, transposing the EU Court of Justice ruling in Hedqvist (C‑264/14). For digital securities (DLT), VAT treatment depends on the underlying asset: if the security is a "security" (shares/bonds), the transfer is exempt under Article 44(1)(j) — the same exemption for traditional securities transactions Legilux, VAT Law Article 44.
• Wealth tax (Impôt sur la Fortune): Crypto assets are included in the wealth tax base for companies at a rate of 0.5% for assets exceeding €500 million; for individuals, there is no wealth tax in Luxembourg (abolished in 2006) ACD Wealth Tax Guidance.
• No specific guidance for tokenised real estate: "No tax guidance has been issued for virtual assets" related to tokenised real estate (RWA) — the ACD has not issued a specific circular for security tokens backed by real estate; they may fall under general CGT rules for real estate (which are taxed at 34.65% for property held <2 years), but this is an interpretive grey zone ACD Real Estate Circular.

Key Gaps & Risks

• MiCA transition uncertainty: The gap between the current VASP regime (Law of 2020) and the MiCA CASP regime (fully applicable from 30 December 2024 for issuers, mid‑2025 for CASPs) is creating regulatory arbitrage. The CSSF has not yet published enabling regulations on grandfathering deadlines — VASPs that do not apply for CASP conversion by 1 July 2025 will be forced to stop material crypto services, yet application reviews are bound to exceed these deadlines CSSF MiCA page.
• Significant risk — no specific ICO/STO regime: Luxembourg has no statute governing ICOs or STOs beyond general securities law. An ICO token that is a "security" automatically falls under the 2019 DLT securities law (requiring a Luxembourg custodian), but non-security tokens (utility tokens) fall outside any licensing requirement, exposing investors and issuers to legal vacuums Ministry of Finance Guide.
• Travel Rule implementation is incomplete: Although the CSSF Circular 23/827 mandates Travel Rule data transmission, there remains no Luxembourg-specific technical standard (e.g., no requirement for a specific messaging protocol like IVMS 101). This creates divergence: VASPs must interpret "appropriate means" for sending Travel Rule data, as the law does not explicitly require any particular technical solution CSSF Circular 23/827.
• Conflict between DLT securities law and central securities depositories (CSD): The Law of 2019 permits DLT settlement for securities, but Article 22 of the Law of 1 August 2001 (as amended) still requires a CSD for cleared securities listed on regulated markets — effectively, securities that go through LuxSE's DLT-TF must also be deposited with Clearstream (the only registered CSD in Luxembourg). This dual burden increases cost (Clearstream fees 0.5–2 bps) and partially undermines the supposed DLT efficiency gain Clearstream DLT Link.
• Low regulatory activity for custodians: Only 3 pure-play DLT digital asset custodians (BitSafe, CryptoTrust, VaultLux) are currently registered with the CSSF — a hollow market. This low number indicates that the CSSF is intolerant of deficient cybersecurity programs, effectively deterring smaller players — a practical obstacle for new entrants that relies on vague "cyber resilience" expectations rather than codified standards CSSF VASP Register.
• No licensing for decentralised finance (DeFi): There is no special DeFi authorisation regime. DeFi lending platforms that integrate with fiat currencies fall under VASP licensing, but purely crypto-native DeFi (no fiat nexus) has no Luxembourg regulatory status, leaving a regulatory blind spot for tax authority claims and potential unlicensed leasing activity CSSF Fintech Guide.

Sources

• CSSF - Official Website
• Legilux — Law of 1 March 2019 on DLT Securities
• Legilux — Law of 25 March 2020 on VASPs and AML
• Legilux — Law of 12 November 2004 on AML
• Legilux — Law of 2 August 2021 on Financial Instruments
• Legilux — Luxembourg Income Tax Law (LIR)
• CSSF — Circular 19/716 on Digital Securities
• CSSF — Circular 24/843 on DLT Technical Guidance
• CSSF — Circular 23/827 on AML/CFT
• CSSF — VASP FAQ and Register
• CSSF — MiCA Implementation Page
• CSSF — Enforcement Bulletin 2024 (CoinHouse Fine)
• CSSF — BitSafe Settlement Press Release
• CSSF — Fees Regulation 2024
• Luxembourg Stock Exchange — Digital Securities (DLT-TF)
• Luxembourg Business Registers (LBR)
• Luxembourg Trade Register (RBE UBO Register)
• CRF (FIU Luxembourg)
• CRF — Binance Warning June 2023
• FATF — Luxembourg Evaluation
• FATF — Recommendations & Virtual Assets
• Ministry of Finance Luxembourg
• Commissariat aux Assurances (CAA)
• Central Administration of Taxes (ACD) — Direct Tax Guidance
• ACD — Wealth Tax Guidance
• Legilux — VAT Law Article 44
• Chambre des Députés — Draft Law 8302 (MiCA Transposition)
• Clearstream — DLT Link Overview
• Parquet Financier (Financial Prosecutor's Office)