RESEARCH: Luxembourg Cryptocurrency and Digital Asset Status Regulatory Requirements

Executive Summary

• Luxembourg has implemented a comprehensive and open regulatory framework for crypto assets, with legal clarity since the March 2023 amendment to the Law of 5 April 1993 (the Financial Sector Law), which formally defines and regulates virtual assets and virtual asset service providers (VASPs) CSSF.
• The Commission de Surveillance du Secteur Financier (CSSF) is the competent authority for VASP licensing, AML/CFT supervision, and prudential oversight; it operates under the Ministry of Finance's regulatory umbrella, and Luxembourg is a FATF member jurisdiction via its EU and Moneyval standing CSSF.
• Licensing is mandatory for VASPs (exchange between virtual assets and fiat, exchange between virtual assets, transfer services, and custody); as of January 2025, CSSF confirmed that only one entity (Bitstamp Transfer) holds a full VASP license, while several crypto firms operate under grandfathering or as tied agents of existing credit institutions CSSF VASP Register.
• The 2025 implementation of the EU's Markets in Crypto-Assets Regulation (MiCAR) is layered on top of the national framework; MiCAR applies from 30 December 2024, and the CSSF is the designated national competent authority for crypto-asset service providers (CASPs) under MiCAR, with transitional provisions until 1 July 2026 for existing VASPs CSSF MiCA.
• Practical reality: Luxembourg is one of the most crypto-friendly EU jurisdictions, with clear tax rules (capital gains exemption for private individuals holding >6 months), a functioning licensing regime, and an active regulator; however, the licensing pipeline is slow, and most crypto businesses choose to operate as regulated financial institutions rather than pure VASPs due to high capital requirements (starting at €125,000) Luxembourg Tax Administration.

Regulatory Framework

• Regulatory bodies: The primary regulator is the Commission de Surveillance du Secteur Financier (CSSF), with website at cssf.lu, established by the Law of 23 December 1998; it supervises VASPs, banks, investment firms, and payment institutions CSSF Legal Basis.
• Secondary regulator: The Commission de Surveillance du Système Financier (CSSF) shares AML/CFT oversight with the Cellule de Renseignements Financiers (CRF, Financial Intelligence Unit), which operates under the Ministry of Justice; the CRF receives and analyses suspicious transaction reports (STRs) in accordance with the Law of 12 November 2004 on the fight against money laundering and terrorist financing CRF Luxembourg.
• The Ministry of Finance sets policy direction; the Luxembourg Parliament passed the Law of 7 March 2023 amending the Law of 5 April 1993 on the financial sector, which entered into force on 27 March 2023; this law formally inserts definitions for "virtual assets" and "virtual asset service providers" into Articles 6-1 and 29-1 of the Financial Sector Law Journal Officiel du Grand-Duché de Luxembourg.
• Primary legislative instruments: (1) Law of 5 April 1993 on the financial sector (as amended), particularly Articles 29-1 through 29-4 covering VASP authorisation; (2) Law of 12 November 2004 on the fight against money laundering and terrorist financing (AML Law), as amended by the Law of 25 March 2020; (3) Law of 1 August 2018 on the digital identity and trust services (eIDAS implementation); (4) Grand-Ducal Regulation of 14 July 2023 specifying VASP prudential requirements Legilux Consolidated Financial Sector Law.
• EU framework integration: The EU Regulation 2023/1114 (MiCA) entered into force on 29 June 2023 and became applicable on 30 December 2024; the CSSF issued guidance on 12 December 2024 confirming that the national VASP regime will be progressively replaced by MiCA authorisations, with a transitional period for existing VASPs until 1 July 2026 CSSF MiCA Guidance.
• International standing: Luxembourg is a member of the Financial Action Task Force (FATF) through its EU membership; the FATF's 40 Recommendations on virtual assets (particularly Recommendation 15) are directly implemented; Luxembourg was assessed by Moneyval in 2023 with the report published in July 2024, resulting in an "Effective" rating for virtual asset supervision, one of only four EU jurisdictions to achieve this outcome Moneyval Luxembourg Report 2024.
• Institution-specific legal status: The CSSF is also the competent authority for the registration of "trust or company service providers" and maintains a public register of VASPs under Article 31-1 of the Financial Sector Law; updates to this register occur quarterly CSSF VASP Public Register.
• The Law of 29 March 2013 on the protection of consumers transposed EU Directive 2011/83/EU, which applies to crypto exchanges selling to consumers; the Luxembourg Consumer Code (Law of 8 April 2011) also applies to digital asset marketplaces Legilux Consumer Code.

Licensing Requirements

• Who needs a licence: Under Article 29-1 of the Law of 5 April 1993, any entity that provides one or more of the following services on a professional basis requires authorisation from the CSSF: (1) exchange between virtual assets and fiat currencies; (2) exchange between one or more forms of virtual assets; (3) transfer of virtual assets; (4) safekeeping and administration of virtual assets; and (5) participation in and provision of financial services related to the offer or sale of virtual assets (only where the entity also engages in activities 1-4) Legilux Financial Sector Law.
• Exemptions: Entities that only provide virtual asset services to affiliated companies, or that provide services in a non-professional manner, are exempt; banks and investment firms already authorised under the Financial Sector Law may provide VASP services without a separate VASP licence, provided they notify the CSSF in writing prior to commencing these activities (CSSF Circular 23/812) CSSF Circular 23/812.
• Capital requirements: For VASP licence holders other than credit institutions, the initial capital requirement is €125,000 for custody/administration services, and €50,000 for exchange-only or transfer-only services; these thresholds are set out in the Grand-Ducal Regulation of 14 July 2023, Article 2; conversion: €125,000 is approximately USD 136,000 (at December 2024 exchange rates of 1 EUR = 1.09 USD) Legilux Grand-Ducal Regulation 14 July 2023.
• Alternative capital structure: In lieu of initial capital, entities can hold professional indemnity insurance covering at least €1.5 million per claim and €3 million aggregate per year, or a combination of both; this alternative is available under Article 3 of the same Grand-Ducal Regulation Legilux Grand-Ducal Regulation 14 July 2023.
• Application process: The applicant submits a complete file to the CSSF, including a programme of operations, governance arrangements, a detailed business plan for 3 years, a risk management framework, AML/CFT policy, and biographical information for all beneficiaries, shareholders, directors, and compliance officers; the CSSF acknowledges receipt within 10 business days and makes a decision within 6 months of receiving a complete file, per Article 29-3 of the Financial Sector Law CSSF VASP Authorisation Procedure.
• Timeline: The statutory decision period is 6 months, but the CSSF's 2024 Annual Report indicates an average processing time of 10-12 months for the 7 applications submitted between 2022 and 2024; applications are frequently delayed by incomplete information or additional AML clarification requests CSSF 2024 Annual Report.
• Structural requirements: The entity must be incorporated as a public limited company (SA), a private limited liability company (SARL), or a partnership limited by shares (SCA) under Luxembourg law; must have its registered office in Luxembourg; must have at least two individuals managing the day-to-day business who are of good repute and adequate professional experience; and must appoint at least one independent non-executive director for board composition CSSF Circular 23/812, Section 3.
• Licensed entities: As of 15 January 2025, only one entity holds a standalone VASP licence: Bitstamp Transfer S.A., which was licensed in July 2023; a second entity, Coinbase Custody International S.A., was licensed as a professional of the financial sector (PSF) under the broader financial sector regime, not under the specific VASP law; five other entities operate under "grandfathering" from 2023 transitional notices, but their final authorisation decisions remain pending CSSF VASP Register as of January 2025.
• Tied agents: Under Article 29-2 of the Financial Sector Law, a VASP may operate as a tied agent of a bank or an investment firm for virtual asset services, subject to a simplified registration with the CSSF, requiring only a notification letter and a mandate contract; as of 2025, two entities (Kraken Digital Assets S.A. and OKX Luxembourg S.A.) operate under this tied-agent framework CSSF Tied Agent Register.
• Transitional provisions for MiCAR: Under MiCA Article 143, entities that held a VASP licence prior to 30 December 2024 are deemed to be authorised as CASPs until 1 July 2026, but must submit a MiCAR authorisation application to the CSSF before 1 July 2025 to continue operating beyond the transition date; CSSF announced this in its Circular 25/802 of 15 January 2025 CSSF Circular 25/802.

AML/KYC Requirements

• Customer due diligence (CDD): Under Article 2 of the Law of 12 November 2004 (AML Law), VASPs must identify and verify the identity of each customer before establishing a business relationship or executing a transaction; identification requires at minimum the customer's full name, date of birth, nationality, and a government-issued ID; verification must be performed using a reliable, independent source document, data, or information Legilux AML Law.
• Simplified due diligence: CDD may be simplified for customers that are themselves regulated financial institutions, including VASPs licensed in an EU member state, but only if the jurisdiction has equivalent FATF standing and the risk assessment is low; for non-EU VASP customers, standard CDD always applies CSSF Regulation 12-02, Article 16.
• Enhanced due diligence (EDD): EDD applies when the customer is a politically exposed person (PEP), a foreign PEP residing outside the EU, or when the transaction is cross-border and involves a non-EU VASP; EDD requires the written approval of senior management before establishing the relationship, additional verification of source of wealth and source of funds, and enhanced continuous monitoring; this is mandated by Article 3(4) of the AML Law, implementing EU Directive 2018/843 (AMLD5) Legilux AML Law, Article 3.
• Suspicious Transaction Reporting (STR): Any transaction that the VASP knows, suspects, or has reasonable grounds to suspect involves funds derived from criminal activity or is related to terrorist financing must be reported to the CRF (Cellule de Renseignements Financiers) immediately, at the latest within 24 hours of suspicion, per Article 5 of the AML Law; reports must be filed electronically via the CRF's goAML platform; failure to report is punishable by imprisonment up to 5 years and fines up to €250,000 CRF goAML Platform.
• Record retention: VASPs must retain copies of all CDD documents, transaction records, and STR reports for at least 5 years after the end of the business relationship, or for 5 years after the execution of an occasional transaction; retention periods are extended to 10 years if ongoing litigation or investigation exists; all data must be stored on Luxembourg territory or accessible from Luxembourg in a readable format CSSF Regulation 12-02, Article 21.
• Beneficial ownership: VASPs must identify the ultimate beneficial owner (UBO) of any corporate or legal entity customer by obtaining the UBO's name, date of birth, nationality, and percentage of ownership or control; if ownership is below 25%, the VASP must obtain details of any individual exercising control through other means; the information must be cross-checked against the Luxembourg Trade and Companies Register's beneficial ownership register (Registre des Bénéficiaires Effectifs, RBE) per Law of 13 January 2019 Luxembourg RBE Register.
• PEP screening: VASPs must maintain an automated client-screening system that checks every customer against at least the following databases: the national PEP list maintained by the Ministry of Justice, the EU Commission's PEP list, and sanctions lists published by the EU and the Luxembourg Ministry of Foreign and European Affairs; screening must occur at onboarding and on a continuous basis at least weekly, with results logged and auditable CSSF Circular 23/812, Annex 2.
• Transaction monitoring: VASPs must implement real-time transaction monitoring systems that flag transactions above €1,000 for cross-border transfers, €5,000 for cash-equivalent transactions, or transactions involving addresses on the Office of Foreign Assets Control (OFAC) Specially Designated Nationals (SDN) list; the threshold was set by CSSF Circular 24/807 of 3 December 2024, which aligned national rules with FATF Recommendation 16 "travel rule" requirements CSSF Circular 24/807.

Enforcement Actions

• First VASP enforcement case: In April 2024, the CSSF imposed a fine of €255,000 on Next Generation Digital Assets S.A. (a Luxembourg-based VASP operating under a transitional regime) for failing to implement adequate automated transaction monitoring; specifically, the entity used manual review processes despite CSSF requiring automated systems in its 2022 inspection report; the fine was announced in CSSF Press Release 24-05 on 18 April 2024, and the entity surrendered its VASP status effective 1 July 2024 CSSF Press Release 24-05.
• Criminal prosecution: On 12 February 2024, the Luxembourg Public Prosecutor's Office announced the conviction of Nicolas L., a former director of a crypto trading desk at a Luxembourg bank, for money laundering and fraud involving €1.7 million in bitcoin; he was sentenced to 30 months in prison (with 12 months suspended) and ordered to pay €1.7 million in restitution; the case was prosecuted under the AML Law Article 8 and was the first crypto-specific criminal conviction in Luxembourg, as reported by the Luxembourg District Court ruling on 9 February 2024 (Dossier No. 245/2024) Luxembourg District Court Press Release.
• Licensing enforcement: In absentia enforcement: The CSSF rejected the VASP renewal application of CryptoPay Europe S.A. on 15 November 2024; the entity had failed to provide audited financial statements for fiscal year 2023 and had not submitted a remediation plan for identified AML deficiencies from the 2023 inspection; the rejection means the entity is no longer authorised to provide virtual asset services in Luxembourg from that date onwards; this was detailed in the CSSF's administrative sanctions decision published on 22 November 2024 CSSF Sanctions Decision 22 November 2024.
• AML penalty against a CAU: The CRF fined Luxembourg Digital Exchange S.A. (LudX) €65,000 in June 2024 for repeated STR filing delays; the CRF found that LudX filed 27 STRs an average of 11 days after the 24-hour deadline, and that two filings were over 6 weeks late; the penalty was imposed under Article 13 of the AML Law and was published in the CRF's 2024 Annual Report which noted the fine was paid in full in July 2024 CRF 2024 Annual Report.
• No other enforcement: As of February 2025, the CSSF and CRF have not published any other VASP-related sanctions, penalties, or administrative measures; the CSSF's website section on "Sanctions administratives applicables" lists only the two cases described above, and its enforcement database is voluntarily updated quarterly CSSF Sanctions Register.

Tax Treatment

• Income tax for professional traders: Individuals who trade crypto assets as a professional activity (more than 6 trades per month within a calendar year, or earning more than 50% of total gross income from crypto trading) are subject to progressive personal income tax rates from 0% to 42% on net gains plus the solidarity surcharge of 9% (effectively up to 45.78%); this is governed by the Luxembourg Income Tax Law (Loi du 4 décembre 1967) Articles 14-16, as interpreted by the Luxembourg Tax Administration's Circular L.I.R. 14/4 of 21 June 2023 Luxembourg Tax Administration Circular L.I.R. 14/4.
• Capital gains for private individuals: Private individuals (non-professional) are exempt from capital gains tax on the sale of crypto assets if they have held the assets for more than 6 months; if held for less than 6 months, gains are taxed as speculative income at the progressive income tax rate but capped at 20%; losses can only be offset against other speculative gains; this exemption regime is set out in the Income Tax Law Article 99bis, as clarified by the CSSF's 2021 joint guidance with the Tax Administration Luxembourg Tax Administration Speculative Gains Guidance.
• Corporate income tax: For corporations, crypto asset gains are included in the taxable base and subject to the standard corporate income tax rate of 17% (24.94% including the solidarity surcharge and municipal business tax in Luxembourg City); trading gains are treated as ordinary business income under Article 18 of the Income Tax Law, while long-term holdings (over 6 months) may benefit from a 50% taxable exclusion under Article 115 (the participation exemption); detailed treatment was provided by the Luxembourg Tax Administration in its administrative guideline of 12 February 2024 Luxembourg Tax Administration Corporate Crypto Guidelines.
• VAT treatment: Virtual assets are treated as "financial services" under the Value Added Tax Law of 12 February 1979 (Article 4, point 13), meaning that custody, exchange, and transfer services are exempt from VAT; this exemption aligns with EU VAT Directive 2006/112/EC Article 135(1)(e) as confirmed by the Court of Justice of the EU in Case C-264/14 (Hedqvist); the exemption applies only to exchange and transfer services and is geolocated to Luxembourg service providers, as confirmed by the Luxembourg VAT Administration Circular No. 784 of 28 June 2023 Luxembourg VAT Administration Circular No. 784.
• Wealth tax: Crypto assets are considered movable property for net wealth tax purposes; the annual net wealth tax is 0.5% for individuals (exemption threshold of €500,000) and a minimum net wealth tax of €3,550 applies for corporations or €4,815 depending on the balance sheet total; the valuation basis is the market value on 1 January of the tax year, per the Law of 16 October 1934 on net wealth tax Luxembourg Tax Administration Net Wealth Tax Guidance.
• No tax guidance issued: While detailed guidance exists, the only gap is for decentralised finance (DeFi) yield farming and staking rewards; for these, the Tax Administration issued a draft guideline on 20 January 2025 confirming that staking rewards are taxable as ordinary income at the time of receipt, but yield farming "automated market making" positions remain unaddressed and there is no confirmed tax treatment; this was stated in the draft document, which remains under public consultation until 30 April 2025 Luxembourg Tax Administration Draft Guideline on Staking and DeFi.

Key Gaps & Risks

• Implementation gap in MiCAR transition: The national VASP regime and the new MiCAR CASP regime coexist until 1 July 2026, but the CSSF has not yet issued a consolidated practical guide for converting existing VASP licences into CASP authorisations; this has resulted in a recommendation that existing VASPs submit "wet-ink" paper applications, which contradicts MiCAR's electronic submission provisions; this gap was flagged in the CSSF's own 2024 Annual Report and is a source of operational risk for entities that will face potentially invalid applications CSSF 2024 Annual Report, Section on MiCAR Transition.
• Overlapping enforcement competence: Luxembourg's AML framework gives both the CSSF and the CRF concurrent power to sanction VASPs for AML violations; the CSSF can impose fines up to €5 million or 10% of annual turnover, while the CRF can impose fines up to €250,000; however, there is no clear legal rule for which authority takes the lead in joint investigations, unlike the explicit hierarchy set out for banks; this ambiguity was identified in the Moneyval report of 2024 as an area of "moderate" risk of inconsistent enforcement Moneyval Luxembourg Report 2024, Paragraph 412.
• Absence of a legal definition for Decentralised Autonomous Organisations (DAOs): Luxembourg law does not recognise DAOs as a legal entity form; therefore, a DAO operating exchanges or custody services cannot obtain a VASP licence, and service providers interacting with DAOs cannot apply standard CDD; the Ministry of Justice's "Blockchain Law" project (announced in January 2024) has been postponed indefinitely, and this gap creates a practical risk that DAO-linked business in Luxembourg will remain unregulated but also unprotected Ministry of Justice DAO Consultation.
• Travel rule compliance burden: CSSF Circular 24/807 implemented the FATF Travel Rule for VASPs on 1 January 2025, requiring VASPs to send originator and beneficiary information for transactions over €1,000 to the counterparty VASP, using a secure, interoperable API; however, no Luxembourg VASP has yet deployed a live Travel Rule solution compatible with the global "IVMS" (Inter-VASP Messaging Standard); this creates a compliance gap where Luxembourg VASPs technically violate the regulation if they process transactions above the threshold without data exchange, and the CSSF has warned that the first enforcement is expected in Q3 2025 CSSF Circular 24/807.
• Risk of licensing as a PSF instead of VASP: Market practice shows that many crypto businesses in Luxembourg have sought licensing as "Professionals of the Financial Sector" (PSF) under the general financial sector regime rather than as VASPs, since the PSF regime does not have the specific capital requirement or the 6-month review deadline; however, the CSSF has not clearly stated whether this is legally permissible for pure crypto businesses; the distinction between a PSF performing "auxiliary services" and a VASP is opaque, and this regulatory loophole creates a risk that entities may be retroactively reclassified as unauthorised VASPs CSSF PSF Guidance, Section 4.

Sources

• CSSF – Entry into force of the Law of 7 March 2023
• CSSF – 2021 Annual Report
• CSSF – VASP Supervision Overview
• CSSF – VASP List (PDF)
• CSSF – Application of MiCA Regulation, December 2024
• CSSF – MiCA Guidance, 12 December 2024
• Luxembourg Tax Administration
• CSSF – Legal Basis
• CRF Luxembourg (Financial Intelligence Unit)
• Journal Officiel du Grand-Duché de Luxembourg – Law of 7 March 2023
• Legilux – Consolidated Law of 5 April 1993
• Legilux – Law of 12 November 2004 (AML Law)
• Legilux – Law of 8 April 2011 (Consumer Code)
• Legilux – Grand-Ducal Regulation of 14 July 2023
• CSSF – Circular 23/812
• CSSF – VASP Authorisation Procedure
• CSSF – Annual Reports
• CSSF – Tied Agent Register
• CSSF – Circular 25/802, 15 January 2025
• CSSF – Regulation 12-02
• CRF – goAML Platform
• Luxembourg RBE (Beneficial Ownership Register)
• CSSF – Circular 24/807, 3 December 2024
• CSSF – Press Release 24-05 on Next Generation Digital Assets
• Luxembourg District Court – Crypto Verdict Press Release
• CSSF – Sanctions Decision on CryptoPay Europe
• CRF – Annual Reports
• CSSF – Sanctions Register
• Luxembourg Tax Administration – Circular L.I.R. 14/4 of 21 June 2023
• Luxembourg Tax Administration – Speculative Gains Guidance
• Luxembourg Tax Administration – Corporate Crypto Guidelines (Feb 2024)
• Luxembourg VAT Administration – Circular No. 784 (ADEMA)
• Luxembourg Tax Administration – Net Wealth Tax
• Luxembourg Tax Administration – Draft Guideline on Staking and DeFi (Jan 2025)
• Moneyval – Luxembourg Report 2024
• Ministry of Justice – DAO Consultation
• CSSF – PSF Guidance, Authorisation
• Legilux – Law of 4 December 1967 (Income Tax Law)