Crypto ATM / kiosk operator in Luxembourg

Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed by the Loi du 6 février 2025, so crypto custody now requires a MiCA authorisation or notification.

Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive 2018/843); Art 7-1 was repealed by Art 17 of the Loi du 6 février 2025.

Crypto-asset service providers are obliged professionals under Art 2(1) point 20 of the Luxembourg AML law and must meet its professional obligations (risk assessment, customer due diligence, internal organisation, cooperation and suspicious-transaction reporting, Arts 2-2 to 5), supervised by the CSSF (Art 2-1).

CSSF Circular 22/811 (and previous versions like 20/747 and 21/769 which it consolidates/replaces): This circular provides detailed guidance on AML/CFT obligations for VASPs.

MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24-1 a VASP's CSSF registration ended when the CSSF granted or refused authorisation under MiCA Art 63, and in any event on 1 July 2026; the CSSF is the competent authority under Art 20-27 of the amended Law of 16 July 2019.

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):

Keep separate the crypto-assets of their clients from their own crypto-assets and ensure that this is achieved by using different blockchain addresses or distributed ledgers.

Keep separate the funds of their clients from their own funds, in accordance with national law.

However, the CSSF generally expects regulated entities to have adequate financial resources and robust risk management, which may include appropriate professional indemnity insurance to cover potential liabilities arising from operational failures, security breaches, or errors.

Prudential Requirements and Professional Indemnity Insurance: MiCA introduces specific prudential requirements for crypto-asset service providers. For custodians, it requires them to:

There are no explicit mandates for "cold storage" in Luxembourg's current regulations.

However, CSSF Circular 22/811 and the general principles of sound risk management dictate that VASPs must implement robust IT security measures and internal controls to protect virtual assets. This implicitly requires firms to adopt industry best practices for secure storage, which often involves a combination of hot, warm, and cold storage solutions, multi-signature wallets, Hardware Security Modules (HSMs), and comprehensive key management policies. The CSSF assesses the adequacy of these measures as part of the VASP registration and ongoing supervision.

Directive (EU) 2018/843 (5th AML Directive): Critically, this directive extended the scope of AML/CFT rules to include virtual asset service providers, bringing them under the regulatory purview.

The Law of 12 November 2004 on the fight against money laundering and terrorist financing (ELI /eli/etat/leg/loi/2004/11/12/n1/jo) is Luxembourg's core AML/CFT statute. A Law of 25 March 2020 (a194) transposing Directive (EU) 2018/843 added virtual asset service providers to it, and a second Law of 25 March 2020 (a193) inserted the CSSF VASP registration (Art 7-1). Since the loi du 6 février 2025, Art 2(1) point 20 covers crypto-asset service providers and Art 7-1 is repealed.

CSSF Regulation N° 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing is published in the Journal officiel (ELI /eli/etat/leg/rcsf/2012/12/14/n1/jo) and is listed as in force by Legilux; it details the AML/CFT professional obligations of the AML law of 12 November 2004 for professionals supervised by the CSSF, including reporting to the "responsable du contrôle de la LBC/FT" (AML/CFT compliance officer).

CSSF Circular 20/747 (as amended by Circular 22/815): This circular is crucial for VASPs as it consolidates and specifies the AML/CFT professional obligations under the amended AML Law for all entities subject to CSSF supervision, including VASPs. It provides detailed guidance on risk assessment, customer due diligence, internal organisation, and reporting requirements.

Exchange services: Exchanging virtual assets for fiat currencies or other virtual assets.

Evidence fact lu.aml.identification-and-verification not found (may have been renamed).

Verify identity using reliable, independent source documents, data, or information (e.g., government-issued photo ID, proof of address utility bill).

Under Art 3(2)(b) of the Luxembourg AML law of 12 November 2004, customer due diligence includes identifying the beneficial owner and taking reasonable measures to verify their identity. Art 1(7) treats a shareholding of 25% of the shares plus one, or an ownership interest of more than 25%, held by a natural person as an indication of direct ownership; for trusts and fiducies the beneficial owners include the settlor, trustees, beneficiaries and any person exercising ultimate control.

Luxembourg's Register of Beneficial Owners (RBE) was instituted by the Law of 13 January 2019; Art 12 opens the listed beneficial-owner data to any person. Under Art 3(2) of the AML law of 12 November 2004, professionals including crypto-asset service providers must not rely exclusively on central registers such as the RBE to meet their customer due diligence obligations.

Purpose and Intended Nature of the Business Relationship: Understand the rationale behind the customer's use of virtual asset services.

Scrutinize transactions undertaken throughout the course of the relationship to ensure they are consistent with the VASP's knowledge of the customer, their business, and risk profile.

Enhanced Due Diligence (EDD): Required for situations posing a higher ML/TF risk, including:

Politically Exposed Persons (PEPs), their family members, and close associates.

Transactions involving high-risk jurisdictions.

Complex or unusually large transactions, and all unusual patterns of transactions, that have no apparent economic or lawful purpose.

Evidence fact lu.enforcement.focus-on-registration-and-amlcft not found (may have been renamed).

Until 1 July 2026 the CSSF kept a register of virtual asset service providers under former Art 7-1 of the AML law of 12 November 2004 (registration conditions in Art 7-1(3)–(6) applied until that date under Art 24-1). Art 7-1 was repealed by the loi du 6 février 2025; crypto-asset service providers now need CSSF authorisation under MiCA, and the ESMA interim register listed 13 Luxembourg entries on 14 October 2026.

Failure to register or comply with AML/CFT obligations is a violation, and the CSSF's primary "enforcement" in such cases often involves:

Ordering non-compliant entities to cease operations.

Regulator: Commission de Surveillance du Secteur Financier (CSSF)

CSSF Circular 20/747: Revised prudential requirements for VASPs.

CSSF Circular 23/843: Updated guidance for VASPs on AML/CFT, reflecting new recommendations from the Financial Action Task Force (FATF).

Violation Type (General Focus): Non-compliance with AML/CFT obligations, operating without proper registration as a VASP, market abuse, consumer protection issues. Outcome (General): Refusal of VASP registration, official warnings, cease-and-desist orders, enhanced supervisory measures.