Self-custodial wallet / non-custodial software in Luxembourg
Publisher of software where users hold their own private keys. The publisher never holds, controls, or has access to user funds.
Self-custodial wallet is conditionally permitted in Luxembourg with a local entity, subject to AML obligations and low licensing burden.
Verdict Details
- Permitted
- conditional
- Local entity required
- Yes
- Licensing burden
- Low
- Last updated
- 2026-07-13
AML Obligations
- No AML obligations attach directly to the non-custodial wallet software publisher under Luxembourg law, because the publisher never holds, controls, or has access to user private keys or funds — this activity does not constitute 'custodian wallet services' under the Law of 12 November 2004 AML Law.
- If the publisher were to engage in any custodial, exchange, or transfer activities (e.g., an integrated swap feature where the publisher controls keys temporarily), it would trigger VASP registration and full AML/CFT obligations under the AML Law including: customer due diligence (CDD), beneficial ownership identification, ongoing transaction monitoring, suspicious transaction reporting (STRs) to the CSSF, and enhanced due diligence (EDD) for PEPs, high-risk jurisdictions, or complex transactions.
- The CSSF's Circulars 20/747, 22/811, and 23/843 provide detailed AML/CFT guidance for registered VASPs; these do not apply to pure non-custodial software publishers.
Key Restrictions
- Pure non-custodial wallet software publishing does not meet the legal definition of 'custodian wallet services' under Luxembourg law (which requires safeguarding private cryptographic keys on behalf of customers), so no VASP registration is required solely for publishing such software.
- The publisher must not, at any point, hold, store, or control user private keys or funds — any incidental custody (e.g., temporary key holding during a swap) would trigger VASP classification.
- There is no explicit consumer-protection or disclosure regime for non-custodial wallet software under current Luxembourg law; however, general consumer protection laws (e.g., Luxembourg Consumer Code) may apply to software-as-a-product distribution.
Key Risks
- Regulatory ambiguity risk: The line between 'custodial' and 'non-custodial' may be tested by the CSSF if the software includes integrated features (swaps, fiat on-ramps, staking) where the provider exercises any control over keys or funds.
- MiCA's upcoming full authorization regime (Regulation (EU) 2023/1114) may broaden the definition of 'custody and administration of crypto-assets' — future guidance could capture some non-custodial services if the provider's software interacts with third-party custodians or manages protocol-level custody.
- Enforcement risk is low for pure software publishers today, but the CSSF maintains a proactive stance and could issue warnings or cease-and-desist orders if it determines an integrated feature crosses into VASP activity.
- No confirmed enforcement precedent for non-custodial software publishers in Luxembourg — lack of public enforcement does not guarantee immunity from future regulatory scrutiny.
Evidence
This verdict synthesizes the following facts. Each fact links to its primary source(s).
Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed by the Loi du 6 février 2025, so crypto custody now requires a MiCA authorisation or notification.
Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive 2018/843); Art 7-1 was repealed by Art 17 of the Loi du 6 février 2025.
Crypto-asset service providers are obliged professionals under Art 2(1) point 20 of the Luxembourg AML law and must meet its professional obligations (risk assessment, customer due diligence, internal organisation, cooperation and suspicious-transaction reporting, Arts 2-2 to 5), supervised by the CSSF (Art 2-1).
Law of 12 November 2004 on combating money laundering and terrorist financing (as amended, including by the Law of 25 March 2020 on virtual assets):
CSSF Circular 22/811 (and previous versions like 20/747 and 21/769 which it consolidates/replaces): This circular provides detailed guidance on AML/CFT obligations for VASPs.
Directive (EU) 2018/843 (5th AML Directive): Critically, this directive extended the scope of AML/CFT rules to include virtual asset service providers, bringing them under the regulatory purview.
The Law of 12 November 2004 on the fight against money laundering and terrorist financing (ELI /eli/etat/leg/loi/2004/11/12/n1/jo) is Luxembourg's core AML/CFT statute. A Law of 25 March 2020 (a194) transposing Directive (EU) 2018/843 added virtual asset service providers to it, and a second Law of 25 March 2020 (a193) inserted the CSSF VASP registration (Art 7-1). Since the loi du 6 février 2025, Art 2(1) point 20 covers crypto-asset service providers and Art 7-1 is repealed.
Custodial wallet providers: Entities that provide services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual assets.
CSSF Circular 20/747 (as amended by Circular 22/815): This circular is crucial for VASPs as it consolidates and specifies the AML/CFT professional obligations under the amended AML Law for all entities subject to CSSF supervision, including VASPs. It provides detailed guidance on risk assessment, customer due diligence, internal organisation, and reporting requirements.
Evidence fact lu.aml.identification-and-verification not found (may have been renamed).
Enhanced Due Diligence (EDD): Required for situations posing a higher ML/TF risk, including:
Evidence fact lu.enforcement.focus-on-registration-and-amlcft not found (may have been renamed).
The CSSF register of virtual asset service providers lost its legal basis: the loi du 6 février 2025 repealed the VASP registration article (AML law Art 7-1), and VASPs registered on 30 December 2024 stayed on the register only until 1 July 2026 or an earlier MiCA decision (AML law Art 24-1). Authorised crypto-asset service providers appear in the ESMA interim MiCA register, which listed 13 entries with home Member State Luxembourg on 14 October 2026.
MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24-1 a VASP's CSSF registration ended when the CSSF granted or refused authorisation under MiCA Art 63, and in any event on 1 July 2026; the CSSF is the competent authority under Art 20-27 of the amended Law of 16 July 2019.
Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):
CSSF Warnings for Unlicensed Entities: The CSSF frequently issues warnings against entities that purport to offer financial services in Luxembourg without proper authorization, including those related to crypto. These are general warnings rather than specific enforcement actions against a regulated VASP.
Verdict Attribution
- Source:
- AI-Generated · Unreviewed
- AI synthesized:
- 2026-07-13 (deepseek-chat)
- Last updated:
- 2026-07-13
- Confidence:
- high
This verdict was produced by an AI model from the underlying facts. Confirm with counsel before relying on it for material decisions.
Conditional — A non-custodial wallet software publisher that never holds or controls user private keys is not classified as a VASP under Luxembourg law and faces no AML registration obligations, but must ensure no incidental custody occurs and should monitor MiCA's evolving scope for custodial-like services.
Questions this verdict aims to answer
- Does software publishing trigger VASP / MSB classification?
- Do AML obligations attach when no custody exists?
- What disclosure or consumer-protection rules apply?