Stablecoin issuer / redeemer in Luxembourg

Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA):

EUR-Lex MiCA Regulation

MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24-1 a VASP's CSSF registration ended when the CSSF granted or refused authorisation under MiCA Art 63, and in any event on 1 July 2026; the CSSF is the competent authority under Art 20-27 of the amended Law of 16 July 2019.

Explicit Requirement: MiCA explicitly mandates crypto-asset service providers offering custody services to:

Keep separate the crypto-assets of their clients from their own crypto-assets and ensure that this is achieved by using different blockchain addresses or distributed ledgers.

Keep separate the funds of their clients from their own funds, in accordance with national law.

MiCA Regulation (EU) 2023/1114, Article 3(1)(14) (Definition of "custody and administration of crypto-assets on behalf of third parties") and Title V (Authorization and operating conditions for crypto-asset service providers).

Prudential Requirements and Professional Indemnity Insurance: MiCA introduces specific prudential requirements for crypto-asset service providers. For custodians, it requires them to:

Hold own funds (capital requirements) or a professional indemnity insurance to cover liability risks from their operations. The amount will depend on the type of service and associated risks.

Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed by the Loi du 6 février 2025, so crypto custody now requires a MiCA authorisation or notification.

Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive 2018/843); Art 7-1 was repealed by Art 17 of the Loi du 6 février 2025.

CSSF Circular 22/811 (and previous versions like 20/747 and 21/769 which it consolidates/replaces): This circular provides detailed guidance on AML/CFT obligations for VASPs.

The Law of 12 November 2004 on the fight against money laundering and terrorist financing (ELI /eli/etat/leg/loi/2004/11/12/n1/jo) is Luxembourg's core AML/CFT statute. A Law of 25 March 2020 (a194) transposing Directive (EU) 2018/843 added virtual asset service providers to it, and a second Law of 25 March 2020 (a193) inserted the CSSF VASP registration (Art 7-1). Since the loi du 6 février 2025, Art 2(1) point 20 covers crypto-asset service providers and Art 7-1 is repealed.

CSSF Circular 20/747 (as amended by Circular 22/815): This circular is crucial for VASPs as it consolidates and specifies the AML/CFT professional obligations under the amended AML Law for all entities subject to CSSF supervision, including VASPs. It provides detailed guidance on risk assessment, customer due diligence, internal organisation, and reporting requirements.

Issuance of virtual assets: Services related to the offering or sale of new virtual assets.

Evidence fact lu.aml.identification-and-verification not found (may have been renamed).

Enhanced Due Diligence (EDD): Required for situations posing a higher ML/TF risk, including:

For corporate tax purposes: Treated as assets on the balance sheet, with profits/losses impacting ordinary taxable income.

Corporate Income Tax (CIT): Progressive rates, approximately 15% for profits up to €175,000, 17% for profits between €175,000 and €200,000, and 22.8% for profits over €200,000 (these rates are indicative and include the contribution to the employment fund).

Municipal Business Tax (MBT): Varies by commune, typically around 6.75% for Luxembourg City.