Luxembourg Compliance Report

Generated 2026-10-23

Partially Regulated

Regulatory Overview

Regulatory Status: Some rules exist but significant gaps; draft legislation or limited guidance
Key Regulator(s): European Parliament and of the Council
Primary Legislation: AML law Art 24-1, Directive 2018/843, Law of 12 November 2004 on the fight against money laundering and terrorist fina, MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24, MiCA Regulation (EU) 2023/1114, Article 67 (5) and Article 68 (specifically Arti, Art 20-27 of the amended Law of 16 July 2019, The Law of 12 November 2004 is frequently amended (consolidated text of 8 August, The Luxembourg AML law of 12 November 2004 is ELI /eli/etat/leg/loi/2004/11/12/n, Under Art 8-6 of the Luxembourg AML law, the CSSF must publish on its website ea, AML law Arts 2(1, The AMLD5 law is the Loi du 25 mars 2020 (Mémorial A n° 194) amending the Law of, The Legilux reference for the Luxembourg AMLD5 law of 25 March 2020 is /eli/etat, Loi du 1er mars 2019 portant modification de la loi modifiée du 1er août 2001 concernant la circulation de titres, Blockchain Law I (Loi du 1er mars 2019) added Art 18bis to the Law of 1 August 2, The Legilux reference for Blockchain Law I of 1 March 2019 is /eli/etat/leg/loi/, Blockchain Law II (Loi du 22 janvier 2021) let the issuance account for demateri, AML law Art 1(20quater, The loi du 6 février 2025 (Mémorial A n° 38) designates the CSSF as Luxembourg’s
Travel Rule: Adopted — Threshold: Implemented
Tax Reporting: For individual income tax, income realised with a virtual currency is taxable only if it falls within commercial profit (Art. 14 L.I.R.) or revenus nets divers (Art. 99 L.I.R.); paying in a virtual currency does not change the tax nature of the income received (ACD circular of 26 July 2018).. For corporate tax purposes: Treated as assets on the balance sheet, with profits/losses impacting ordinary taxable income.. For VAT purposes: Often treated as means of payment or equivalent to currency.. Exchanging a virtual currency for another virtual currency, for euros, or for goods or services is a disposal for consideration (Art. 102(1a) L.I.R.); for individuals the gain is a speculation gain under Art. 99bis L.I.R. if held six months or less, untaxed when the year’s total is under €500 (ACD circular of 26 July 2018).. These gains are subject to the individual's progressive income tax rates (up to 42% plus surcharges for the employment fund).

Key Facts

aml Directive (EU) 2015/849 (4th AML Directive): Laid the groundwork for strengthening AML/CFT rules across the EU. Directive (EU) 2018/843 (5th AML Directive): Critically, this directive extended the scope of AML/CFT rules to include virtual asset service providers, bringing them under the regulatory purview. Luxembourg National Law: The Law of 12 November 2004 on the fight against money laundering and terrorist financing (ELI /eli/etat/leg/loi/2004/11/12/n1/jo) is Luxembourg's core AML/CFT statute. A Law of 25 March 2020 (a194) transposing Directive (EU) 2018/843 added virtual asset service providers to it, and a second Law of 25 March 2020 (a193) inserted the CSSF VASP registration (Art 7-1). Since the loi du 6 février 2025, Art 2(1) point 20 covers crypto-asset service providers and Art 7-1 is repealed. CSSF Regulation N° 12-02 of 14 December 2012 on the fight against money laundering and terrorist financing is published in the Journal officiel (ELI /eli/etat/leg/rcsf/2012/12/14/n1/jo) and is listed as in force by Legilux; it details the AML/CFT professional obligations of the AML law of 12 November 2004 for professionals supervised by the CSSF, including reporting to the "responsable du contrôle de la LBC/FT" (AML/CFT compliance officer). CSSF Circular 20/747 (as amended by Circular 22/815): This circular is crucial for VASPs as it consolidates and specifies the AML/CFT professional obligations under the amended AML Law for all entities subject to CSSF supervision, including VASPs. It provides detailed guidance on risk assessment, customer due diligence, internal organisation, and reporting requirements. Exchange services: Exchanging virtual assets for fiat currencies or other virtual assets. Custodial wallet providers: Entities that provide services to safeguard private cryptographic keys on behalf of their customers, to hold, store and transfer virtual assets.
enforcement Until 1 July 2026 the CSSF kept a register of virtual asset service providers under former Art 7-1 of the AML law of 12 November 2004 (registration conditions in Art 7-1(3)–(6) applied until that date under Art 24-1). Art 7-1 was repealed by the loi du 6 février 2025; crypto-asset service providers now need CSSF authorisation under MiCA, and the ESMA interim register listed 13 Luxembourg entries on 14 October 2026. Failure to register or comply with AML/CFT obligations is a violation, and the CSSF's primary "enforcement" in such cases often involves: Issuing warnings for unregistered activities. Ordering non-compliant entities to cease operations. Intensive supervisory engagement, which can lead to operational changes but not necessarily a public fine. Significance: This proactive stance aims to prevent illicit activity rather than solely penalize it after the fact, which might explain the lack of numerous public fines. Extensive searches of the CSSF's official communications, press releases, and reputable financial news sources for the period of mid-2021 to mid-2024 do not reveal specific, public enforcement actions against named cryptocurrency entities with associated penalty amounts for non-compliance with virtual asset regulations. Luxembourg's regulatory actions, especially related to AML/CFT, can sometimes be resolved through administrative measures, enhanced supervision, or non-public agreements, rather than large public fines.
general Detection of missing or meaningless data (e.g., "xxxxx") Handling repeated failures by counterparties Management of transfers involving self-hosted wallets Deadlines for responding to information requests Customer Due Diligence (CDD) and Enhanced Due Diligence (EDD): Verification of customer identity, beneficial ownership, and purpose of transactions. Transaction Monitoring: Monitoring of transactions for suspicious activities. Suspicious Transaction Reporting (STRs): Obligation to report suspicious activities to the Financial Intelligence Unit (FIU). Internal Controls: Adequate internal governance arrangements, risk assessments, and compliance functions.
licensing Custodian wallet providers registered with the CSSF as VASPs under AML law Art 7-1 kept that registration only until 1 July 2026, or until the CSSF granted or refused MiCA authorisation if earlier (AML law Art 24-1); Art 7-1 was repealed by the Loi du 6 février 2025, so crypto custody now requires a MiCA authorisation or notification. Luxembourg's VASP registration was governed by Art 7-1 of the Law of 12 November 2004, inserted by the Loi du 25 mars 2020 (Mémorial A n° 193), while a companion Loi du 25 mars 2020 (Mémorial A n° 194) transposed AMLD5 (Directive 2018/843); Art 7-1 was repealed by Art 17 of the Loi du 6 février 2025. Crypto-asset service providers are obliged professionals under Art 2(1) point 20 of the Luxembourg AML law and must meet its professional obligations (risk assessment, customer due diligence, internal organisation, cooperation and suspicious-transaction reporting, Arts 2-2 to 5), supervised by the CSSF (Art 2-1). CSSF Circular 22/811 (and previous versions like 20/747 and 21/769 which it consolidates/replaces): This circular provides detailed guidance on AML/CFT obligations for VASPs. CSSF Circular 22/811 (English version) MiCA authorisation has replaced registration in Luxembourg: under AML law Art 24-1 a VASP's CSSF registration ended when the CSSF granted or refused authorisation under MiCA Art 63, and in any event on 1 July 2026; the CSSF is the competent authority under Art 20-27 of the amended Law of 16 July 2019. Regulation (EU) 2023/1114 on Markets in Crypto-Assets (MiCA): EUR-Lex MiCA Regulation
sanctions European Union (EU) Sanctions: These are directly applicable regulations in all EU member states. The EU implements both UN-mandated sanctions and its own autonomous sanctions regimes (e.g., concerning Russia, Iran, North Korea, Syria, Myanmar, etc.). EU sanctions explicitly cover "funds and economic resources," which have been clarified to include crypto-assets. United Nations (UN) Sanctions: These are binding on all UN member states and are implemented in the EU through EU Council Regulations. UN sanctions typically target specific individuals, entities, or regimes (e.g., Al-Qaeda, ISIL, Taliban, DPRK, Iran). Office of Foreign Assets Control (OFAC) Sanctions (U.S.): While U.S. sanctions are not directly legally binding on non-U.S. persons or entities outside the U.S., their extraterritorial reach is significant. VASPs in Luxembourg engaged in transactions involving U.S. persons, the U.S. financial system (e.g., USD transactions), or U.S.-origin technology must adhere to OFAC regulations to avoid severe penalties, including designation on OFAC's Specially Designated Nationals and Blocked Persons (SDN) List. OFAC has been proactive in adding cryptocurrency addresses to its sanctions lists. URL (Legilux): https://legilux.public.lu/eli/etat/leg/loi/2004/11/12/n6/jo (Note: This link is to the original law; look for the "Version consolidée" for the latest amendments.) CSSF Circular 20/747 (as amended): This circular details the AML/CFT requirements specifically for virtual asset service providers. EU Council Regulations: These are the direct legal instruments for EU sanctions. Examples include: Council Regulation (EU) No 833/2014 concerning restrictive measures in view of Russia’s actions destabilising the situation in Ukraine (and its numerous amendments, particularly those explicitly covering crypto-assets). URL (EUR-Lex): https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02014R0833-20230225 (Check for the latest consolidated version)
securities Regulatory Body: Commission de Surveillance du Secteur Financier (CSSF) – https://www.cssf.lu International Standing: Luxembourg is a member of the Financial Action Task Force (FATF) and adheres to its 48‑recommendation framework for combating money laundering and terrorist financing. Law on Securities (Luxembourg, Law No. 1.006/2010), Article 12 – defines “securities” to include digital assets when classified as investment contracts under the CSSF’s guidelines. Regulation (EU) No. 600/2014 on market abuse – transposed into Luxembourg law, imposing pre‑ and post‑trade transparency obligations for securities, including crypto‑linked instruments. Who Needs a License: Any entity offering “securities” that involve digital assets must obtain a license from the CSSF under the Financial Services Supervision Act. Activities Requiring Licensing: Issuance of tokenized securities, custodial services for crypto‑linked investment funds, and platforms facilitating regulated trading of digital asset‑backed securities. Capital Requirements: Minimum authorized capital of €5 million (EUR) or the equivalent in USD (~$5.8 million at 2024 exchange rates). Application Process: Submit a License Application Form (LAF‑01) to the CSSF, including:
status The loi du 6 février 2025 (Mémorial A n° 38) designates the CSSF as Luxembourg’s competent authority for MiCA, Regulation (EU) 2023/1114 (Art. 20-27 of the loi modifiée du 16 juillet 2019), and for the TFR, Regulation (EU) 2023/1113 (Art. 20-38); the ESMA interim register (14 Oct 2026) lists 13 CASP entries with Luxembourg as home state. CSSF Official Announcement on Enforcement Luxembourg CSSF Discussions on Emerging Technologies CSSF Enforcement Bulletin - 2024 Official EU Legislative Database - Council Regulation (EU) 2019/1937 Residents: Taxed progressively; thresholds and rates detailed in the document. Non-Residents: Subject to a flat rate of 30% on net capital gains from Luxembourg-sourced cryptocurrency transactions. Luxembourg Financial Market Authority (FMA) Official Website
tax For individual income tax, income realised with a virtual currency is taxable only if it falls within commercial profit (Art. 14 L.I.R.) or revenus nets divers (Art. 99 L.I.R.); paying in a virtual currency does not change the tax nature of the income received (ACD circular of 26 July 2018). For corporate tax purposes: Treated as assets on the balance sheet, with profits/losses impacting ordinary taxable income. For VAT purposes: Often treated as means of payment or equivalent to currency. Exchanging a virtual currency for another virtual currency, for euros, or for goods or services is a disposal for consideration (Art. 102(1a) L.I.R.); for individuals the gain is a speculation gain under Art. 99bis L.I.R. if held six months or less, untaxed when the year’s total is under €500 (ACD circular of 26 July 2018). These gains are subject to the individual's progressive income tax rates (up to 42% plus surcharges for the employment fund). A loss on exchanging a virtual currency held six months or less is a speculation loss within Art. 99bis L.I.R. (ACD circular of 26 July 2018); the circular sets no rule on offsetting such losses. If the cryptocurrency is held for more than six months, the gain is generally considered tax-exempt. This is a significant advantage in Luxembourg for long-term individual investors. Crypto income is commercial profit under Art. 14 L.I.R. when there is an independent, permanent profit-seeking activity; the ACD circular of 26 July 2018 lists as indicators dedicated premises or organisation, borrowed capital, frequent turnover of holdings and trading for third parties.
travel rule Travel-rule obligations for crypto-asset service providers in Luxembourg apply since 30 December 2024 under Regulation (EU) 2023/1113, not from 10 July 2027; the CSSF is the competent authority (Art 20-38 of the law of 16 July 2019 as inserted by the loi du 6 février 2025) and may impose fines under Art 20-41. Luxembourg licenses crypto-asset service providers: the CSSF is the competent authority for MiCA (Art 20-27 of the law of 16 July 2019 as inserted by the loi du 6 février 2025) and can impose administrative fines (Art 20-31). Separately, the Law of 19 December 2020 on financial restrictive measures applies to all persons operating in or from Luxembourg (Art 3). As of the provided source materials, no entity has been identified as holding a Luxembourg crypto or virtual-asset service provider license, and no such license type is described in the sources Source: CSSF AMLR Communiqué The practical reality is that Luxembourg relies on EU-level regulations; the AMLR will apply directly from 10 July 2027 with travel-rule-related requirements, and the future EU AMLA will begin direct supervision of selected obliged entities in 2028 Source: CSSF AMLR Communiqué The CSSF (Commission de Surveillance du Secteur Financier) is the AML/CFT supervisory authority for credit institutions and the professionals it supervises, authorises or registers (AML law of 12 November 2004, Art 2-1(1)) and a supervisory authority for financial restrictive measures under the Law of 19 December 2020 (Art 2(8), 6(2)). The Regulation of the European Parliament and of the Council on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (AMLR) was published in the Official Journal of the European Union on 19 June 2024; it will enter into force on the twentieth day following its publication and will apply from 10 July 2027 Source: CSSF AMLR Communiqué The Directive on mechanisms to be put in place by Member States for the prevention of the use of the financial system for money laundering or terrorist financing (AMLD6) was also published on 19 June 2024; it repeals Directive (EU) 2015/849, and Member States have three years from its entry into force to transpose it into national legislation Source: CSSF AMLR Communiqué The Regulation establishing the Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLAR) was published on 19 June 2024; it will apply from 1 July 2025, and AMLA will start direct supervision of selected obliged entities in 2028 Source: CSSF AMLR Communiqué

Sources

This report is AI-generated from publicly available regulatory sources. Last updated: 2026-10-14. View full profile