jurisdiction

Disclaimer: This chapter was last updated on 20 July 2026 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

1. How is crypto regulated?

Jurisdiction-specific MiCAR implementation and deviations Any other regulation
Please refer to the general section on MiCAR.

Financial services are regulated under the law of 5 April 1993 on the financial sector, as amended (FSL) and other legislation, notably the law of 10 November 2009 on payment services, as amended.

Authorisation and enforcement under the FSL and the other legislation is principally overseen by the Commission de Surveillance du Secteur Financier (CSSF).

At present, no legislation has been made in respect of cryptoassets per se from a financial services perspective.

Luxembourg has, however, adopted several laws in order to enable:

  • account keepers to maintain securities accounts and credit securities on such accounts within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases. In practice, this means that the law allows for the maintaining and transfer of securities by way of DLT;
  • central account keepers or settlement organisations to keep securities issuance accounts and carry out the registration of dematerialised securities within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases.

Moreover, the definition of financial instruments also includes financial instruments which are issued by means of DLT.

Finally, Luxembourg law provides for a specific status as control agent for dematerialized securities. This control agent is in charge of :

  • maintaining securities issuance accounts within or through secured electronic mechanisms, including DLT;
  • track, at any time, the holding chain of dematerialised securities held in securities accounts within or through secured electronic registration mechanisms, including DLT;
  • verify that the total amount of each issuance registered in a securities issuance account within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases, is equal to the sum of the securities registered in the securities accounts of the account keepers maintained within or through secured electronic registration mechanisms, including DLT.

An investment firm or a credit institution contemplating carrying out such activities should notify the CSSF beforehand and comply with certain requirements.  

Further, the CSSF has issued specific s FAQs on Crypto-Assets for– Undertakings for collective investment. These FAQs provide useful guidance for the investment fund industry. 

2. What are the steps taken by the regulator to adopt MiCAR? 

The CSSF has a dedicated page on its website regarding MiCAR. All relevant information regarding the activities in scope, authorisation process and links to relevant information and documentation is provided therein.

3. Are the following activities regulated or unregulated in your jurisdiction? ― Direct sales of tokens by issuers— Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services —Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)

Please refer to the general section on MiCAR.

4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis?

Please refer to the general section on MiCAR.

5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?

Overall, between 9 to 12 months. This delay may be shortened depending on whether the relevant entity is already well-established.

6. What would be the approximate overall cost of obtaining a licence?

The CSSF levies a single lump sum of EUR 30,000 for the examination of an application for authorisation as a CASP in accordance with Article 63 MiCAR. Further, authorised CASPs are required to pay an annual lump sum of EUR 40,000. Other fees may apply to issuers of ARTs and EMTs.

7. What is the probability (%) of success in obtaining a licence?

This will depend on the shareholding structure and the contemplated managers, whether the entity already has a track-record, etc. A well-advised applicant with a high-quality application should expect their application to be approved.

For example, as of July 2026, the CSSF has adopted an active approach to CASP authorisations, having granted nine authorisations so far in 2026.

8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

The CSSF requires a minimum of substance in Luxembourg. Compliance will play an important role. Otherwise, please refer to the general section on MiCAR.