1.  How is crypto regulated?
  2. What are the steps taken by the regulator to adopt MiCAR? 
  3.  Are the following activities regulated or unregulated in your jurisdiction? ― Direct sales of tokens by issuers— Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services —Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)
  4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis?
  5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?
  6. What would be the approximate overall cost of obtaining a licence?
  7. What is the probability (%) of success in obtaining a licence?
  8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

jurisdiction

Luxembourg

Disclaimer: This chapter was last updated on 17 June 2025 and does not reflect any subsequent developments. The information provided is intended for general informational purposes and should not be construed as legal advice.

1. How is crypto regulated?

AML RegulationAny other regulation

The law of 12 November 2004 on the fight against money laundering and terrorist financing, as amended (AML Law) required certain service providers to register with the Luxembourg supervisory authority. Activities in scope were the following:

  • the exchange between virtual assets and fiat currencies, including the service of exchange between virtual currencies and fiat currencies;
  • the exchange between one or more forms of virtual assets;
  • the transfer of virtual assets;
  • the safekeeping or administration of virtual assets or instruments enabling control over virtual assets, including the custodian wallet service;
  • the participation in and provision of financial services related to an issuer’s offer or sale of a virtual asset.

Since a law of 6 February 2025, the AML Law has been amended to remove the registration requirement. The AML Law, however, provides for transition measures. More specifically, virtual asset service providers that were registered as at 30 December 2024 shall remain registered as such until 1 July 2026 or until they are granted or refused an authorisation pursuant to Article 63 of MiCAR.  

Financial services are regulated under the law of 5 April 1993 on the financial sector, as amended (FSL) and other legislation, notably the law of 10 November 2009 on payment services, as amended.

Authorisation and enforcement under the FSL and the other legislation is principally overseen by the Commission de Surveillance du Secteur Financier (CSSF).

At present, no legislation has been made in respect of cryptoassets per se from a financial services perspective.

Luxembourg has, however, adopted several laws in order to enable:

  • account keepers to maintain securities accounts and credit securities on such accounts within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases. In practice, this means that the law allows for the maintaining and transfer of securities by way of DLT;
  • central account keepers or settlement organisations to keep securities issuance accounts and carry out the registration of dematerialised securities within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases.

Moreover, the definition of financial instruments also includes financial instruments which are issued by means of DLT.

Finally, Luxembourg law provides for a specific status as control agent for dematerialized securities. This control agent is in charge of :

  • maintaining securities issuance accounts within or through secured electronic mechanisms, including DLT;
  • track, at any time, the holding chain of dematerialised securities held in securities accounts within or through secured electronic registration mechanisms, including DLT;
  • verify that the total amount of each issuance registered in a securities issuance account within or through secured electronic registration mechanisms, including distributed electronic ledgers or databases, is equal to the sum of the securities registered in the securities accounts of the account keepers maintained within or through secured electronic registration mechanisms, including DLT.

An investment firm or a credit institution contemplating carrying out such activities should notify the CSSF beforehand and comply with certain requirements.  

2. What are the steps taken by the regulator to adopt MiCAR? 

The CSSF has a dedicated page on its website regarding MiCAR. All relevant information regarding the activities in scope, authorisation process and links to relevant information and documentation is provided therein.

3. Are the following activities regulated or unregulated in your jurisdiction? ― Direct sales of tokens by issuers— Exchange (buy/sell) ― Custody (hold) ― Borrowing/lending ― Yield/staking services —Staking on proof of stake consensus mechanisms (please indicate if NFTs are treated differently from fungible cryptoassets for each activity)

Please refer to the general section on MiCAR.

4. Can offshore business provide services to local customers on either active solicitation or reverse solicitation basis?

Please refer to the general section on MiCAR.

5. How long would establishing a cryptoasset business/obtaining a license in your jurisdiction take?

Overall, between 9 to 12 months. This delay may be shortened depending on whether the relevant entity is already well-established.

6. What would be the approximate overall cost of obtaining a licence?

This information is not yet available. 

7. What is the probability (%) of success in obtaining a licence?

This will depend on the shareholding structure and the contemplated managers, whether the entity already has a track-record, etc. A well-advised applicant with a high-quality application should expect their application to be approved.

8. What other limitations are there in your jurisdiction when looking to set up a cryptoasset business? E.g., Compliance requirements and physical presence

The CSSF requires a minimum of substance in Luxembourg. Compliance will play an important role. Otherwise, please refer to the general section on MiCAR.