On 2 October 2026, the Luxembourg supervisory authority for financial services (the CSSF) published FAQs on tokenisation (the FAQ), providing guidance to entities that consider relying on tokenisation when performing their activities. The FAQ acknowledges the potential benefits offered by tokenisation, notably in terms of efficiency and cost, whilst emphasising the CSSF’s technologically neutral approach.
The FAQ applies in particular to undertakings for collective investment (UCIs), investment fund managers (IFMs) and entities acting as UCI administrators (UCIAs) performing the registrar function, as well as entities wishing to act as control agents within the meaning of the Law of 6 April 2013 on dematerialised securities, as amended (the Dematerialised Securities Law).
The CSSF invites entities considering tokenisation projects to contact it as early as possible to initiate a preliminary dialogue, to identify the relevant legislative frameworks and need for licenses, as well as any potential obstacles at an early stage.
You will find below the key takeaways from the FAQ.
1. Native token issuance by UCIs
The FAQ confirms that, in accordance with the principle of technological neutrality, Luxembourg UCIs can issue native units/shares using distributed ledger technology (DLT), provided that the proposed operating model is compliant with the applicable regulatory framework.
- Tokenised UCI units/shares may be issued in registered or dematerialised form, within the meaning of the Law of 10 August 1915 on commercial companies. The use of DLT as the issuance and record-keeping infrastructure does not determine the legal form of underlying securities or vice versa.
- For UCIs issuing dematerialised units/shares using DLT, an eligible entity (e.g. the IFM, a registrar agent or a credit institution authorised as UCIA) will need to act as UCIA for the registrar function, in addition to complying with all requirements applicable under the Dematerialised Securities Law.
As a reminder, a UCIA planning substantial changes to its operating model as part of its use of DLT is required to apply with the CSSF for authorisation of any substantial changes to the initial application, in accordance with point (5) of Circular CSSF 22/811.
2. Control agent and UCIA for the registrar function
The FAQ clarifies that the form under which units/shares of a UCI are issued (i.e. registered or dematerialised) does not impact the need to appoint a UCIA in charge of the registrar function within the meaning of Circular CSSF 22/811.
The tasks covered by the UCIA in its registrar function go beyond what is required from a control agent under the Dematerialised Securities Law. In consequence, an eligible entity will need to perform all the residual tasks foreseen under points (19) and (20) of Circular CSSF 22/811. However, a single entity holding all appropriate licenses/authorisations may perform both functions.
3. Multiple UCIAs for the same UCI
The FAQ confirms that multiple entities may act as UCIAs in charge of the registrar function for the same UCI, where such a UCI issues both tokenised units/shares and traditional (i.e. non-tokenised) units/shares, provided that certain conditions are met.
The FAQ also clarifies the following points on multiple UCIAs for the same UCI:
- the division of tasks between the different UCIAs in charge of the registrar function must not result in a fragmentation which renders the exercise of the coordination and general supervisory function difficult;
- the IFM must ensure that the operating model, as well as the potential risks and implications thereof, is adequately disclosed to investors, and the names of all entities acting as UCIA, along with their respective functions, must be clearly disclosed in the offering documents;
- an entity (the IFM and/or one of the UCIAs) must maintain a consolidated view of the units/shares issued by the UCI to ensure that all other relevant UCI administration functions/tasks can be performed; and
- the IFM and/or the UCI must ensure that any additional risks arising from this division of responsibilities are properly managed, and full compliance with all relevant provisions of the applicable law must be ensured.
Control agent requirements
The FAQ provides guidance on the legal requirements and procedures to become a control agent:
- entities wishing to perform control agent activities in Luxembourg must notify the CSSF at least two months prior to the control agent’s activity taking place;
- where elements of the activity are fully or partially outsourced or supported by ICT third-party arrangements, additional notifications may need to be submitted with a potential impact on the overall timeline (three months before the start of the outsourcing, reduced to one month if outsourcing is made to a Luxembourg support PFS);
- entities located in the EEA intending to notify the CSSF in respect of the control agent activity must first inform the competent authority of their home Member State and inform the CSSF of any objection or comment of such competent authority. Further assurance that the competent authority shall assist the CSSF in obtaining all information necessary to ascertain compliance with the requirements under Article 21a of the Dematerialised Securities Law shall be provided.
DORA requirements and third-party service providers
The CSSF takes the view that entities referred to in Article 1(10a) of the Dematerialised Securities Law are subject to Digital Operational Resilience Act (DORA) requirements including in respect of the control agent activity.
A control agent can have recourse to a third-party service provider to obtain technical support in the context of the tokenisation of UCIs (e.g. smart contract development and/or administration). The CSSF considers it highly likely that the control agent activity qualifies as a critical or important function (CIF) within the meaning of Article 3(22) of DORA. Accordingly, where ICT third-party arrangements are used to support the control agent activity, entities must refer to Circular CSSF 25/882 and notify the CSSF using the appropriate notification form within the applicable time limits.
Overall, the FAQ provides a clarification of the regulatory framework applicable to the tokenisation of investment funds in Luxembourg. The CSSF’s technologically neutral approach and emphasis on early engagement should facilitate the development of tokenisation projects whilst ensuring appropriate regulatory oversight.
If you have any questions related to this topic, please feel free to reach out to our funds expert Aurélien Hollard and/or our regulatory expert Aurélia Viémont.
