Regulatory AlertsLuxembourg: crypto & digital assets regulation
RegulatedLuxembourg: MiCA licensing via CSSF; strict custody and issuance rules
- Lead regulator
- Commission de Surveillance du Secteur Financier (CSSF)
- Also involved
- BCL (banking interface) · CRF (AML)
- Core law
- Regulation (EU) 2023/1114 (MiCA)
- Entry capital
- EUR 125,000 (CASP)
- Approval timeline
- 4-6 months
- Customer assets
- Segregated custody required
- Data protection
- GDPR · CNPD
- Sandbox
- Yes - CSSF Regulatory Sandbox
Luxembourg regulates crypto-asset service providers (CASPs) and token issuers under the EU Markets in Crypto-Assets Regulation (MiCA). The CSSF is the primary supervisor, enforcing strict governance, capital, and conduct rules. The regulatory environment is mature, with recent circulars detailing ESMA/EBA guidelines on suitability, security, and investor protection.
Which licence do you need?
| Your activity | Requirement | Capital | Timeline | Authority |
|---|---|---|---|---|
| Exchange / trading platform | LicenceCASP[1][2] Requires ESMA-compliant competence and security standards | EUR 125,000 | 4-6 months | CSSF |
| Custody of client assets | LicenceCASP[2] Strict segregation and security protocols mandated | EUR 125,000 | 4-6 months | CSSF |
| Token issuance / public offering | LicenceIssuer[2][3] Requires white paper and governance standards | Variable | — | CSSF |
| Broker-dealer / OTC desk | LicenceCASP[4] Subject to suitability and investor protection rules | EUR 125,000 | 4-6 months | CSSF |
| Stablecoin issuance | LicenceART/EMT Issuer[5][6] Governance and redemption plan requirements apply | Variable | — | CSSF |
| Crypto payments acceptance | LicenceCASP[7] Travel Rule compliance mandatory | EUR 125,000 | 4-6 months | CSSF |
| Mining / staking services | Uncertainverify with regulator MiCA scope unclear for pure mining | — | — | — |
| Advisory / portfolio management | LicenceCASP[1] Staff competence guidelines apply | EUR 125,000 | 4-6 months | CSSF |
New — what changed recently
- 2025-04-30CSSF Circulars 25/885-25/891 — Implementation of ESMA/EBA guidelines on security, suitability, and investor protection for MiCA entities.
- 2025-02-25CSSF Circulars 25/872-25/876 — Adoption of EBA guidelines on governance, redemption plans, and suitability for token issuers and CASPs.
- 2025-04-08CSSF Circular 25/879 — Formal adoption of EBA Travel Rule guidelines for crypto-asset transfers.
Market-entry checklist
- 1Secure MiCA license from CSSFApply for CASP or Issuer status with EUR 125k capital minimum.
- 2Implement ESMA security standardsAdopt system and security access protocols per Circular 25/889.
- 3Establish governance frameworksEnsure management suitability and governance per Circular 25/872.
- 4Deploy Travel Rule complianceIntegrate EBA guidelines for transfer information per Circular 25/879.
- 5Prepare white paper (if issuing)Draft standardized crypto-asset white paper per Article 97 guidelines.
Sources
- Circular CSSF 26/909 — Application of ESMA Guidelines on Knowledge and Competence under MiCA · 2026-04-01
- CSSF Circular 25/889: Application of ESMA Guidelines on System and Security Standards for Crypto-Asset Offerors · 2025-04-30
- CSSF Circular 25/872 on EBA Guidelines for Governance Arrangements of Asset-Referenced Token Issuers · 2025-02-25
- CSSF Circular 25/891: Application of ESMA Guidelines on Suitability and Periodic Statements for Crypto Portfolio Management · 2025-05-21
- Circular CSSF 25/885 — Application of EBA Guidelines on Templates for MiCAR Supervisory Duties · 2025-04-30
- Circular CSSF 25/876 — Application of EBA Guidelines on Redemption Plans under Regulation (EU) 2023/1114 · 2025-02-25
- CSSF Circular 25/879: Adoption of EBA Travel Rule Guidelines on Fund and Crypto-Asset Transfers · 2025-04-08