Luxembourg: technology regulation at a glance

Framework: EU Markets in Crypto-Assets Regulation (MiCA/MiCAR, Regulation (EU) 2023/1114), in force across the EU since 30 June 2024 (Titles III & IV on ARTs/EMTs) and 30 December 2024 (full application). Luxembourg designated the CSSF (Commission de Surveillance du Secteur Financier) as the competent authority via the national MiCA implementing law published in the Mémorial on 10 February 2025. National blockchain framework completed by Blockchain Laws I-IV (most recently the Law of 20 December 2024 amending the 6 April 2013 law on dematerialised securities). AML/CFT registration of VASPs continues under the Law of 25 March 2020 (as amended).

Crypto is legal in Luxembourg and is now subject to a comprehensive EU-wide regulatory regime under MiCA, with the CSSF acting as the national competent authority for authorisation and supervision of crypto-asset service providers (CASPs) and issuers of asset-referenced and e-money tokens. Luxembourg has long been a pro-DLT jurisdiction, its successive 'Blockchain Laws' (most recently Blockchain Law IV of 20 December 2024) explicitly recognise DLT for issuing and holding dematerialised securities, and the country has already granted MiCA authorisations (e.g., Zodia Custody, Banking Circle/EURI, Alipay Europe). Legacy AML-registered VASPs benefit from a transitional period that ends on 1 July 2026, after which a full MiCA licence is required.

Framework: EU AI Act (Regulation (EU) 2024/1689), directly applicable; national implementing Bill 8476 pending before the Chamber of Deputies designates the CNPD as default market surveillance authority and single point of contact, complemented by the National AI Strategy (Accelerating Digital Sovereignty 2030, 2025)

As an EU member state, Luxembourg is directly bound by the EU AI Act, whose prohibitions on unacceptable-risk AI have applied since 2 February 2025, GPAI rules since 2 August 2025, and the general regime (including high-risk and transparency obligations) since 2 August 2026. National implementing Bill 8476 (deposited 23 December 2024) to designate competent authorities and sanctions remains pending before Parliament following the Conseil d'État's opinion of 10 July 2026, but authorities (notably CNPD, CSSF, CAA, ILR, ILNAS) are already acting under their existing sectoral mandates. Luxembourg complements this with its 2025 National AI Strategy under the 'Accelerating Digital Sovereignty 2030' initiative.

Framework: EU General Data Protection Regulation (Regulation 2016/679) directly applicable, implemented nationally by the Law of 1 August 2018 on the organisation of the Commission nationale pour la protection des données (CNPD) and the Law of 1 August 2018 on the protection of natural persons with regard to the processing of personal data in criminal and national security matters; sector rules in the Law of 30 May 2005 (ePrivacy). Supervisory authority: Commission nationale pour la protection des données (CNPD).

Luxembourg has a mature, comprehensive personal-data protection regime based on the directly applicable EU GDPR, implemented domestically by the twin Laws of 1 August 2018, which repealed the former 2002 data-protection act and define the CNPD's enlarged tasks and corrective powers plus national specifics (notably workplace surveillance). An independent supervisory authority (the CNPD) actively enforces the GDPR, cooperates in the EDPB, and has issued major decisions, including a record €746m fine against Amazon in 2021 that the Luxembourg Administrative Court annulled in March 2026 and remanded to the CNPD for a new reasoned decision. The ePrivacy Directive is transposed by the 2005 Electronic Communications Act and continues to apply (the planned EU ePrivacy Regulation was dropped from the Commission's 2025 work programme).

Framework: Law of 10 November 2009 on payment services (transposing PSD2 / EMD2), supervised by the Commission de Surveillance du Secteur Financier (CSSF); complemented by EU Regulations MiCA (crypto-assets, with CSSF designated as competent authority by the Law of 6 February 2025) and the Instant Payments Regulation (EU) 2024/886.

Luxembourg operates a clear, well-established licensing regime for digital payments and fintech. Payment institutions (PIs), e-money institutions (EMIs) and AISPs require authorisation/registration from the CSSF under the Law of 10 November 2009, while crypto-asset service providers fall under directly-applicable EU MiCA with the CSSF as competent authority. EU-wide rules on open banking (PSD2) and mandatory SEPA instant credit transfers (Regulation (EU) 2024/886) are fully applicable.

Framework: Luxembourg Law of 29 August 2008 on free movement of persons and immigration (as amended); administered by the Immigration Directorate of the Ministry of Home Affairs. EU/EEA/Swiss nationals enjoy free movement; third-country nationals use category-specific residence permits via Guichet.lu. No dedicated digital-nomad visa exists.

Luxembourg does not offer a dedicated digital-nomad or remote-work visa. EU/EEA/Swiss citizens may live and work freely; non-EU remote workers and relocators must qualify under an existing residence category, most relevantly self-employed/independent worker, investor, or the work-prohibited 'private reasons' permit. A residence-by-investment ('golden visa') route exists with thresholds from €500,000 to €20 million.

Framework: EU Digital Services Act (Regulation (EU) 2022/2065), implemented nationally by the Law of 4 April 2025; the Autorité de la concurrence (Competition Authority) is the national Digital Services Coordinator. Hosting/illegal-content liability also rests on the amended e-commerce law of 14 August 2000.

Online content and platform safety in Luxembourg are governed by the directly-applicable EU Digital Services Act, fully in force since 17 February 2024, supplemented by the national Law of 4 April 2025 that designates a Digital Services Coordinator and sets enforcement powers and penalties. The Autorité de la concurrence supervises the roughly 195 intermediary/platform providers established in Luxembourg (a major hosting hub), while the European Commission directly oversees Very Large Online Platforms and Search Engines. National implementation focuses on illegal-content notice mechanisms, transparency of recommender systems and advertising, and protection of minors, coordinated with the data-protection (CNPD), audiovisual (ALIA) and product-safety (ILNAS) regulators.

Framework: Law of 5 May 2026 on measures to ensure a high level of cybersecurity (transposing EU Directive 2022/2555, 'NIS2'); supervised by the Institut Luxembourgeois de Régulation (ILR), with the CSSF as competent authority for the financial sector and the Haut-Commissariat à la Protection nationale (HCPN) as strategic coordinator and single point of contact.

Luxembourg has a comprehensive, cross-sector cybersecurity regime built on the Law of 5 May 2026, which transposed the EU NIS2 Directive (replacing the prior NIS1 law) and entered into force on 10 May 2026. The ILR is the lead competent authority for most sectors, while the CSSF (with the Commissariat aux Assurances) supervises the financial sector under the directly applicable EU DORA Regulation. Essential and important entities face risk-management, governance and tiered incident-reporting duties, backed by fines up to EUR 10 million or 2% of global turnover.

Framework: Law of 2 September 2011 on the right of establishment (autorisation d'établissement), administered by the Ministry of the Economy (General Directorate for SMEs); company forms governed by the amended Law of 10 August 1915 on commercial companies; registration with the Luxembourg Trade and Companies Register (RCS / Luxembourg Business Registers).

Luxembourg places no nationality or residency restrictions on company ownership, foreigners may own and control 100% of a Luxembourg company. However, most commercial, craft, industrial and certain liberal activities require a business permit (autorisation d'établissement) granting professional integrity and qualification, and incorporating a capital company (SARL/SA) requires a notarial deed, so the overall process involves several steps and typically takes weeks to a few months.