Is crypto legal in Luxembourg? Rules & regulation (2026)
Crypto is regulated in Luxembourg.
Crypto is legal in Luxembourg and is now subject to a comprehensive EU-wide regulatory regime under MiCA, with the CSSF acting as the national competent authority for authorisation and supervision of crypto-asset service providers (CASPs) and issuers of asset-referenced and e-money tokens. Luxembourg has long been a pro-DLT jurisdiction, its successive 'Blockchain Laws' (most recently Blockchain Law IV of 20 December 2024) explicitly recognise DLT for issuing and holding dematerialised securities, and the country has already granted MiCA authorisations (e.g., Zodia Custody, Banking Circle/EURI, Alipay Europe). Legacy AML-registered VASPs benefit from a transitional period that ends on 1 July 2026, after which a full MiCA licence is required.
Legal framework
EU Markets in Crypto-Assets Regulation (MiCA/MiCAR, Regulation (EU) 2023/1114), in force across the EU since 30 June 2024 (Titles III & IV on ARTs/EMTs) and 30 December 2024 (full application). Luxembourg designated the CSSF (Commission de Surveillance du Secteur Financier) as the competent authority via the national MiCA implementing law published in the Mémorial on 10 February 2025. National blockchain framework completed by Blockchain Laws I-IV (most recently the Law of 20 December 2024 amending the 6 April 2013 law on dematerialised securities). AML/CFT registration of VASPs continues under the Law of 25 March 2020 (as amended).
Status by sub-area
Stablecoins
In forceMiCA Titles III (asset-referenced tokens) and IV (e-money tokens) have applied since 30 June 2024 and are supervised by the CSSF in Luxembourg. EMTs may only be issued by EU-authorised credit institutions or e-money institutions, must be 1:1 backed and redeemable at par; the CSSF has already authorised Luxembourg-domiciled EMT issuers (e.g., Banking Circle's EURI, Alipay Europe).
Exchanges / VASP
In forceCASPs (exchanges, brokers, custodians, advisors, transfer services) must be authorised by the CSSF under MiCA since 30 December 2024. Pre-existing AML-registered VASPs benefit from a national transitional period until 1 July 2026, after which only a MiCA licence permits service provision. CSSF authorisation passports across the EU.
Token Offerings
In forcePublic offers of crypto-assets that are not ARTs/EMTs are governed by MiCA Title II (white-paper notification to the CSSF, marketing rules, right of withdrawal). Tokenised securities and security tokens remain outside MiCA and are subject to the EU Prospectus Regulation as transposed by the Luxembourg Law of 16 July 2019 on prospectuses, plus the dematerialised-securities/Blockchain Law framework.
Custody
In forceCustody and administration of crypto-assets on behalf of clients is a regulated CASP service under MiCA Article 75, with segregation, safeguarding policy, liability for loss, and proof-of-holdings requirements supervised by the CSSF. For investment funds, the CSSF requires either CASP authorisation or specific notification by the depositary safeguarding crypto-assets, and Blockchain Law IV modernises the custody chain for DLT-recorded securities.
DeFi
PartialMiCA explicitly carves out fully decentralised crypto-asset services 'without any intermediary' from its scope, so Luxembourg has no dedicated DeFi regime today. In practice, the CSSF and EU regulators assess each protocol's degree of decentralisation; front-ends, governance entities or intermediaries that exercise control are likely to be treated as CASPs, while AML rules and securities/MiFID law may still apply. A dedicated EU DeFi review is mandated under MiCA Article 142 (Commission report due 30 December 2024 and follow-up legislation expected).
Still pending: Follow-up legislation expected from MiCA Art. 142 DeFi review
Tax
In forceLuxembourg has no crypto-specific tax law: general income-tax principles apply. For individuals, disposals within six months of acquisition are taxed as speculative income at marginal personal rates (up to ~45.8%), with a EUR 500 annual exemption; disposals after six months are generally tax-exempt unless the activity is commercial. Crypto trades are VAT-exempt as a financial service (CJEU Hedqvist, Art. 44(1)(d) Luxembourg VAT Law). DAC8 / CARF reporting is in force from 1 January 2026 (Law of 27 March 2026).
How to get a crypto license in Luxembourg
To provide crypto-asset services in Luxembourg you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Commission de Surveillance du Secteur Financier (CSSF), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.
- Authority
- the Commission de Surveillance du Secteur Financier (CSSF)
- License required
- a MiCA CASP authorisation (Crypto-Asset Service Provider)
- Framework / law
- the EU Markets in Crypto-Assets Regulation (MiCA), Title V
- Minimum capital
- €50,000–€150,000 minimum, by service class (Class 1/2/3)
- Timeline
- about 40 working days of substantive review; 1–3 months for a well-prepared application
- Cost
- an application fee of roughly €5,000–€25,000, plus ongoing supervisory fees
- Passporting
- Yes: a single MiCA CASP licence passports across all 27 EU member states.
What a crypto license in Luxembourg covers
- Custody and administration of crypto-assets for clients
- Operating a trading platform for crypto-assets
- Exchanging crypto-assets for funds, or for other crypto-assets
- Executing orders for crypto-assets on behalf of clients
- Reception and transmission of orders, and placing of crypto-assets
- Advice and portfolio management on crypto-assets
- Transfer services for crypto-assets on behalf of clients
Step by step: getting a crypto license in Luxembourg
Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU.
Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation.
Submit the application to the national competent authority.
Completeness check: the authority has 25 working days to confirm the file is complete and request anything missing.
Substantive assessment: the authority has 40 working days to grant or refuse the authorisation.
Once authorised, notify the passport to the host member states you intend to serve, then begin operating across the EU.
Documents required in Luxembourg
- Programme of operations describing each crypto-asset service you will provide
- Business plan with three-year financial projections
- Evidence of prudential safeguards (own funds or qualifying insurance)
- Governance arrangements, organisational chart and internal-control description
- AML/CFT policies and the appointment of a compliance officer
- ICT security, business-continuity and DORA-aligned resilience policies
- Custody and client-asset segregation arrangements
- Complaints-handling procedure and conflict-of-interest policy
- Fit-and-proper evidence for directors and qualifying shareholders (CVs, criminal-record certificates)
Ongoing obligations in Luxembourg
- Maintain prudential safeguards and own funds at or above the class minimum
- Keep client crypto-assets segregated from the firm's own assets
- Run continuous AML/CFT monitoring, screening and suspicious-activity reporting
- Keep marketing communications fair, clear and not misleading
- Operate complaints handling and manage conflicts of interest
- Meet ICT resilience and incident-reporting duties under DORA
- File periodic reports to the national competent authority
Key points: crypto & digital assets in Luxembourg
MiCA in force; CSSF is competent authority
MiCA applies in full since 30 December 2024. The Luxembourg implementing law (published in the Official Journal on 10 February 2025) designates the CSSF as the competent authority with supervisory, investigative and sanctioning powers over CASPs and ART/EMT issuers.
Transitional period ends 1 July 2026
VASPs registered with the CSSF before 30 December 2024 may continue to operate under a national transitional regime until 1 July 2026; after that date a CASP authorisation under MiCA is required to provide crypto-asset services in or from Luxembourg.
Blockchain Law IV, DLT securities
The Law of 20 December 2024 (Blockchain Law IV, in force 31 December 2024) amended the 6 April 2013 law on dematerialised securities to extend the DLT framework to unlisted equity securities and introduced the 'control agent' role (bank, investment firm or settlement organisation, on prior notification to the CSSF).
Active MiCA licensing in Luxembourg
The CSSF has already granted MiCA authorisations to several major operators, including Zodia Custody (CASP) and Alipay Europe (EMT licence for a euro stablecoin); Banking Circle issues the EURI EMT from Luxembourg under CSSF supervision, evidence that the regime is operational, not just on paper.
DAC8 / crypto reporting transposed
Luxembourg transposed the EU DAC8 directive (Council Directive (EU) 2023/2226) and the OECD Crypto-Asset Reporting Framework through the law of 27 March 2026, imposing structured due-diligence, data-collection and reporting obligations on CASPs and equivalent operators from 1 January 2026.
CSSF guidance on crypto in investment funds
The CSSF published Version 7 of its FAQ on virtual/crypto-assets on 4 February 2026, aligning terminology with MiCA, requiring prior CSSF notification before a fund invests in crypto-assets, case-by-case risk assessment, internal control functions and investor disclosure, retail UCITS still cannot gain direct exposure.
Crypto license in Luxembourg: FAQ
Do you need a license to run a crypto business in Luxembourg?
Yes. To provide crypto-asset services in Luxembourg you need a MiCA CASP authorisation (Crypto-Asset Service Provider), supervised by the Commission de Surveillance du Secteur Financier (CSSF), under the EU Markets in Crypto-Assets Regulation (MiCA), Title V.
Which authority issues crypto licenses in Luxembourg?
The Commission de Surveillance du Secteur Financier (CSSF).
How much does a crypto license cost in Luxembourg?
An application fee of roughly €5,000–€25,000, plus ongoing supervisory fees.
How long does it take to get a crypto license in Luxembourg?
Typically about 40 working days of substantive review; 1–3 months for a well-prepared application.
What documents do you need for a crypto license in Luxembourg?
The application file centres on programme of operations describing each crypto-asset service you will provide; business plan with three-year financial projections; evidence of prudential safeguards (own funds or qualifying insurance); governance arrangements, organisational chart and internal-control description; plus fit-and-proper evidence for directors and qualifying shareholders.
What is the application process for a crypto license in Luxembourg?
Incorporate a legal entity with a registered office in the member state, with at least one director resident in the EU. Build the application file: programme of operations, business plan, governance, AML/CFT, ICT resilience and client-asset segregation. The authority then assesses the file and, once authorised, you can begin operating.
Does a Luxembourg crypto license work in other EU/EEA countries?
Yes: a single MiCA CASP licence passports across all 27 EU member states.
Timeline of decisions
- Decision
- Decision
- Decision
- Guidance · officialCSSF overhauls crypto-asset rules for investment funds (FAQ v7)
The CSSF published Version 7 of its FAQ on crypto-assets, replacing all 'virtual asset' references with 'crypto-assets' to align with MiCA and allowing UCITS to obtain indirect crypto exposure of up to 10% of NAV. It marks the regulator's most permissive stance to date for Luxembourg funds.
CSSF
- DecisionCoinbase Granted First Major MiCA CASP Licence by CSSF, Establishes EU Hub in Luxembourg
Coinbase received its MiCA crypto-asset service provider authorisation from the CSSF, becoming the first major US exchange to obtain an EU-wide licence under the new framework, and relocated its EU hub from Ireland to Luxembourg. The single licence is passportable across all 27 EU member states, serving over 450 million people.
Coinbase
- DecisionBitstamp becomes first MiCA-licensed crypto exchange in Luxembourg
The CSSF granted Bitstamp a Crypto-Asset Service Provider (CASP) authorisation under MiCA, covering trading, order execution and custody with an EEA passport. It was the first full CASP licence issued by the CSSF, signalling Luxembourg's role as an EU crypto hub.
Luxembourg for Finance
- Law · officialLuxembourg MiCA Designation Law Published, CSSF Named Sole Competent Authority for Crypto-Assets
The Law of 6 February 2025, published in the Official Gazette on 10 February 2025, formally designated the CSSF as Luxembourg's sole competent authority under MiCAR, granting it supervisory, investigative and sanctioning powers over CASPs, ART issuers and EMT issuers. VASPs registered before 30 December 2024 benefit from a transitional period until 1 July 2026.
CSSF
- Law · officialLaw designates CSSF as Luxembourg's MiCA competent authority
The Law of 6 February 2025 formally named the CSSF as the sole national competent authority for MiCA, vesting all CASP licensing, supervision and enforcement powers in the regulator. It completed Luxembourg's domestic anchoring of the EU regime.
CSSF
- LawBlockchain IV Law modernises the dematerialised-securities custody chain
The Law of 20 December 2024 entered into force, introducing an optional 'control agent' model and broadening DLT issuance to equities, fund units and tokenised physical assets. It deepened Luxembourg's tokenisation framework beyond debt instruments.
Luxembourg for Finance
- LawBlockchain III Law implements the EU DLT Pilot Regime
The Law of 15 March 2023 implemented EU Regulation 2022/858, letting market infrastructures trade and settle tokenised securities on DLT and recognising DLT for financial collateral arrangements. It extended Luxembourg's blockchain framework to market-infrastructure level.
Luxembourg for Finance
- Law · officialAML5 Law, Mandatory VASP Registration Regime Established for Virtual Asset Firms
The Law of 25 March 2020, transposing AMLD5 (EU Directive 2018/843), entered into force on 30 March 2020 and introduced Luxembourg's first mandatory registration regime for virtual asset service providers (VASPs) under CSSF supervision. Entities offering VA exchange, transfer, safekeeping or investment services must register with the CSSF and comply with full AML/CFT obligations before operating.
CSSF
- Law · officialLaws of 25 March 2020 create the VASP registration regime
Amendments to the 2004 AML/CFT law transposed the EU 5th AML Directive, defining virtual assets and requiring VASPs to register with and be AML-supervised by the CSSF. This was Luxembourg's first dedicated legal regime for crypto businesses.
CSSF
Sources
- cssf.lu/en/markets-in-crypto-assets-mica-micar/
- cssf.lu/en/virtual-asset-service-provider/
- cssf.lu/en/crypto-assets-service-providers-casp/
- elvingerhoss.lu/insights/publications/mica-end-transitional-period-1-july-2026
- arendt.com/news-insights/news/luxembourgs-blockchain-law-iv-groundbreaking-new-o
- bsp.lu/lu/publications/newsletters-newsflashes/blockchain-iv-new-law-adopted
- natlawreview.com/article/luxembourg-financial-services-regulator-cssf-updates-its-posi
- prokopievlaw.com/post/luxembourg-cssf-updates-crypto-asset-faq-for-retail-funds-februa
- thefintechtimes.com/zodia-custody-secures-mica-licence-to-unlock-eu-wide-digital-asset-se
- en.paperjam.lu/article/cssf-grants-alipay-e-money-licence-paving-way-for-euro-stable
- hoganlovells.com/en/publications/whats-going-on-with-crypto-assets-in-luxembourg
- globallegalinsights.com/practice-areas/blockchain-cryptocurrency-laws-and-regulations/luxembo
- kryptos.io/guides/luxembourg-crypto-tax-guide
- ey.com/en_lu/insights/wealth-asset-management/luxembourg-market-pulse/luxemb
Next for Luxembourg: Artificial IntelligenceComprehensive law
Next topicOrientation, not legal advice: verify against the primary sources linked above. Last verified 13 Jun 2026. Methodology & how to cite · State of Technology Regulation 2026