Crypto & Digital Assets Regulations in Luxembourg

🇱🇺 CSSF Warning high

April 15th 2026

Warning concerning fraudulent activities by persons misusing the name of Coinbase Luxembourg S.A.

No description available.

Sectors:

Crypto & Digital Assets Payments & E-Money

Topics:

AML / Financial Crime Consumer Protection / Conduct Authorisation & Licensing

Crypto ExchangeFintechPayment Provider

View Original

🇱🇺 CSSF Guidance high

April 1st 2026

Circular CSSF 26/909

Application of the Guidelines of the European Securities and Markets Authority for the criteria on the assessment of knowledge and competence under the Markets in Crypto Assets Regulation (MiCA) (ESMA35-24871704-2922)

AI Analysis

Circular CSSF 26/909 specifies how the CSSF applies ESMA's Guidelines (ESMA35-24871704-2922) for assessing **knowledge and competence** criteria under MiCA, targeting staff involved in crypto-asset services. It matters because it enforces MiCA's staff certification requirements, ensuring Luxembourg CASPs meet EU-wide standards for consumer protection and operational integrity amid the full MiCA rollout on 30 December 2024.

What Changed

- Adoption of ESMA Guidelines: CSSF mandates application of ESMA's criteria for evaluating staff knowledge and competence in crypto-asset services, including roles in custody, trading, portfolio...
Assessment Framework: Firms must implement standardized tests and processes to verify staff qualifications, aligning with MiCA Article 62 on CASP authorization, focusing on technical crypto...
No New Standalone Rules: This circular builds on prior CSSF MiCA circulars (e.g., 25/890 on crypto-asset classification), integrating competence checks into licensing dossiers and ongoing supervision.

Suggested Considerations

Assess Staff Competence: Implement ESMA-guided evaluations (e.g., exams, certifications) for all relevant personnel handling crypto services; document results in governance frameworks.
Update Policies and Training: Integrate competence criteria into HR, onboarding, and annual reviews; roll out MiCA-specific training on reporting, breaches, and governance.
Licensing Dossier Enhancement: Include competence attestations in CSSF applications; appoint dedicated compliance/risk officers with verified qualifications.
Ongoing Monitoring: Conduct regular audits, penetration tests, and incident planning; confirm compliance annually via management body statements.
Early CSSF Engagement: Schedule dialogues and info sessions; create MiCA readiness scorecards for board and regulator discussions.

Key Dates

1 April 2026

Circular CSSF 26/909 published; immediate application of ESMA competence guidelines.; [User-provided content]

Compliance Impact

Urgency: High – With publication today (1 April 2026) and MiCA's CASP regime live since 30 December 2024, firms face immediate supervisory scrutiny during licensing and VASP transitions ending 1 July 2026. Non-compliance risks authorization denial, enforcement, or operational halts, especially as CSSF audits dossiers for competence gaps amid Luxembourg's role as MiCA hub.

References

AI-generated analysis. May contain errors or omissions — verify with the original CSSF source before acting. Full disclaimer.

Sectors:

Crypto & Digital Assets Capital Markets & Trading Payments & E-Money

Topics:

Authorisation & Licensing Senior Managers / Governance Consumer Protection / Conduct

Crypto ExchangeBankFintech

View Original

🇱🇺 CSSF Guidance high

February 17th 2026

FAQ concerning the Luxembourg Law of 17 December 2010 relating to undertakings for collective investment (Updated)

Version 23

AI Analysis

This CSSF FAQ (Version 23, updated 17 February 2026) provides interpretive guidance on the Luxembourg Law of 17 December 2010 relating to undertakings for collective investment (UCIs), covering UCITS, Part II UCIs, SIFs, and SICARs. It matters for compliance professionals as it clarifies authorisation processes, investment rules, and supervisory expectations, ensuring alignment with evolving EU frameworks like AIFMD and MiCAR. The update, effective today, addresses recent regulatory shifts including crypto-asset integration.

What Changed

- Authorisation Requirements: UCIs require CSSF approval of constitutive documents (articles, management regulations), depositary selection, and management company/AIFM applications for contractual...
Crypto-Asset Updates (aligned with separate but related FAQ Version 7): Replaces "virtual assets" with "crypto-assets" per MiCAR (EU 2023/1114); UCITS and retail AIFs (non-well-informed investors)...
Investment Policies and Liquidity Management: Funds must detail objectives, strategies, asset classes, restrictions, borrowing, and conflicts; look-through for intermediary vehicles per ESMA/AIFMD...
Risk Spreading Exemptions: Limits do not apply to OECD/EU-guaranteed securities or UCIs with comparable risk-spreading.
Depositary Role in Crypto: Luxembourg depositaries can custody crypto-assets with safeguards and CSSF notification; responsibility varies by model (depositary or MiCAR provider).

Suggested Considerations

Review and Update Documents: Align UCI constitutive documents, investment policies, and sales documents with clarified rules on strategies, LMTs, conflicts, and risk-spreading; apply look-through for intermediaries.
Crypto-Specific: For >10% NAV exposure, apply for "Other-Other Fund-Crypto-assets" extension (custody, valuation, AML/CFT plans, expertise); notify CSSF for depositary crypto custody; implement heightened AML/CFT due diligence per FATF/Luxembourg assessments.
Authorisation/Amendments: Submit for CSSF approval on new setups, manager changes, or sub-funds (esp. SICAV multi-sub-funds with EU cross-border services).
Governance and Reporting: Ensure RC/RR demonstrate crypto risk understanding; update disclosures for investors on risks, LMTs, and fair treatment.
Ongoing Compliance: Use FAQ/Compilation for RAIFs/SIFs/SICARs/Part II UCIs; auditors/managers confirm tax-exempt status for SICARs.

Key Dates

20 May 2025

Related AIFM FAQ Version 24; Introduces changes relevant to UCI managers acting as AIFMs

16 January 2026

UCI Authorisation page update; Reflects ongoing CSSF expectations for approvals

04 February 2026

Crypto FAQ Version 7 update effective; MiCAR-aligned changes on crypto exposure, authorisation extensions, and depositary notifications

17 February 2026 DEADLINE

FAQ Version 23 update effective; Applies immediately to UCI operations, authorisations, and compliance.[User-provided content]

Compliance Impact

Urgency: High – The update coincides with MiCAR implementation and today's release, requiring immediate review for crypto-exposed funds to avoid unauthorised strategies or AML gaps; non-compliance risks supervisory actions, authorisation delays, or investor disputes in Luxembourg's key fund domicile.

References

AI-generated analysis. May contain errors or omissions — verify with the original CSSF source before acting. Full disclaimer.

Sectors:

Investment Management Crypto & Digital Assets Wealth & Private Banking

Topics:

Authorisation & Licensing Reporting & Disclosure AML / Financial Crime

Asset ManagerHedge FundAll Firms

View Original

🇱🇺 CSSF Warning high

February 12th 2026

Warning concerning the website www.digitalasset-bank.com

No description available.

Sectors:

Banking & Credit Crypto & Digital Assets

Topics:

AML / Financial Crime Authorisation & Licensing

BankFintechCrypto Exchange

View Original

🇱🇺 CSSF Warning high

February 5th 2026

Crypto frauds and scams

No description available.

Sectors:

Crypto & Digital Assets

Topics:

AML / Financial Crime Consumer Protection / Conduct

Crypto ExchangeAll Firms

View Original

🇱🇺 CSSF Guidance high

February 4th 2026

The CSSF has updated its FAQ Crypto-Assets - Undertakings for collective investment (previously FAQ Virtual Assets - Undertakings for collective investment) and draws the attention to the following points

No description available.

AI Analysis

The Commission de Surveillance du Secteur Financier (CSSF) has updated its FAQ on crypto-asset investments by undertakings for collective investment, effective February 4, 2026, to align with the EU's Markets in Crypto-Assets Regulation (MiCAR). This update establishes clear investment limits and licensing requirements for UCITS and AIFs investing in crypto-assets, fundamentally reshaping how Luxembourg-regulated funds can structure crypto exposure.

AI-generated analysis. May contain errors or omissions — verify with the original CSSF source before acting. Full disclaimer.

Sectors:

Investment Management Crypto & Digital Assets Capital Markets & Trading

Topics:

Authorisation & Licensing Prudential / Capital Requirements AML / Financial Crime

Asset ManagerHedge FundFintech

View Original

🇱🇺 CSSF Guidance high

February 4th 2026

FAQ Crypto-Assets – Undertakings for collective investment (Updated)

Version 7 – 04/02/2026

AI Analysis

The CSSF has released Version 7 of its FAQ on Crypto-Assets for Undertakings for Collective Investment, updated on February 4, 2026, to reflect the entry into force of the Markets in Crypto-Assets Regulation (MiCAR). This guidance establishes binding investment limits, authorization requirements, and risk management standards for UCITS and AIFs investing in crypto-assets, fundamentally reshaping how Luxembourg-regulated collective investment schemes can engage with digital assets.

What Changed

The most significant regulatory modifications in Version 7 include: Investment Limits for UCITS UCITS may invest indirectly in crypto-assets for a maximum of 10% of their net asset value (NAV). These indirect investments are limited to transferable securities that do not embed derivatives in accordance with Article 10 of the Grand-ducal Regulation of 8. Investment Limits for AIFs AIFs open to retail investors other than well-informed investors may invest in crypto-assets for a maximum of 10% of their NAV.

Suggested Considerations

*Immediate Compliance Steps:
*Portfolio Audit: Conduct a comprehensive review of all UCITS and AIF holdings to identify current and potential crypto-asset exposures, both direct and indirect (including derivatives with crypto underlyings).
*Investment Policy Updates: Revise fund documentation, prospectuses, and investment policies to reflect the 10% NAV limits and MiCAR compliance requirements.
*Risk Management Assessment: Update risk management policies to address crypto-asset volatility, liquidity, and technological risks, with case-by-case impact assessments on fund risk profiles.
*Investor Notification: Ensure transparent and timely communication with investors regarding any crypto-asset investments or policy changes.

Key Dates

February 4, 2026

- FAQ Version 7 effective date (entry into force of MiCAR alignment)

July 1, 2026 DEADLINE

- Deadline for Virtual Asset Service Providers (VASPs) to transition to CASP authorization or cease operations

No specific implementation grace period

- The FAQ does not specify a transition period for existing funds exceeding the 10% limit; firms should clarify this with the CSSF immediately

Compliance Impact

Urgency Rating: HIGH

References

AI-generated analysis. May contain errors or omissions — verify with the original CSSF source before acting. Full disclaimer.

Sectors:

Investment Management Crypto & Digital Assets Capital Markets & Trading

Topics:

Authorisation & Licensing Prudential / Capital Requirements Reporting & Disclosure

Asset ManagerHedge FundFintech

View Original

🇱🇺 CSSF Enforcement high

August 18th 2025

Circular CSSF 25/896

Adoption of the EBA Guidelines on internal policies, procedures and controls to ensure the implementation of Union and national restrictive measures (sanctions)

AI Analysis

Circular CSSF 25/896 adopts the EBA Guidelines EBA/GL/2024/14 and EBA/GL/2024/15, mandating Luxembourg financial institutions to establish robust internal policies, procedures, and controls for complying with EU and national restrictive measures (sanctions). This matters because it sets binding EU-wide standards to prevent sanctions violations and circumvention, with absolute obligations for immediate asset freezing and reporting, amid escalating geopolitical tensions.

What Changed

- Institutions must develop, implement, and maintain up-to-date policies, procedures, and controls for identifying, investigating, and applying restrictive measures without delay, including risk...
Management body responsibilities expanded: approve sanctions compliance strategy, oversee implementation, conduct at least annual assessments of exposure and controls, ensure remedial actions, and...
Screening and monitoring requirements: Maintain updated sanctions lists with immediate integration of changes; screen customer base, transactions, and datasets accurately; enable immediate...
Training and testing: Deliver regular, documented role-specific training; perform ongoing system testing for screening calibration, list accuracy, transaction monitoring effectiveness, and reporting.
Proportionality applies based on institution's size, activities, and exposure; PSPs and CASPs explicitly addressed with tailored controls.

Suggested Considerations

Conduct annual exposure assessments to sanctions risks and circumvention; update policies accordingly.
Appoint senior management/board-level responsibility for approving and overseeing sanctions strategy, including annual reviews and deficiency reporting.
Implement reliable screening systems for customers, transactions, and lists; define screenable datasets; test systems regularly for effectiveness (e.g., immediate freezing, accurate hits).
Provide documented training to relevant staff on sanctions, institutional exposure, and internal processes.
Establish processes for immediate action on matches: suspend transfers, freeze assets, report to Ministry of Finance/CSSF/FIU without delay; maintain whitelists only under strict conditions.

Compliance Impact

Urgency: High – With less than 12 months until the 30 December 2025 deadline (as of January 2026), firms face binding requirements for absolute compliance, including personal accountability for management bodies; non-compliance risks enforcement by CSSF, reputational damage, and fines amid frequent EU sanctions updates (e.g., Regulations 2025/1469, 2025/1476). This elevates sanctions from operational task to strategic board priority.