Crypto & Digital Assets in Luxembourg

Key dates

18 June 2025

- FATF adopts modifications to Recommendation 16 to enhance payment transparency, including strengthened travel‑rule standards

24 June 2026

- FATF launches public consultation on guidance for the implementation of the updated Recommendation 16

21 August 2026 Deadline

- FATF public consultation period closes; this is the deadline for private‑sector contributions highlighted by the CSSF

End 2030

- FATF’s revised Recommendation 16 framework is expected to be fully effective, with jurisdictions having implemented the standard into national law or regulation by this date

Suggested considerations

• Map and document all existing and planned cross‑border payment and value‑transfer flows (including virtual asset transfers) to identify where FATF Recommendation 16 and travel‑rule obligations currently apply or will apply by 2030.
• Review the June 2025 FATF modifications to Recommendation 16 and the current consultation materials, and perform a gap analysis against your existing AML/CTF, KYC and payments data standards, including thresholds, data fields, and monitoring use‑cases.
• Establish an internal project for travel‑rule implementation and enhancement that spans AML, operations, technology, legal and data‑protection teams, with explicit ownership and governance.
• Strengthen beneficiary‑side transaction‑monitoring rules to use incoming travel‑rule data for sanctions, fraud and AML detection, including controls to identify misdirected or unusual payments based on name, location, and other attributes.
• Review and, where necessary, update customer due diligence and KYC procedures to ensure the availability and verification of data fields that will be required to travel with transactions (for example, address, town and country, identification numbers, date of birth).

What changed

• *(Based on the CSSF notice plus the 2025 FATF revisions to Recommendation 16 and existing travel‑rule standards; details may be further refined by the new guidance now under consultation.)*
• FATF is issuing implementation guidance for the updated Recommendation 16, which already increased obligations regarding payment transparency, including more granular beneficiary data and expanded...
• Cross‑border payments and value transfers above 1,000 USD/EUR are expected to include additional mandatory beneficiary information, such as beneficiary name, account or unique reference, and at least...
• Beneficiary institutions are given enhanced responsibilities to use travel‑rule information (not just receive it) for transaction monitoring, including detecting misdirected payments and indicators...
• The revised travel rule continues to apply to both traditional wire transfers and value transfers involving virtual assets, reinforcing that Virtual Asset Service Providers (VASPs) must collect,...

Key dates

TBD (from AMLA operational go‑live date in 2025–2026)

- AMLA formally designates its first batch of directly supervised obliged entities at EU level, potentially including entities identified under this circular

25 June 2026

- CSSF publishes Circular 26/914 identifying obliged entities eligible for direct supervision by AMLA and setting the framework for Luxembourg’s contribution to AMLA’s selection and supervisory process

TBD (periodic, post‑AMLA go‑live)

- Periodic reviews by AMLA and the CSSF of eligible entities’ status and updates to the list of entities subject to, or proposed for, direct AMLA supervision

Suggested considerations

• Determine whether your firm is likely to fall within the “eligible for AMLA direct supervision” perimeter by assessing your cross‑border footprint, ML/TF risk profile, group structure, and relative size against AMLA’s high‑risk and cross‑border criteria.
• Review and update the firm‑wide AML/CFT risk assessment to ensure it is robust, data‑driven, and aligned with an EU‑level supervisory perspective, including explicit consideration of cross‑border risks, complex group structures, and high‑risk products.
• Strengthen AML/CFT governance and oversight, including Board and senior management reporting, to demonstrate clear ownership of ML/TF risk, documented risk appetite, and effective challenge consistent with what AMLA expects from directly supervised entities.
• Review and, where necessary, enhance customer due diligence, transaction monitoring, screening and suspicious activity reporting frameworks to withstand more intrusive and harmonised EU‑level scrutiny.
• Map and document cross‑border business lines and passporting activities (branches, agents, tied intermediaries, distributors) to ensure you can provide complete and up‑to‑date information to the CSSF and AMLA on request.

What changed

• - The CSSF formally identifies Luxembourg “obliged entities” under AML/CFT law that are potentially eligible for direct AMLA supervision, clarifying which categories of firms fall into the EU‑level...
• The circular operationalises, at CSSF level, the EU allocation mechanism for direct supervision, building on Regulation (EU) 2024/… establishing AMLA and the forthcoming directly applicable AML...
• The CSSF establishes a process for providing information to AMLA on Luxembourg obliged entities (e.g. size, cross‑border activities, risk profile) to support AMLA’s periodic selection and review of...
• The circular clarifies that CSSF‑supervised entities identified as “eligible” remain under CSSF supervision unless and until AMLA formally designates them for direct supervision, at which point AMLA...
• The circular anticipates enhanced data and reporting requirements for entities assessed as eligible for AMLA direct supervision, including more granular information on cross‑border business,...

Key dates

1 April 2026

Circular CSSF 26/909 published; immediate application of ESMA competence guidelines.; [User-provided content]

Suggested considerations

• Assess Staff Competence: Implement ESMA-guided evaluations (e.g., exams, certifications) for all relevant personnel handling crypto services; document results in governance frameworks.
• Update Policies and Training: Integrate competence criteria into HR, onboarding, and annual reviews; roll out MiCA-specific training on reporting, breaches, and governance.
• Licensing Dossier Enhancement: Include competence attestations in CSSF applications; appoint dedicated compliance/risk officers with verified qualifications.
• Ongoing Monitoring: Conduct regular audits, penetration tests, and incident planning; confirm compliance annually via management body statements.
• Early CSSF Engagement: Schedule dialogues and info sessions; create MiCA readiness scorecards for board and regulator discussions.

What changed

• - Adoption of ESMA Guidelines: CSSF mandates application of ESMA's criteria for evaluating staff knowledge and competence in crypto-asset services, including roles in custody, trading, portfolio...
• Assessment Framework: Firms must implement standardized tests and processes to verify staff qualifications, aligning with MiCA Article 62 on CASP authorization, focusing on technical crypto...
• No New Standalone Rules: This circular builds on prior CSSF MiCA circulars (e.g., 25/890 on crypto-asset classification), integrating competence checks into licensing dossiers and ongoing supervision.

Key dates

20 May 2025

Related AIFM FAQ Version 24; Introduces changes relevant to UCI managers acting as AIFMs

16 January 2026

UCI Authorisation page update; Reflects ongoing CSSF expectations for approvals

04 February 2026

Crypto FAQ Version 7 update effective; MiCAR-aligned changes on crypto exposure, authorisation extensions, and depositary notifications

17 February 2026 Deadline

FAQ Version 23 update effective; Applies immediately to UCI operations, authorisations, and compliance.[User-provided content]

Suggested considerations

• Review and Update Documents: Align UCI constitutive documents, investment policies, and sales documents with clarified rules on strategies, LMTs, conflicts, and risk-spreading; apply look-through for intermediaries.
• Crypto-Specific: For >10% NAV exposure, apply for "Other-Other Fund-Crypto-assets" extension (custody, valuation, AML/CFT plans, expertise); notify CSSF for depositary crypto custody; implement heightened AML/CFT due diligence per FATF/Luxembourg assessments.
• Authorisation/Amendments: Submit for CSSF approval on new setups, manager changes, or sub-funds (esp. SICAV multi-sub-funds with EU cross-border services).
• Governance and Reporting: Ensure RC/RR demonstrate crypto risk understanding; update disclosures for investors on risks, LMTs, and fair treatment.
• Ongoing Compliance: Use FAQ/Compilation for RAIFs/SIFs/SICARs/Part II UCIs; auditors/managers confirm tax-exempt status for SICARs.

What changed

• - Authorisation Requirements: UCIs require CSSF approval of constitutive documents (articles, management regulations), depositary selection, and management company/AIFM applications for contractual...
• Crypto-Asset Updates (aligned with separate but related FAQ Version 7): Replaces "virtual assets" with "crypto-assets" per MiCAR (EU 2023/1114); UCITS and retail AIFs (non-well-informed investors)...
• Investment Policies and Liquidity Management: Funds must detail objectives, strategies, asset classes, restrictions, borrowing, and conflicts; look-through for intermediary vehicles per ESMA/AIFMD...
• Risk Spreading Exemptions: Limits do not apply to OECD/EU-guaranteed securities or UCIs with comparable risk-spreading.
• Depositary Role in Crypto: Luxembourg depositaries can custody crypto-assets with safeguards and CSSF notification; responsibility varies by model (depositary or MiCAR provider).

Key dates

4 February 2026 Deadline

- FAQ Version 7 effective date; MiCAR compliance requirements become operative

1 July 2026 Deadline

- Deadline for Virtual Asset Service Providers (VASPs) to transition from registration to authorization under MiCAR or cease operations

Suggested considerations

• *For UCITS Managers:
• by-case assessment of crypto-asset investment impact on fund risk profiles
• specific risks (volatility, liquidity, technological risk)
• asset investments
• *For AIFMs Managing AIFs with Crypto Exposure:

What changed

The regulatory framework introduces several material modifications: Investment Exposure Limits UCITS may invest indirectly in crypto-assets for a maximum of 10% of their net asset value (NAV). These indirect investments are restricted to transferable securities that do not embed derivatives. AIFs open to retail investors other than well-informed investors face the same 10% NAV ceiling. MiCAR Alignment The FAQ modifications directly reflect the entry into force of Regulation (EU) 2023/1114 on markets in crypto-assets.

Key dates

February 4, 2026

- FAQ Version 7 effective date (entry into force of MiCAR alignment)

July 1, 2026 Deadline

- Deadline for Virtual Asset Service Providers (VASPs) to transition to CASP authorization or cease operations

No specific implementation grace period

- The FAQ does not specify a transition period for existing funds exceeding the 10% limit; firms should clarify this with the CSSF immediately

Suggested considerations

• *Immediate Compliance Steps:
• *Portfolio Audit: Conduct a comprehensive review of all UCITS and AIF holdings to identify current and potential crypto-asset exposures, both direct and indirect (including derivatives with crypto underlyings).
• *Investment Policy Updates: Revise fund documentation, prospectuses, and investment policies to reflect the 10% NAV limits and MiCAR compliance requirements.
• *Risk Management Assessment: Update risk management policies to address crypto-asset volatility, liquidity, and technological risks, with case-by-case impact assessments on fund risk profiles.
• *Investor Notification: Ensure transparent and timely communication with investors regarding any crypto-asset investments or policy changes.

What changed

The most significant regulatory modifications in Version 7 include: Investment Limits for UCITS UCITS may invest indirectly in crypto-assets for a maximum of 10% of their net asset value (NAV). These indirect investments are limited to transferable securities that do not embed derivatives in accordance with Article 10 of the Grand-ducal Regulation of 8. Investment Limits for AIFs AIFs open to retail investors other than well-informed investors may invest in crypto-assets for a maximum of 10% of their NAV.

Suggested considerations

• Conduct annual exposure assessments to sanctions risks and circumvention; update policies accordingly.
• Appoint senior management/board-level responsibility for approving and overseeing sanctions strategy, including annual reviews and deficiency reporting.
• Implement reliable screening systems for customers, transactions, and lists; define screenable datasets; test systems regularly for effectiveness (e.g., immediate freezing, accurate hits).
• Provide documented training to relevant staff on sanctions, institutional exposure, and internal processes.
• Establish processes for immediate action on matches: suspend transfers, freeze assets, report to Ministry of Finance/CSSF/FIU without delay; maintain whitelists only under strict conditions.

What changed

• - Institutions must develop, implement, and maintain up-to-date policies, procedures, and controls for identifying, investigating, and applying restrictive measures without delay, including risk...
• Management body responsibilities expanded: approve sanctions compliance strategy, oversee implementation, conduct at least annual assessments of exposure and controls, ensure remedial actions, and...
• Screening and monitoring requirements: Maintain updated sanctions lists with immediate integration of changes; screen customer base, transactions, and datasets accurately; enable immediate...
• Training and testing: Deliver regular, documented role-specific training; perform ongoing system testing for screening calibration, list accuracy, transaction monitoring effectiveness, and reporting.
• Proportionality applies based on institution's size, activities, and exposure; PSPs and CASPs explicitly addressed with tailored controls.