Registration of a virtual asset service provider (VASPs)

In accordance with Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets and the national Law of 6 February 2025 repealing Article 7-1 of the AML/CFT Law, it is no longer possible to file a new application for registration as a virtual asset service provider (PSAV/VASP) with the CSSF.

The Law of 6 February 2025 also provides details on the transitional measures targeting VASPs. VASPs registered with the CSSF before 30 December 2024 in accordance with Article 7-1 of the amended Law of 12 November 2004 on the fight against money laundering and the financing of terrorism as in force as of 30 December 2024, shall remain registered in the VASP register established by the CSSF until 1 July 2026 or until they are granted or refused authorisation under Article 63 MiCAR, whichever is sooner.

Persons interested to provide crypto-asset services are required to inform themselves in advance about the applicable regulatory framework, in particular Regulation (EU) 2023/1114 of the European Parliament and of the Council of 31 May 2023 on markets in crypto-assets (MiCAR). MiCAR creates a bespoke regime for crypto-assets that are not already covered in European financial services legislation and establishes an authorisation regime for crypto-asset service providers (CASP/PSCA). Further information is available on the MiCAR and CASP web pages of the website of the CSSF.

The CSSF’s role for the Virtual Asset Service Providers registered in Luxembourg is limited to registration, supervision and enforcement for AML/CFT purposes only. The CSSF shall, in that respect, be authorised to collect fees payable by the VASPs subject to registration and AML/CFT supervision.

No persons established in Luxembourg or providing services in Luxembourg may provide virtual asset services without being registered with the CSSF as provided for in Article 7-1(1) of the Law of 12 November 2004 on the fight against money laundering and terrorist financing (“AML/CFT Law”).

According to Articles 1(20c) and 7-1(1) of the AML/CFT Law, entities, who are established or provide services in Luxembourg, have to register with the CSSF in case they are providing one or more of the following services on behalf of or for their clients:

• exchange between virtual assets and fiat currencies, including the exchange between virtual currencies and fiat currencies;
• exchange between one or more forms of virtual assets;
• transfer of virtual assets;
• safekeeping and/or administration of virtual assets or instruments enabling control over virtual assets, including custodian wallet services;
• participation in and provision of financial services related to an issuer’s offer and/or sale of virtual assets.

Any entity, including any entity already licensed/registered by a competent authority and in particular licensed financial institutions, which already offers any of the virtual asset services described above as of 30 March 2020, has to :

• promptly notify the CSSF thereof by email (to ipig@cssf.lu);
• submit a registration file to the CSSF in order to be specifically registered as a VASP as soon as possible and at the latest by 30 May 2020; and
• comply, as from 30 March 2020, with the professional obligations and the conditions described in the AML/CFT Law, as amended by the March 2020 Laws.

Any entity, including any entity already licensed/registered by a competent authority and in particular licensed financial institutions, which offers or intends to offer any of the virtual asset services described above as from 30 March 2020 has to:

• register beforehand as a VASP; and
• comply with the professional obligations and the conditions described in the AML/CFT Law, as amended by the March 2020 Laws.

The requirement of registration for applicants, who are established or provide services in Luxembourg, is without prejudice to any other licence/registration or other status required either in Luxembourg or by other European or third countries for any other activities performed by the applicant.

The registration procedure generally starts with a meeting at the CSSF premises aiming to present the applicant and its project. Depending on the activities of the project, registration as a VASP may be necessary.

In case the applicant submits a formal registration file to the CSSF for registration, it must include all the documents and information required by using the relevant forms made available on the CSSF website.

The registration file shall exclusively be provided to the CSSF in an electronic form via the MFT (Managed File Transfer) system of the CSSF, for which the required link will be provided to the applicant by the CSSF (upon request to the following email address ipig@cssf.lu). The submission of a registration file does not entail registration with the CSSF. The registration is effective upon inclusion of the applicant in the CSSF register. The CSSF then examines the registration file, by analysing it, exchanging letters and, where appropriate, organising meeting(s) with the relevant stakeholders.

The CSSF reserves the right to ask for additional information and documents during the registration process. The CSSF also reserves the right not to commence the analysis of the registration file as long as the registration file is not complete and the requested information and documents are missing.

When the CSSF has finished its analysis and a formal registration decision has been taken by the CSSF, the CSSF will complete the registration itself. After the registration has been completed, the registered entity is published in the national public register maintained by the CSSF. The fact that a VASP is entered in the register of the CSSF shall not, under any circumstance, be described in any way whatsoever as a positive assessment made by the CSSF of the quality of the services provided by the VASP. The registration, the submission of a registration and/or the CSSF AML/CFT supervision may not be invoked or used for advertising or possible solicitations for business.

If, after the registration, significant changes to the activities or to the key function holders notified upon registration occur, the registered entity has to immediately inform the CSSF in writing. The CSSF has the right to withdraw the entity from the register in case of non-compliance with certain obligations as provided for in Article 7-1(4) of the AML/CFT Law. The CSSF has several supervisory powers and has the power to impose administrative sanctions and other administrative measures as provided for in chapter 3-1 of the AML/CFT Law.