Crypto License in Luxembourg

Crypto-authorization process in the Luxembourg Virtual Currency Registry

The crypto authorization process to register a company into the Luxembourg virtual currency registry is done by forwarding a request to the CSSF. The process can be qualified of simple, as the Luxembourg regulator has laid out a straightforward process with very clear requirements.

However, one may keep in mind that Luxembourg is an international high level financial center and expect some level of financial gatekeeping. Hence the importance of acknowledging the process carefully before applying to a VASP license in Luxembourg.

The registration of Luxembourg Company in Register of crypto currency companies

The registration of a company into the Luxembourg registry of crypto entities starts with a meeting at the CSSF’ offices. The goal is to present the project to the regulatory authorities and explain why the project team wants to be regulated in Luxembourg.

Following this first step, the CSSF will conduct an analysis of the project and assess if the activities can be regulated in Luxembourg and perform a first check of the compliance with professional obligations from the AML/KYC framework of the jurisdiction.

Next, the crypto project is liable to complete its application by providing the necessary supporting documents and information. For this purpose, the CSSF will open access to its online file management system (“MFT”) and the following steps may be conducted remotely.

Though there are rules with specific requirements established, the CSSF has the right to ask for more documentation and information from the applicant before granting a crypto license.

Governmental Statements on Crypto in Luxembourg

Luxembourg is a highly reputed financial center, the home of numerous institutions such as the European Investment Bank and the European Investment Fund and a very stable country for business.

The development since 2020 of a regulatory framework around cryptocurrency demonstrates Luxembourg’s willingness to approach this new segment of the financial market with a constructive attitude. The creation of a framework dedicated to the qualification of digital assets, bridging cryptocurrencies and other virtual assets with market finance, has been encouraged by the Government of the Grand Duchy of Luxembourg.

Minister of Finance, Yuriko Backes, commented on the situation by stating that these efforts were necessary to place Luxembourg as a pioneer in the era of digitization of finance.

Requirements for companies engaged in crypto activities in Luxembourg

In order for a company to engage in crypto activities in Luxembourg, it is necessary to acknowledge the requirements of the CSSF.

At the very beginning of the process, the applicant must send a request for registration as a virtual asset service provider, which includes:

• Identity details about the directors and shareholders (identity, address) or legal entity if relevant;
• The services to be provided under the crypto license of Luxembourg;
• A description of the identified money laundering and terrorist financing risks and how the company manages these risks (internal control mechanisms).

At the corporate structure level, the entity applying for a VASP license in Luxembourg must appoint at least 2 managers and 1 compliance officer. The operation must also prepare for an independent audit function.

The founders must demonstrate their fitness and property by providing a resume and a certificate of non criminal record.

Strong emphasis is expected by the CSSF on compliance with the AML/KYC laws of Luxembourg. The applicant must prepare documents and systems on that regard, including but not limited to:

• Internal policies, controls and procedures;
• Risk modelization;
• Employee screening;
• Record keeping at every level of the operation;
• Customer due diligence rules and systems;
• Reporting set-up through the CSSF tool (“goAML”);
• AML/CTF policies.

Finally, starting from the first year, a crypto company registered in Luxembourg is liable to pay a fee of 15,000 EUR.

The process of setting up a company for a cryptocurrency business in Luxembourg

It is not mandatory to set up a company in Luxembourg in order to get the VASP license in Luxembourg and to start a cryptocurrency business. The license has mostly been granted to other European entities (CoinHouse in France, Zodia in Ireland, Sygnum in Switzerland).

This means that non-European projects are advised to register a company in Luxembourg if they are willing to apply and receive a crypto license in the Grand Duchy.

As a business friendly jurisdiction and former tax haven, Luxembourg is an easy place to start a company. The process can be done remotely and requires the provision of just a few documents and the payment of the incorporation costs and fees.

Taxation for cryptocurrency companies in Luxembourg

For cryptocurrency companies registered in Luxembourg, profits are taxable depending on the company turnover. The rate that applies are the following:

• 15% for income lower than 175.000 EUR;
• 26.650 EUR + 31% of the profits - 175.000 EUR, if the income is included between 175.001 and 200.000 EUR;
• 17% for income above 200.001 EUR.

A solidarity surtax of 7% applies on the corporate income taxed amount (not on the income basis).

A municipality tax also applies, depending on the city of registration in the Grand Duchy of Luxembourg. In Luxembourg City, this tax is 6.75%.

As a matter of example, a company registered in Luxembourg City will be liable to pay taxes at a consolidated rate of 24,95%.

Obligations for crypto companies in Luxembourg

The obligations for crypto companies in Luxembourg are mainly strict compliance with the professional obligations laid down in the AML/CFT Law and the maintenance of a sound financial and corporate structure.

A virtual asset service provider in Luxembourg must conduct an AML/CFT risk assessment on a regular basis, taking into consideration every factor of risk: the customers, their countries or geographical areas, the services and crypto assets, the monitoring and reporting systems, the employee ability to enforce the rules, etc.

Though not set in law, the CSSF explicitly advises the usage of automated tools for transactions monitoring, reporting and customer due diligence (KYC “Know Your Customer”).

These tools will then allow the crypto licensed company in Luxembourg to report any suspicious activity or transactions they identify. For this purpose, the company must be registered and properly connected to the CSSF’s reporting system “goAML”. These obligations are the end goal of compliance with the Law of 19 December 2020 which further enforces the AML/KYC obligations of crypto companies in Luxembourg.

Sanctions for violating Luxembourg crypto-business obligations

The AML/CTF Law gives the power to the CSSF to impose administrative sanctions and to take measures against entities which do not comply with the registration requirements and the legal obligations of Luxembourg crypto business companies.

Violating the obligations of the Luxembourg crypto law can lead to prosecution to the Administrative Court of Luxembourg. At a minimum, a legal entity may receive a warning before seeing its crypto license in Luxembourg revoked by the CSSF.

Facilitating financial crime is strongly sanctioned in Luxembourg and the guilty individuals will face international criminal charges for their abuses.