Crypto License in Luxembourg
Luxembourg has positioned itself as one of the financial centre anchors for crypto-asset service providers operating under MiCA. The Commission de Surveillance du Secteur Financier (CSSF) acts as the single competent authority for both authorization and supervision, giving applicants one regulatory point of contact rather than a split process across multiple bodies.
For projects already holding a license as a credit institution, electronic money institution, or investment firm, the regime also allows a lighter notification route rather than a full authorization file.
The jurisdiction combines an established fund and banking ecosystem with full EU passporting rights under a single CASP authorization. For a project that has outgrown the appeal of a purely offshore base and is targeting institutional counterparties or EU-wide distribution, Luxembourg sits among the more credible entry points into the regulated European market. For an overview of all MiCA license types, see our MiCA license guide.
Quick Facts: Luxembourg CASP license
| Label | Value |
| License Type | Crypto-Asset Service Provider (CASP) |
| Regulator | Commission de Surveillance du Secteur Financier (CSSF) |
| Legal Basis | Regulation (EU) 2023/1114 (MiCA), Law of 6 February 2025 |
| Application Routes | Authorization (Article 62) or notification for already-regulated entities (Article 60) |
| Minimum Capital | EUR 50,000 to EUR 150,000, depending on license class |
| Application Fee | EUR 15,000 (lump sum, payable annually) |
| Corporate Tax | Approx. 24.94% effective (Luxembourg City) |
| Passporting | EU-wide, under Article 59(7) MiCA |
| Timeline | Approx. 9 to 12 months total (scoping, incorporation, file preparation, CSSF review) |
Business Development Manager, leading the mandate engagement function across crypto, FinTech, gaming, and international corporate structuring verticals.
Experts in fintech and crypto licensing worldwide.
CASP License Classes Under MiCA
MiCA does not issue a single undifferentiated license. The regulation ties the applicable capital threshold to the scope of activity, meaning the correct starting point for any Luxembourg application is an honest mapping of the business model against the three service classes below. This structure is harmonized across the EU, so the same tiers apply whether the entity is authorized in Luxembourg, Lithuania, or any other member state.
| Covered Services | Minimum Capital | |
|---|---|---|
| Class 1 | Reception and transmission of orders, execution of orders on behalf of clients, advice, portfolio management | EUR 50,000 |
| Class 2 | Exchange of crypto-assets for funds or other crypto-assets, placing of crypto-assets | EUR 125,000 |
| Class 3 | Operation of a trading platform, custody and administration of crypto-assets on behalf of clients | EUR 150,000 |
Regulatory Framework for CASPs in Luxembourg
How MiCA, national law, and CSSF supervision fit together. MiCA replaced the patchwork of national crypto regimes that previously governed the sector, including Luxembourg’s earlier VASP registration model under the 2020 amendment to the AML law. The framework below reflects the regime as it stands following the end of the transitional grandfathering period.
The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) will apply from 10 July 2027, replacing the current AMLD framework with directly applicable rules across all member states. For Luxembourg CASPs, this means:
- The AML/CFT program must be reviewed and updated to align with the new regulation’s requirements
- The compliance officer role will become a designated function under the AMLR, with specific competence and independence requirements
- Customer due diligence thresholds and enhanced due diligence triggers will be harmonized across the EU
- A new EU AML Authority (AMLA) will have direct supervisory powers over the highest-risk financial entities
CASPs authorized before July 2027 will need to adapt their compliance frameworks to the new rules. The CSSF is expected to issue transitional guidance.
Regulation (EU) 2023/1114, known as MiCA, entered into force in June 2023, with the provisions governing crypto-asset service providers becoming applicable from 30 December 2024. Luxembourg transposed the national elements of the regime through the Law of 6 February 2025 on digital finance, which designates the CSSF as the competent authority and inserts a new Article 24-1 into the AML/CFT Law of 12 November 2004, bringing CASPs formally under that supervisory regime.
The CSSF does not delegate anti-money laundering oversight to a separate body. It supervises CASPs directly under the amended 2004 AML/CFT Law, supported by sector-specific guidance including Circular CSSF 25/878 on money laundering and terrorist financing risk factors, Circular CSSF 25/879 on the crypto Travel Rule, and Circular CSSF 25/875 on the suitability assessment of management bodies and shareholders.
The CASP must connect its transaction monitoring system to the CSSF’s goAML platform for suspicious transaction reporting. The compliance officer is responsible for filing reports and maintaining the relationship with the CSSF on AML/CFT matters. Explore LegalBison’s fractional compliance service.
A Luxembourg CASP authorization is not confined to the domestic market. Once granted, the entity can notify its intention to provide services in other EU member states, either by establishing a branch or under freedom to provide services, without undergoing a separate national licensing process in each destination. This single-authorization, EU-wide reach is one of the core commercial arguments for choosing a MiCA jurisdiction over an offshore base.
CASPs authorized in Luxembourg also fall within the scope of the Digital Operational Resilience Act (Regulation (EU) 2022/2554), which layers the following requirements on top of the MiCA authorization:
- ICT risk management framework covering prevention, detection, response, and recovery
- Incident reporting to the CSSF within 4 hours for major ICT-related incidents
- Digital operational resilience testing, including threat-led penetration testing for significant CASPs
- Third-party ICT service provider register and oversight framework (including cloud providers, custody technology, and AML software vendors)
- Information sharing arrangements on cyber threat intelligence
This is not a separate license, but it shapes the operational documentation a CASP must maintain on an ongoing compliance budget. A small CASP should expect to allocate resources for a compliance tooling stack (transaction monitoring, goAML connection, incident reporting) and periodic resilience testing.
Not every applicant goes through the same door. An entity building a crypto business from scratch applies for full authorization under Article 62 of MiCA. A firm already licensed as a credit institution, electronic money institution, investment firm, or certain other regulated entities may instead be eligible for the lighter notification route under Article 60, since the prudential and governance groundwork has, to a degree, already been assessed by the regulator or an equivalent EU authority.
A Luxembourg CASP can serve clients outside the EU. MiCA does not restrict the CASP to EU clients only. However, if the CASP wants to provide services to clients in a non-EU country, it must comply with that country’s local regulatory requirements. The CASP cannot rely on its Luxembourg authorization to operate in jurisdictions outside the EU without local licensing.
For non-EU firms seeking to access EU clients, reverse solicitation remains possible under MiCA Art. 42. If a non-EU client initiates the relationship and requests services on their own initiative, the CASP can provide services without a full EU authorization. However, the CSSF and ESMA take a narrow view of reverse solicitation: the client must genuinely initiate the relationship, and the CASP cannot market or solicit business from EU clients and then claim reverse solicitation.
Entities that had registered as VASPs under the pre-MiCA regime were permitted to continue operating during a transitional window. That grandfathering period closed on 1 July 2026. Any entity still operating without a full CASP authorization or Article 60 notification after that date is doing so outside the regulated perimeter, which has direct consequences for banking access and institutional counterparties. For details on the post-transition landscape, see our CASP license adaptation guide.
Path to CASP Authorization in Luxembourg
A structured, multi-stage process managed through the CSSF’s own filing system. Total timeline is approximately 9 to 12 months, depending on application quality and CSSF review cycles.
Scoping:
Initial engagement with the CSSF to confirm the intended license class, business model, and any notification-route eligibility for already-regulated applicants. The CSSF uses this stage to set expectations about the review timeline and the documentation it will require. Skipping this step or submitting an incomplete initial file is the most common cause of delays.
Incorporation:
The Luxembourg entity is incorporated, typically as a societe anonyme (SA) or societe a responsabilite limitee (SARL), alongside the appointment of local management and governance structures. The CSSF expects at least two directors who pass a fit and proper assessment. The entity must have a registered office in Luxembourg.
Compliance build-out:
AML/CFT program, governance documentation, safeguards required under the amended Law of 12 November 2004 and MiCA’s regulatory technical standards.
Application filing:
The formal authorization file is submitted through the CSSF’s electronic filing channel, in the format prescribed by the applicable delegated and implementing regulations.
CSSF review:
The CSSF reviews the application, issues requests for clarification, and may request additional documentation. The review timeline depends on the completeness of the initial file and the complexity of the business model. Authorization is granted once the CSSF is satisfied that all prudential, governance, and AML/CFT requirements are met. The entity is then entered on ESMA’s public CASP register.
Passporting notification:
Notification of passporting rights to the host member states where the CASP intends to operate under freedom of establishment or freedom to provide services. Each host member state has up to 3 months to assess the notification.
Other MiCA Jurisdictions Worth Considering
Luxembourg is one route into the MiCA-regulated EU market, not the only one. Depending on timeline, budget, and target client base, another CASP jurisdiction or a broader look at crypto licensing options may fit the project better.
Crypto License in Bulgaria
from 5.000 €-
Low tax EU country
-
Comprehensive framework
-
High skilled IT workforce
Crypto License in Czech Republic
from 4.200 €-
EU jurisdiction
-
Light requirements
-
No residency required
Crypto License in Estonia
from 1.420 €-
0% Corporate Income Tax
-
Cheap and fast process
-
No travel needed
Crypto License in Finland
on request-
Prestigious Nordic jurisdiction
-
Reliable and trusted framework
-
Simple authorization process
Crypto License in France
on request-
MiCA compliant
-
Allows portfolio management
-
High reputation
Crypto License in Italy
on request-
Prestigious EU jurisdiction
-
Financial hub
-
In high demand
Structuring a Crypto Company in Luxembourg
What a CASP authorization looks like once the license is granted. Holding a CASP authorization is one part of the equation. The corporate vehicle, tax position, and banking relationships around it determine whether the structure is actually operable day to day.
- Corporate Form and Governance
- Taxation of Luxembourg CASPs
- Banking and Operational Substance
The societe anonyme (SA) and societe a responsabilite limitee (SARL) are the two capital-company forms most CASP applicants use, alongside the less common SCA and SAS structures, all of which fall within the scope of Luxembourg's corporate income tax. The CSSF's suitability assessment under Circular 25/875 extends to both shareholders and members of the management body, meaning governance cannot be treated as a formality bolted on after incorporation. MiCA itself does not impose a blanket residency requirement on directors; in practice, applicants are generally advised to build genuine, demonstrable local governance rather than rely on a nominal registered office with decisions taken entirely elsewhere.
Practical substance expectations:
- At least two directors who pass the CSSF fit and proper assessment
- Board meetings held in Luxembourg on a regular basis (quarterly minimum recommended)
- Documented decision-making records showing Luxembourg-based governance
- A compliance officer with direct access to the company's monitoring systems and the ability to report to the CSSF
- No mandatory local office lease, but a registered office address is required
Corporate income tax in Luxembourg is charged at 15% on income up to EUR 175,000 and at 17% on income above EUR 200,000, with a transitional bracket in between. On top of this, a 7% solidarity surcharge applies, and municipal business tax adds a further layer, roughly 6.75% in Luxembourg City itself. Combined, the effective corporate tax burden for a Luxembourg City entity lands at approximately 24.94%. Companies based in other communes may see a modestly different effective rate, since the municipal component varies by location.
Crypto-specific income (trading fees, custody fees, exchange commissions) is taxed as ordinary business income at the standard corporate rates. Luxembourg does not impose a separate crypto-specific tax.
A CASP authorization improves banking access considerably compared to operating outside the regulated perimeter, but Luxembourg's banking sector remains selective, and onboarding is not automatic on the strength of the license alone. Institutions weigh the AML/CFT program, the transaction monitoring framework, and the credibility of the ownership structure. Building genuine operational substance, real governance activity, documented decision-making, and a functioning compliance program, tends to matter as much to a banking partner as the authorization itself.
Practical steps that improve banking outcomes:
- A complete and tested AML/CFT program with documented risk assessments
- A transaction monitoring system that is operational (not just planned)
- A compliance officer who has relevant experience and is actively engaged
- A clear business plan showing legitimate use cases and client onboarding flows
- Source of funds documentation for all shareholders and ultimate beneficial owners
FAQ About the Luxembourg CASP License
Not automatically. If the project involves issuing asset-referenced tokens (ARTs), separate EBA authorization is required under Art. 43. If the project involves issuing e-money tokens (EMTs), separate authorization as a credit institution or electronic money institution is required under Art. 48. The CASP authorization covers the service activities (exchange, custody, execution), not the token issuance itself.
Start Your Luxembourg CASP
Book a free consultation to get a clear roadmap for your Luxembourg authorization.
Business Development Manager, leading the mandate engagement function across crypto, FinTech, gaming, and international corporate structuring verticals.
Experts in fintech and crypto licensing worldwide.