Luxembourg crypto license 2026 — CSSF CASP authorisation
The CSSF is Luxembourg's single supervisor for CASP authorisation, prudential and conduct supervision and AML/CFT under MiCA and the Law of 6 February 2025. VASPs registered with the CSSF could continue until 1 July 2026; that period has ended. Advisers expect institutional-grade governance and substance.
Last reviewed by the Crypto Law Index editorial desk
Why Luxembourg suits institutional applicants
Luxembourg is one of the EU's principal financial-services centres. The CSSF reported net assets of €6.79 trillion in Luxembourg undertakings for collective investment at 31 August 2026, and the country also has a substantial private-banking sector and several pan-EU banking subsidiaries. The CSSF has supervised that institutional landscape for decades. The Law of 6 February 2025, in force since 10 February 2025, designated it as the national competent authority under MiCA.
Luxembourg uses a single-supervisor model. Unlike Italy, where CONSOB authorises CASPs after an opinion of the Banca d'Italia, the CSSF covers authorisation, prudential and conduct supervision and AML/CFT. That gives the applicant one case team, one application file and one supervisory dialogue. Advisers report that the bar is high across the conduct, prudential and AML dimensions.
What the CSSF expects from a CASP file
Advisers describe the CSSF's expectations as institutional governance: a management body sized for institutional operations with documented fit-and-proper assessments, and a three-lines-of-defence framework with independent compliance, risk-management and internal-audit functions. On substance, MiCA Article 59(2) requires a registered office in Luxembourg, effective management in the EU and at least one EU-resident director; advisers also expect a documented lease and managers working in Luxembourg, and report that letterbox arrangements do not survive review.
The prudential requirement is set by MiCA Article 67: the higher of the Annex IV amount and one quarter of the previous year's fixed overheads. ICT and operational-resilience frameworks are expected to be consistent with DORA, and the AML programme must be fully developed, with an MLRO appointed and suspicious-transaction reporting to the Luxembourg FIU (CRF). Advisers report that the CSSF's circulars on AML, outsourcing, ICT risk management and governance form the working standard around MiCA's statutory floor.
The realistic Luxembourg timeline
The statutory clock of 40 working days under MiCA Article 63 starts only when the application file is deemed complete. Advisers report a thorough pre-screen that tends to produce detailed information requests, and work on nine to twelve months end-to-end for an institutional first-time file (practitioner estimate) — pre-filing preparation, the CSSF completeness cycle, the 40-working-day assessment, and onboarding to operational commencement.
Pre-engagement matters in Luxembourg. Advisers recommend informal pre-application discussions with the CSSF on governance fit, substance arrangements and outsourcing structures, and report that applicants who use them file stronger first applications and avoid long information-request cycles. Advisers place Luxembourg alongside Ireland and Germany for supervisory depth, with single-supervisor simplicity as its distinctive feature.
Luxembourg's CASP authorisation is the licence granted by the Commission de Surveillance du Secteur Financier (CSSF) under MiCA Regulation (EU) 2023/1114 Articles 59 and 63, implemented in Luxembourg by the Law of 6 February 2025, to crypto-asset service providers established in Luxembourg.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Commission de Surveillance du Secteur Financier (CSSF), Luxembourg City |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Luxembourg Law of 6 February 2025 (Mémorial A No. 38, in force 10 February 2025) |
| Supervisory model | Single supervisor — the CSSF retains authorisation, prudential, conduct, and AML/CFT supervision |
| Initial capital | €50,000 (Class 1) — €150,000 (Class 3), MiCA Annex IV |
| Statutory clock | 40 working days from a complete file to decision under MiCA Article 63(9); one information request can suspend it for up to 20 working days |
| Application languages | Advisers report that French, German or English is accepted for the supervisory file; confirm at the pre-application stage |
| Pre-MiCA register | CSSF VASP register under article 7-1 of the AML Law of 12 November 2004; registered firms could continue until 1 July 2026 under the Law of 6 February 2025. The period is over |
| Best for | Institutional asset managers, banking groups, and private-banking institutions prioritising authorisation quality over speed or cost |
Top counsel for Luxembourg CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Luxembourg engagement, regardless of where they are headquartered.
Frequently asked questions about Luxembourg CASP authorisation
Who supervises CASPs in Luxembourg?
The CSSF is the single supervisor for CASP authorisation, prudential supervision, conduct supervision and AML/CFT. Luxembourg's MiCA implementation uses a single-supervisor model — unlike Italy, where CONSOB authorises CASPs after an opinion of the Banca d'Italia.
How long does CSSF CASP authorisation take?
Advisers estimate nine to twelve months end-to-end for a complete first-time file. The statutory clock of 40 working days under MiCA Article 63 starts only once the file is deemed complete, and advisers report that the CSSF tends to use the full period for substantial files.
What is the minimum capital for a Luxembourg CASP?
The MiCA Annex IV floors apply: €50,000 for Class 1, €125,000 for Class 2, and €150,000 for Class 3. Under MiCA Article 67 the requirement is the higher of that amount and one quarter of the previous year's fixed overheads.
Can a CASP file the CSSF application in English?
In practice, yes, according to advisers: they report that the CSSF accepts files in English as well as French and German, and that its case teams work in English. Confirm the language at the pre-application stage.
Is Luxembourg right for a venture-stage crypto start-up?
Rarely, in advisers' experience. They report that the CSSF's substance and governance expectations are calibrated to institutional applicants — established asset managers, banking groups and fintech subsidiaries of credit institutions — and that venture-stage start-ups usually fit better elsewhere in the EU.
Pitfalls and nuances in Luxembourg
1 Filing a venture-stage application file
Advisers report that the CSSF's application standards are calibrated to institutional applicants. Lean start-up governance, founder-led management bodies without independent oversight and bootstrap-stage substance arrangements tend to struggle in CSSF review.
2 Underestimating the CSSF substance bar
MiCA Article 59(2) requires a registered office in Luxembourg, effective management in the EU and at least one EU-resident director. Advisers expect more: a documented lease, at least two managers working in Luxembourg, and compliance and risk-management functions sized for the planned business. Letterbox arrangements do not meet those expectations.
3 Treating Luxembourg tax as automatically advantageous
Luxembourg's combined corporate tax rate on Luxembourg-source income is competitive but not dramatically below other EU jurisdictions. The historic advantage came from holding-company and fund structures, not baseline operating-company taxation, so CASPs that locate there for tax reasons alone often pay more than expected.
4 Overlooking the CSSF's investment-firm circulars
The CSSF supervises a large investment-firm and fund-management population, and advisers report that its circulars on AML, outsourcing, ICT risk management and governance inform its CASP expectations. A file built only around the MiCA text can miss the standards the CSSF applies through its circular guidance.
Practitioners in Luxembourg
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Luxembourg. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Luxembourg is Commission de Surveillance du Secteur Financier (CSSF). The legal basis is MiCA Regulation (EU) 2023/1114 + Luxembourg Law of 6 February 2025 designating the CSSF as competent authority. Visit www.cssf.lu/en/markets-in-crypto-assets-mica-micar for the regulator's official guidance, application forms, and supervisory expectations.
For where every EU and EEA state stands — its authority, its national act and when its transitional period ended — see the MiCA implementation tracker.