Luxembourg crypto license 2026 — CSSF CASP authorisation
Luxembourg is the institutional EU CASP jurisdiction. The CSSF is the single supervisor for authorisation, prudential and conduct supervision, and AML/CFT under MiCA and the Law of 30 May 2025. Substantial substance, banking-grade governance, and a deliberate nine-to-twelve-month cadence define it.
Why Luxembourg is the institutional EU jurisdiction
Luxembourg is one of the EU's principal financial-services centres, with the largest fund-management industry in the bloc outside Ireland, a substantial private-banking sector, and several pan-EU banking subsidiaries. The CSSF has supervised that institutional landscape for decades and brings the same standards to MiCA. The Law of 30 May 2025 designated the CSSF as the national competent authority for CASP authorisation, prudential and conduct supervision, and AML/CFT.
Luxembourg uses a single-supervisor model. Unlike the split arrangements in Italy or Spain, the CSSF wears all hats — which produces administrative simplicity for the applicant: one case team, one application file, one supervisory dialogue. The trade-off is that the CSSF is a high-standards supervisor and the bar is uniformly high across the conduct, prudential, and AML dimensions.
What the CSSF expects from a CASP file
The CSSF's standards reflect its broader supervisory tradition. It expects institutional governance — a management body sized for institutional operations with documented fit-and-proper assessments, and a three-lines-of-defence framework with independent compliance, risk-management, and internal-audit functions. Substance is tested at first contact: a registered office in Luxembourg with documented lease and floor plan, and senior management physically resident in Luxembourg. Letterbox arrangements do not survive review.
Prudential review is granular, drawing on the CSSF's banking-supervision tradition, and the authority may apply higher prudential expectations than the MiCA floor for institutional applicants. ICT and operational-resilience frameworks are expected to be consistent with DORA, and the AML programme must be fully developed with an MLRO appointed and suspicious-transaction reporting to the Luxembourg FIU (CRF). The CSSF's circulars on AML, outsourcing, ICT risk-management, and governance form the working standard around MiCA's statutory floor.
The realistic Luxembourg timeline
The CSSF is a deliberate supervisor. The five-month statutory clock under MiCA Article 63 starts only when the application file is deemed complete, and the pre-screen is thorough, tending to produce detailed information requests. A realistic end-to-end working assumption for an institutional first-time file is nine to twelve months — pre-filing preparation, the CSSF completeness cycle, the active five-month clock, and onboarding to operational commencement.
The pre-engagement option matters in Luxembourg. The CSSF welcomes informal pre-application discussions on substantive matters — governance fit, substance arrangements, and outsourcing structures — and applicants who use pre-engagement constructively tend to file higher-quality first applications and avoid lengthy information-request cycles. For a buyer triaging EU options, Luxembourg sits in the institutional tier alongside Ireland and Germany: high supervisory expertise, a strong reputational signal, and a deliberately rigorous process, with single-supervisor simplicity as its distinctive advantage.
Luxembourg's CASP authorisation is the licence granted by the Commission de Surveillance du Secteur Financier (CSSF) under MiCA Regulation (EU) 2023/1114 Articles 59 and 63, transposed into Luxembourg law by the Law of 30 May 2025, to crypto-asset service providers established in Luxembourg or providing services to Luxembourg clients on a non-passport basis.
Fast facts
| Parameter | Value |
|---|---|
| Regulator | Commission de Surveillance du Secteur Financier (CSSF), Luxembourg City |
| Legal basis | MiCA Regulation (EU) 2023/1114 + Luxembourg Law of 30 May 2025 on markets in crypto-assets |
| Supervisory model | Single supervisor — the CSSF retains authorisation, prudential, conduct, and AML/CFT supervision |
| Initial capital | €50,000 (Class 1) — €150,000 (Class 3), MiCA Annex IV |
| Statutory clock | Five months from a complete file to decision under MiCA Article 63 |
| Application languages | French, German, or English accepted for the supervisory file |
| Pre-MiCA register | No substantive pre-MiCA VASP register beyond AML registration; no transitional grandfathering — every CASP files fresh |
| Best for | Institutional asset managers, banking groups, and private-banking institutions prioritising authorisation quality over speed or cost |
Top counsel for Luxembourg CASP work
Firms below are ranked according to the published CLPAI methodology. Featured selections cover firms with documented Luxembourg engagement, regardless of where they are headquartered.
Frequently asked questions about Luxembourg CASP authorisation
Who supervises CASPs in Luxembourg?
The CSSF is the single supervisor for CASP authorisation, prudential supervision, conduct supervision, and AML/CFT. Luxembourg's MiCA implementation uses a single-supervisor model — unlike the split-supervisor approach of Italy or Spain.
How long does CSSF CASP authorisation take?
Nine to twelve months for a complete first-time file. The five-month statutory clock under MiCA Article 63 starts only once the file is deemed complete, and the CSSF — a deliberate, high-standards supervisor — tends to use the full period for substantial files.
What is the minimum capital for a Luxembourg CASP?
The MiCA Annex IV floors apply: €50,000 for Class 1, €125,000 for Class 2, and €150,000 for Class 3. The CSSF may apply higher prudential expectations for institutional applicants, particularly for trading-platform files.
Can a CASP file the CSSF application in English?
Yes. Luxembourg's multilingual administrative framework accommodates French, German, or English. The CSSF case team operates fluently in English alongside French.
Is Luxembourg right for a venture-stage crypto start-up?
Rarely. The CSSF's substance and governance expectations are calibrated to institutional applicants — established asset managers, banking groups, and fintech subsidiaries of credit institutions. Venture-stage start-ups typically find better fit elsewhere in the EU.
Pitfalls and nuances in Luxembourg
1 Filing a venture-stage application file
The CSSF's application standards are calibrated to institutional applicants. Lean start-up governance, founder-led management bodies without independent oversight, and bootstrap-stage substance arrangements typically do not pass CSSF review. Applicants who self-identify as venture-stage benefit from filing in a different jurisdiction.
2 Underestimating the CSSF substance bar
Luxembourg substance expectations are heavier than the EU median: a registered office with documented lease and floor plan, senior management — typically at least two managers — physically resident in Luxembourg, and compliance and risk-management functions sized for the planned business. Letterbox arrangements fail at first supervisory contact.
3 Treating Luxembourg tax as automatically advantageous
Luxembourg's combined effective tax rate is approximately 24.94% on Luxembourg-source income — competitive but not dramatically below other EU jurisdictions. The historic advantage came from holding-company and fund structures, not baseline operating-company taxation, so CASPs that locate there for tax-only reasons typically pay more than expected.
4 Overlooking the CSSF's investment-firm circulars
The CSSF supervises a large investment-firm and fund-management population, and its circulars on AML, outsourcing, ICT risk-management, and governance inform its CASP expectations. Applicants who approach the file with a 'pure MiCA' framework miss the substantive standards the CSSF applies through its circular guidance.
Practitioners in Luxembourg
Named lawyers from the Crypto Law Index practitioners directory whose jurisdictional coverage includes Luxembourg. Editorial picks, sourced from public records.
Regulator and primary sources
The supervisor of CASP authorisations in Luxembourg is Commission de Surveillance du Secteur Financier (CSSF). The legal basis is MiCA Regulation (EU) 2023/1114 + Luxembourg Law of 30 May 2025 on markets in crypto-assets. Visit www.cssf.lu/en/mica for the regulator's official guidance, application forms, and supervisory expectations.