Luxembourg#
Luxembourg's MiCA transitional period ended 1 July 2026, formally closing the national VASP-registration pathway (Article 7-1(2) of the amended 2004 AML law) that had previously governed crypto firms via the Article 143(3) grandfathering clause. The CSSF has continued issuing full CASP authorisations, confirmed for Ripple, B2C2 and Coinbase, while industry sources describe substantial EU-wide market attrition among firms that did not secure authorisation before the cutover.
The legal mechanics of the transition are anchored in MiCA's Article 143(3) grandfathering clause, which permitted firms providing crypto-asset services under Luxembourg's prior national law before 30 December 2024 to continue operating until 1 July 2026 or until a MiCA authorisation decision was issued -- whichever came first. Firms that had been registered under the pre-MiCA virtual-asset-service-provider pathway, specifically Article 7-1(2) of Luxembourg's amended 2004 anti-money-laundering law, have now been largely superseded by the MiCA CASP track, though the precise operational status of any registrants who did not transition is not yet confirmed against the CSSF's public register. Industry commentary referenced in this cycle describes significant market attrition accompanying the cutover, with only a few hundred firms securing full CASP authorisation across the EU out of an estimated several thousand that had been operating under varied national regimes; this figure is treated as a non-binding, directional market observation rather than a regulatory finding, since it is sourced to industry commentary rather than a CSSF or ESMA statistical release.
Outlook
The licensing module is likely to remain amber in the near term less because of ambiguity in the rules themselves -- MiCA's CASP authorisation requirement is now settled EU law with a clear national implementation via the CSSF -- and more because of the transitional friction the cutover has generated: continuing enforcement action against unauthorised firms, uncertainty about the fate of former national VASP registrants, and the broader EU-wide consolidation of the crypto-service-provider population. Subsequent cycles should confirm whether the CSSF's public register shows any lapsed or withdrawn Article 7-1(2) registrations, and should track whether ESMA's supervisory-convergence statements evolve into more concrete enforcement disclosures specific to Luxembourg.
Crypto Licensing
Luxembourg's crypto-licensing regime reached a defined settlement point with the close of the Markets in Crypto-Assets Regulation's Article 143(3) transitional arrangement on 1 July 2026. Luxembourg elected to use the maximum eighteen-month transitional period available to pre-existing registered virtual-asset service providers, and from that date any unauthorised provision of a MiCA-regulated crypto-asset service in the jurisdiction became unlawful. Providing crypto-asset services with Luxembourg as home Member State now requires authorisation as a Crypto-Asset Service Provider from the CSSF under Title V of the Regulation. The authorisation process carries a defined fee structure, EUR30,000 for a new applicant or EUR15,000 for a firm already holding CSSF authorisation in another capacity, alongside minimum capital requirements that scale from EUR50,000 to EUR150,000 according to the specific service class sought. The CSSF commits to a decision within forty working days of receiving a complete application file, giving applicants a reasonably predictable timeline for market entry.
As of the 6 October 2026 ESMA data extract, thirteen firms hold home-state CASP authorisation in Luxembourg. This figure represents the settled outcome of the transition: firms that held pre-MiCA registration and successfully converted to full CASP status during the eighteen-month window are now operating under the new regime, while any that did not complete the transition would, by definition, no longer be lawfully providing MiCA-regulated services in the jurisdiction from 1 July 2026 onward. The shift from a transitional to a steady-state posture changes the nature of the supervisory relationship between the CSSF and authorised firms, moving from transition-management toward ongoing compliance monitoring of an established cohort.
One area of the licensing regime that remains unconfirmed on the evidence available is the national administrative-fine maxima that Luxembourg has set in transposing Article 111 of the Regulation, which governs the penalties competent authorities can impose for breaches. This detail was not independently located, and it represents a genuine gap in the current understanding of the full enforcement architecture available to the CSSF, rather than an indication that no such framework exists.
Outlook
With the transitional cliff-edge now behind it, the near-term trajectory for Luxembourg's crypto-licensing regime is likely to be one of steady-state supervisory compliance monitoring of the thirteen authorised entities, rather than further disruption driven by transition deadlines. The settled authorisation base and clearly defined fee and capital thresholds suggest the regime has reached a mature operational state. Confirmation of the national administrative-fine maxima under Article 111, once located, would complete the picture of the CSSF's full enforcement toolkit, but its absence from the record does not itself indicate instability in the licensing framework as it currently stands.
4 earlier distinct update(s)
Crypto Licensing
Luxembourg's crypto-asset licensing regime reached full maturity on 1 July 2026 with the expiry of the MiCAR Article 143(3) transitional period. This 18-month transitional window had allowed entities already providing crypto-asset services under prior national law to continue operating while their CASP authorisation applications were processed; its expiry means that any entity providing MiCAR-regulated crypto-asset services in Luxembourg without CASP authorisation is now operating outside the law, as confirmed directly on the CSSF's own website. This is a hard, dated boundary rather than a gradual tightening, and it applies uniformly to all crypto-asset service providers active in the jurisdiction regardless of how long they had operated under the prior national regime.
Against this newly-hardened perimeter, Ripple is reported to have received full MiCA CASP authorisation from the CSSF in July 2026, which would enable it to passport its regulated crypto-asset services across all 30 EEA states from its Luxembourg authorisation. This claim is sourced from Ripple's own press release rather than independent confirmation against the CSSF's public CASP register, so it should be read as a probable rather than confirmed development pending corroboration. If accurate, it signals that Luxembourg's authorisation pipeline, now that the transitional grace period has closed, is processing substantial international applicants alongside the domestic entities that were previously operating under the earlier national regime.
A separate, distinct development concerns crypto assets held within investment fund structures: the CSSF updated its FAQ on crypto assets in investment funds, referenced as of March 2026, requiring investment fund managers to assess crypto-asset-related activities against MiCAR Article 60(5). This corroborated law-firm commentary indicates that Luxembourg's substantial fund-management sector is separately being drawn into the MiCA compliance perimeter through its fund-oversight channel, distinct from the direct CASP-authorisation channel governing exchanges and custodians.
One coverage gap should be noted: Luxembourg's 2025 National Risk Assessment reportedly classified the crypto sector as high risk, but this is sourced only via a Tier-3/4 vendor blog and has not been independently confirmed against a primary NRA document this cycle. This is carried forward as an open item rather than an asserted finding.
Outlook
The principal item to watch is whether Ripple's reported CASP authorisation is independently confirmed against the CSSF's public register, and whether other applicants clear authorisation in the post-transitional-period environment. Confirmation or further detail on the 2025 National Risk Assessment's reported high-risk classification of the crypto sector, from a primary source, would also materially sharpen the picture of how Luxembourg's supervisor is calibrating its post-transition enforcement posture.
Crypto Licensing
Luxembourg's crypto-licensing regime reached a structural closure point this cycle with the end of the MiCA VASP-to-CASP grandfathering transition. Under Regulation (EU) 2023/1114 (MiCA), crypto-asset service providers operating in Luxembourg must hold CASP authorisation from the CSSF; the eighteen-month transitional window that allowed previously CSSF-registered virtual asset service providers to continue operating under their existing registration closed on 1 July 2026. This is a Confirmed finding, sourced directly from the CSSF's own 1 July 2026 public statement, and it is binding and in force as of this cycle.
The mechanics of the transition are themselves instructive. VASPs that had registered with the CSSF before 30 December 2024 -- the date the bulk of MiCAR's remaining provisions, including the CASP authorisation requirement, became applicable -- were permitted a grace period running until 1 July 2026 or an earlier refusal of CASP authorisation, whichever came first. That grace period has now expired for any provider that had not secured full CASP authorisation. The practical consequence is that any provider still operating in Luxembourg on the strength of the old VASP registration alone, without having converted to CASP status, is no longer permitted to offer crypto-asset services -- a hard compliance cliff rather than a gradual wind-down. This finding on the transitional mechanics itself carries Confirmed confidence but rests on a tier-3 legal-commentary source rather than a directly retrieved primary CSSF circular describing the transitional regime's original terms, a modest sourcing gap worth noting.
The regime's traffic-light assessment is green: the framework is settled, fully in force, and the transition closed cleanly with no evidence of disorderly wind-down or contested enforcement this cycle. The primary framework is Regulation (EU) 2023/1114 (MiCA) and the supervisory authority is the CSSF. No LU-specific enforcement action against providers that failed to convert in time has been identified this cycle, and none is asserted in the absence of evidence.
Outlook
The item to watch is whether any residual population of providers that were mid-process on CASP applications as of the 1 July 2026 cutoff either complete authorisation or face enforcement for continuing to operate without it. Given Luxembourg's emerging profile as a concentration point for CASP authorisation activity, any enforcement pattern here would be a meaningful signal for the maturity of CSSF's post-transition supervisory posture.
Crypto Licensing
The defining event of this cycle is the expiry, on 1 July 2026, of the eighteen-month MiCA transitional window available to entities that had registered as virtual-asset service providers with the CSSF before 30 December 2024. The CSSF has confirmed that, as of that date, entities providing crypto-asset services in Luxembourg without CASP authorisation under MiCA are operating without a valid legal basis; the VASP-registration grandfathering window has closed entirely. This is a Confirmed, T1-sourced finding directly from the CSSF's own publication, and it represents the dominant structural tightening in Luxembourg's crypto-licensing regime this cycle: a permissive registration status that had allowed legacy VASPs to operate under lighter AML-registration obligations has been converted into a binding authorisation-or-cease requirement.
The CSSF has also confirmed the precise scope of the one available exception. Third-country crypto-asset service providers may serve Luxembourg or EU customers under the reverse-solicitation exemption, but this is available only where the customer initiates contact; active solicitation by the third-country provider does not qualify, and engaging in it may result in a service prohibition. This is a materially important operational boundary for any third-country provider assessing whether it can continue Luxembourg-facing activity without full CASP authorisation, and it leaves comparatively little room for providers to rely on the exemption as a substitute for authorisation where any form of active marketing toward Luxembourg or EU customers is occurring.
Corroborating evidence indicates the CSSF's authorisation-processing capacity remained active through and beyond the transition deadline rather than freezing around it. The regulator granted a preliminary MiCA CASP authorisation to an OTC liquidity provider on 13 May 2026, ahead of the deadline, and a full CASP authorisation to a major payments-token issuer on 6 July 2026, shortly after the deadline passed. Both of these developments are sourced at T3 confidence, corroborating rather than establishing the underlying CSSF authorisation throughput, and support a Probable-confidence reading that the CSSF maintained active supervisory processing capacity spanning the transition period rather than allowing authorisation backlogs to accumulate at the deadline itself.
The traffic-light position for this module is amber, reflecting a live enforcement and compliance-status uncertainty window: any Luxembourg-facing crypto-asset provider not yet fully CASP-authorised now sits in an ambiguous position, whether because it has an authorisation application still pending, because it is relying on the reverse-solicitation exemption, or because it has simply failed to convert and has not yet drawn supervisory attention. This is a genuinely tightening trajectory rather than a stable one.
Outlook
The most significant open question for the coming cycle is the scale of the non-converted legacy VASP population in Luxembourg: how many entities that were previously registered as VASPs failed to obtain CASP authorisation before the 1 July 2026 deadline, and what supervisory or enforcement posture the CSSF adopts toward that population. This was not established this cycle and constitutes a genuine coverage gap rather than a confirmed absence of non-compliant firms. Continued monitoring of CSSF authorisation-grant announcements will also help establish whether the authorisation throughput observed through mid-2026 continues at a similar pace now that the transition deadline has passed, which would further support a reading of orderly market transition.
Crypto Licensing
Luxembourg's crypto-licensing regime completed its transition from a transitional VASP model to a fully operative MiCA CASP perimeter as of 1 July 2026, when the 18-month grandfathering period for CSSF-registered virtual-asset service providers ended (high confidence; primary CSSF source). Providers that have not been granted, or have been refused, CASP authorisation under Regulation (EU) 2023/1114 may no longer offer crypto-asset services in the European Union. VASPs registered with the CSSF as of 30 December 2024 benefited from an 18-month transitional period permitting continued operation until 1 July 2026 or the grant/refusal of CASP authorisation, whichever came first (high confidence; tier-3 law-firm tracker). This closure narrows materially the population of unsupervised or transitionally-supervised crypto operators able to serve Luxembourg and the wider EU market, and it is the most consequential crypto-licensing development for Luxembourg this cycle.
Outlook
Watch for CSSF disclosure of how many previously-registered VASPs were granted, versus refused, CASP authorisation, and for any enforcement action against providers that continued operating past 1 July 2026 without a resolved authorisation status.
Sources and findings (10)
- T1 · ESMACrypto-asset service providers (CASPs) in Luxembourg/EU — CSSF-issued CASP authorisation under MiCA to provide crypto-asset services; unauthorised firms lost the ability to legally operate in the EU following the end of national transitional periods on 1 July 2026. retrieved M5 binding in force new
- T4 · CoinDeskCSSF — Full MiCA CASP authorisations to firms including Ripple, B2C2, and Coinbase, enabling EEA-wide passporting of crypto-asset services. retrieved M4 binding in force new
- T4 · The Block (press release)Virtual asset service providers (pre-MiCA) — Article 7-1(2) of the amended law of 12 November 2004 on AML/CFT as the pre-MiCA VASP registration pathway, now largely superseded by MiCA CASP authorisation. retrieved M3 binding in force new
- T1 · ESMAMiCA Article 143(3) grandfathering clause — Entities providing crypto-asset services under Luxembourg's pre-existing national law before 30 December 2024 to continue operating until 1 July 2026 or until a MiCA authorisation decision was issued. retrieved M3 binding in force new
- T4 · The BlockPreviously nationally-registered crypto firms (EU-wide) — The ability to serve EU clients following the 1 July 2026 end of MiCA transitional periods; only a few hundred firms EU-wide secured full CASP authorisation out of thousands under prior national regimes. retrieved M3 non-binding new
- T3CSSF — CASP authorisation under MiCA Art 59/62 for any entity professionally providing crypto-asset services; CSSF formally designated by the Law of 6 February 2025, published in the Mémorial 10 February 2025. retrieved M5 binding in force
- T3VASP grandfathering transition (MiCA Art 143(3)) — 18-month transitional window for VASPs registered before 30 December 2024 ended 1 July 2026 in Luxembourg; continuing without full CASP authorisation or an Art 60 notification places the entity outside the regulated perimeter. retrieved M5 binding in force
- T3CASP own-funds requirement — Minimum capital of EUR 50,000 to EUR 150,000 depending on licence class/service scope, per MiCA Art 67 and Annex IV as applied by CSSF. M4 binding in force
- T1CSSF — Providing crypto-asset services with Luxembourg as home Member State requires CASP authorisation from the CSSF under MiCA Title V; application fee EUR 30,000 (EUR 15,000 for an already CSSF-authorised firm), minimum capital EUR 50,000-150,000 by service class, decision within 40 working days of a complete file. retrieved M5 binding in force
- T1CSSF — Luxembourg used MiCA's maximum 18-month Article 143(3) transitional period for pre-MiCA registered VASPs; the transition ended 1 July 2026, after which unauthorised provision of MiCA-regulated crypto-asset services is unlawful. retrieved M5 binding in force