Luxembourg Financial Services Regulator, the Financial Sector Supervisory Commission, and Issues FAQs on "Virtual Asset Service Provider" Regime

New FAQS Complementary to FAQs on Investment in Virtual Assets

Further to the general publications by the Financial Sector Supervisory Commission (CSSF) in 2020 and 2021 and two sets of frequently asked questions (FAQs) published by the CSSF at the end of 2021 (one for banks/credit institutions—last updated in April 2023 and one for undertakings in collective investment—last updated in January 2022)¹ relating to the investment in cryptocurrencies, digital assets, and virtual assets (collectively referred to as Virtual Assets or VA), the CSSF has now published a set of FAQs addressed to entities offering services as Virtual Asset service providers (VASPs). The FAQs are designed to clarify the application of the VASP regime. The VASP regime was first introduced into the Luxembourg law of 12 November 2004 on the fight against money laundering and terrorist financing (the AML Law) in March 2020.

Definitions of VA and VA-Related Services

Article 1 (20b) of the AML Law defines a VA as a “digital representation of value, including a virtual currency,” that: (i) can be digitally traded/transferred; (ii) can be used for payment or investment purposes; and (iii) neither qualifies as “electronic money”)² nor as financial instrument.³ Article 1 (20c) of the AML Law lists certain VA-related services (VA Services) the offering of which, under the circumstances described below, will require the offeror to register with the CSSF as a VASP. 

The VA Services include, in particular, the exchange between VA and fiat currencies, the transfer of VA, the safekeeping or administration of VA, and the participation in, and provision of, financial services related to an issuer’s offer or sale of VA. The provision of VA Services only for one’s own account is excluded from the VASP regime.

Application to Luxembourg and Foreign Entities

The AML Law contains a long-arm provision which broadens the VASP regime’s scope to encompass not only entities established in Luxembourg who offer or intend to offer one or more VA Services, but also foreign entities (that is, those not established in Luxembourg) who offer or intend to offer VA Services in the Luxembourg market. Such entities must provide notice of their intended activities to the CSSF, which performs a case-by-case analysis and utilizes internal criteria based on the recommendations by the Financial Action Task Force to determine whether the entity will be considered to be offering VA Services in Luxembourg. 

The elements used by the CSSF to assess whether an entity offers VA Services in the Luxembourg market include, among others, the question whether the entity:

• Has an active commercial approach to offer VA services to the Luxembourg market (like a dedicated section on its website directed to Luxembourg residents);
• Organizes physical visits of prospects and customers in Luxembourg;
• Offers the VA Services on a continuous basis;
• Has a distribution network in Luxembourg and relies on intermediaries that are either authorized or not seeking customers;
• Has a physical presence in Luxembourg; and
• Has part of its technical infrastructure, in particular its servers used for running the VA services, located in Luxembourg.

To register as a VASP, an AML/CTF policy which complies with the Luxembourg AML/CTF framework must be in place. A foreign (non-Luxembourg) entity is required to submit with its registration application a “gap analysis” showing that its AML/CTF policy and procedures, which in practice are established per the requirements of the entity’s competent authorities, comply likewise with Luxembourg’s AML/CTF framework.

The VASP regime is complementary to any existing authorization, license, or registration, that is, an entity who is already under the prudent supervision of the CSSF or another Luxembourg or foreign supervisory authority and intends to provide VA Services (or to provide services to VASPs) must still be registered as a VASP with the CSSF.

Out of Scope Entities

By contrast, entities who provide solely either the hardware or the software to design and support the offering of VA Services, i.e., software developers, internet providers, cloud service providers, etc., are not required to register.

Consequences of Registration

Following acceptance and positive assessment by the CSSF of the application for registration as a VASP, the entity providing VA Services is, going forward, under the prudent supervision of the CSSF and will be listed in the register⁴ of VASPs held by the CSSF.

It is important to note that registration with the CSSF is required before offering the relevant VASP Services. The AML Law empowers the CSSF to impose administrative sanctions/measures with respect to persons who do not comply with the requirement to register as a VASP.

To date, there are 11 VASPs registered with the CSSF. The CSSF’s FAQs for VASPs emphasize the CSSF’s prohibition on the use of the fact of an entity’s registration with, and its supervision by, the CSSF as a commercial argument for its VASP Services.

No Passporting of VA Services Into Other EU Member States

Unlike under certain European harmonized regulations, and pending the full entry into force of the Markets in Crypto Assets Regulation⁵ on 30 December 2024,⁶ no passporting of the VASP status from Luxembourg into other EU member states is currently available.