Crypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Prepared by RUE editorial team · Updated 12 May 2026
Request eligibility reviewCrypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Luxembourg remains relevant because the jurisdiction combines a mature financial-services environment, strong regulator credibility and institutional acceptance. The trade-off is equally clear: the CSSF expects substance, governance discipline, documented AML controls, transparent ownership and realistic operational design. RUE structures the application around the actual legal perimeter rather than selling a generic “crypto-friendly” narrative.
RUE performs perimeter analysis, corporate setup coordination, AML framework drafting, MiCA/CASP document preparation, banking-readiness packaging and regulator-facing remediation support. We also align licensing with tax, accounting, outsourcing and post-approval compliance operations.
The CSSF is a recognized financial supervisor. For serious counterparties, regulator quality often matters more than marketing claims about a jurisdiction being “crypto friendly”.
Luxembourg sits inside the EU framework, which matters for MiCA, Travel Rule implementation under Regulation (EU) 2023/1113, and alignment with broader EU AML architecture.
Funds, tokenization projects, custody models and governance-sensitive groups often prefer Luxembourg because investors, banks and service providers understand the jurisdiction.
Luxembourg rewards applicants that can evidence governance, outsourcing control, source of funds, transaction monitoring logic and data-protection readiness from day one.
Compare MiCA Class 1, Class 2 and Class 3 by permitted activities and baseline requirements.
| Activity / Option | Mica Class 1 - 50 000 EUR | Mica Class 2 - 125 000 EUR | Mica Class 3 - 150 000 EUR |
|---|---|---|---|
| Reception and transmission of orders | V | V | V |
| Execution of orders on behalf of clients | V | V | V |
| Advisory and portfolio management | V | V | V |
| Crypto-fiat and crypto-crypto exchange | X | V | V |
| Custody and administration of crypto-assets | X | V | V |
| Operation of a trading platform | X | X | V |
Crypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Across most viable structures, the regulator will expect:
A practical nuance often missed in competitor pages: proprietary treasury activity is not automatically the same as client-facing regulated crypto services. The perimeter depends on what the company does for or on behalf of clients, whether it controls client crypto-assets or keys, and whether it intermediates exchange, transfer, execution or custody functions.
Crypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Prepare shareholder structure, beneficial ownership chain, proof of identity, source of wealth and source of funds. Nominee-heavy or opaque structures usually trigger deeper questions.
Directors and senior managers must show relevant experience, clean background profile, time commitment and actual control over the business. Generic CVs without product-specific competence are weak evidence.
The file should include customer onboarding logic, sanctions and PEP screening, risk scoring, EDD triggers, transaction monitoring, suspicious activity escalation and recordkeeping rules.
Luxembourg does not reward shell-style applications. The regulator will look at decision-making, outsourcing control, staffing model, local touchpoints and whether the company can actually run the service safely.
Expect scrutiny of wallet security, privileged access, key management, logging, backup, incident response, vendor due diligence and GDPR-sensitive processing of customer data.
Compare Luxembourg with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
6 jurisdictions in this table
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Get an approximate cost estimate for your crypto license based on your business needs
Select options below to see estimated costs
Estimated Cost
€0
Estimated Timeframe
Country-specific
Capital Requirement
€0
* This calculator provides approximate estimates only. Actual costs may vary based on your specific situation. Contact us for a detailed personalized quote.
Luxembourg taxation must be reviewed separately from licensing. A crypto authorization does not create a special tax regime by itself. In practice, founders usually need to assess corporate income tax, municipal business tax, possible net wealth tax, and the VAT treatment of each revenue line.
The critical legal point is that VAT treatment depends on the nature of the service, not on the word “crypto” alone. Exchange-related services may be analyzed differently from software licensing, advisory, white-label infrastructure, custody support, or token issuance support. EU case law, including the logic associated with Hedqvist, is relevant, but founders should not generalize it to every crypto business model.
RUE normally coordinates licensing and tax work in parallel, because product design affects both. For example, the same group may need one analysis for token dealing, another for SaaS revenue, and a separate one for payment-related flows. Current rates and filing obligations should always be verified at implementation stage with Luxembourg tax advisers and official guidance.
Approval is the start of the control cycle, not the end. In 2026, Luxembourg crypto businesses must maintain AML, Travel Rule, governance, reporting and security controls on a continuous basis.
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Crypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Incorporate the Luxembourg vehicle, prepare ownership records, governance structure and initial operating model. Banking-readiness materials should be prepared in parallel, not after filing.
Draft the AML/CFT framework, risk assessment, onboarding rules, sanctions controls, outsourcing map, security policies and business plan. The file must reflect the real transaction flow.
Submit the application package to the competent authority with supporting documents, management information and financial materials tailored to the correct regulatory perimeter.
Expect iterative questions, remediation requests and requests for clarification. Most timelines expand here, especially where the product description, outsourcing chain or source-of-funds logic is weak.
After approval, finalize onboarding, reporting, Travel Rule operations, staff training, vendor controls and governance cadence. Post-approval compliance must be operational before scaling.
Open the key issues founders, compliance teams and legal leads usually need to confirm before launch.
Crypto-asset services within MiCA’s scope require CASP authorisation or another route expressly permitted by MiCA. Luxembourg’s transitional period for legacy VASPs ended on 1 July 2026, so AML VASP registration alone no longer permits those services. Separately assess whether the model triggers payment-services, electronic-money, investment-services or other financial regulation.
Yes. Crypto business is legal in Luxembourg if the activity is structured within the applicable legal perimeter and the company meets AML, governance, operational and, where relevant, MiCA requirements.
Not automatically. AML-only VASP status should not be marketed as a universal passport across the EU. Passporting logic must be assessed under the specific authorization regime, especially under MiCA for CASPs.
The main financial regulator is the CSSF. Depending on the issue, founders also need to consider the CRF for suspicious activity reporting, LBR/RCS for company and ownership records, and the CNPD for data protection.
Not as a universal rule for every crypto model. Management and substance expectations depend on the regime, structure and operating model. The safer question is whether the company can evidence real control, governance and operational substance in Luxembourg.
Not every case is defined by a simple office requirement, but shell-style setups are weak. The regulator will look at substance in practical terms: decision-making, staff access, governance, records, outsourced functions and the ability to operate compliantly.
Yes, foreign ownership is generally possible, but ownership transparency is critical. The applicant must disclose the full shareholder and UBO chain and provide credible source-of-funds and source-of-wealth evidence where required.
It depends on the perimeter and file quality. In practice, founders should budget for 4-9+ months in many cases, including scoping, setup, documentation and regulator review. Complex or poorly prepared files can take longer.
There is no one universal capital figure for all Luxembourg crypto businesses. Capital logic depends on whether the company is assessed as a VASP, CASP, PI, EMI or another regulated entity. Any fixed web number should be treated with caution unless tied to the exact regime.
Sometimes no, but never assume that from the label alone. If the provider does not control client keys and does not intermediate regulated services, the model may fall outside the core perimeter. If functionality goes beyond pure software, the analysis changes.
Own-account activity may fall outside the core client-service perimeter, but this is fact-specific. The analysis changes if the company deals for clients, controls client assets, markets execution services or combines treasury activity with regulated intermediation.
Yes, where the transfer activity falls within the EU framework. In 2026, relevant firms must assess and implement controls under Regulation (EU) 2023/1113, including originator/beneficiary data handling and risk controls for transfers.
No. Licensing and bankability are related but not identical. Banks still run their own risk review and usually want a coherent KYB package, source-of-funds narrative, transaction profile, AML controls and governance evidence. See also our bank account in Luxembourg and crypto business bank account pages.
