Regulated United Europe OÜ
Registration number: 14153440
Anno: 16.11.2016
Phone: +372 56 966 260
Email: [email protected]
Address: Laeva 2, Tallinn, 10111, Estonia
MiCA License in Luxembourg 2026
Obtain CSSF CASP authorisation in Luxembourg under MiCA. RUE supports exchanges, custodians, brokers, and crypto platforms targeting compliant EU passporting.
Book MiCA Consultation
Regulator
CSSF
Timeframe
4-8 months
Cost
from €29,900
Capital
€50k-€150k
Depends on CASP services, substance, outsourcing model, and dossier quality.
Why Luxembourg for a MiCA License
Luxembourg is a credible home state for institutional-grade CASPs seeking EU market access under MiCA. RUE structures the legal perimeter, prepares the CSSF dossier, and aligns governance, AML/TFR, and ICT evidence before submission.
As your point of contact, I help coordinate the licensing process end-to-end, keep communication clear, and move your application forward without unnecessary delays.
RUE provides end-to-end support for MiCA authorisation in Luxembourg: regulatory scoping, company setup coordination, CSSF-facing dossier drafting, fit-and-proper support, AML/CFT and Travel Rule framework design, ICT/DORA readiness, and passporting strategy.
We work as a legal and compliance project lead, so your business plan, policies, financial model, outsourcing map, and governance documents stay internally consistent before the CSSF starts substantive review.
CSSF Credibility
The CSSF is a respected financial regulator, which matters when your target clients, banking partners, and investors assess licensing quality.
EU Passporting
A Luxembourg CASP authorisation can be passported across the EU after the required notification mechanics are completed.
Institutional Ecosystem
Luxembourg offers proximity to fund, banking, and capital-markets infrastructure that many institutional crypto models need.
Compliance Depth
The jurisdiction is well suited for firms prepared to evidence governance, safeguarding, AML/CFT, Travel Rule, and operational resilience in detail.
MiCA Licence in Luxembourg
34,900 EUR
Package includes (8)
- Preparation of necessary documents for registration of a new company in Luxembourg 2026
- Translation of a certificate of no criminal record through a sworn translator
- Payment of state fees related to company registration
- Payment of notary fees related to company registration
- Preparation of compliance documents for MiCA application
- Preparation of a business plan
- Submission of the necessary documents to CSSF
- Recruitment of local MLRO/Compliance officer
Timeframe: From 6 months
Core Requirements for a Luxembourg MiCA License
A MiCA license in Luxembourg is the market term for CASP authorisation under Regulation (EU) 2023/1114, granted by the CSSF. In 2026, the question is no longer whether MiCA applies; it already does. The practical question is whether your company can prove that its service perimeter, governance, AML/CFT controls, safeguarding model, and ICT operating model are robust enough for authorisation and for ongoing supervision.
The CSSF does not assess documents in isolation. It assesses whether your narrative, org chart, capital model, outsourcing map, client journey, and control framework describe the same business. That is why weak applications are usually delayed by inconsistency, not by the mere absence of one document.
Correct Regulatory Scope and Token Qualification +
Your first task is to determine whether your business actually falls within the CASP regime under MiCA, or whether part of the model belongs elsewhere.
- MiCA covers crypto-asset services such as custody, exchange, execution, reception and transmission of orders, placing, transfer services, portfolio management, advice, and operation of a trading platform for crypto-assets.
- MiCA does not automatically cover everything crypto-related. If a token qualifies as a financial instrument, the analysis may move into MiFID II rather than MiCA.
- ARTs and EMTs have separate issuer rules, and EMT structures may intersect with e-money and payments regulation.
- Certain genuinely decentralised models and certain NFTs require case-by-case legal qualification rather than blanket assumptions.
A wrong perimeter decision usually contaminates the whole dossier: capital class, safeguarding logic, disclosures, outsourcing, and even the board competency matrix.
Minimum Own Funds and Capital Class +
MiCA sets minimum own-funds thresholds for CASPs at €50,000, €125,000, or €150,000, depending on the services provided. In practice, the applicable threshold follows the highest relevant class in your service mix.
- €50,000: typically lower-risk service profiles such as reception/transmission of orders, advice, portfolio management, or transfer services for crypto-assets.
- €125,000: typically applies to exchange-related services, execution of orders, or placing of crypto-assets.
- €150,000: typically applies where you operate a trading platform, provide custody and administration, or exchange crypto-assets for funds.
Minimum capital is not the same as launch budget. The CSSF will also look at funding sufficiency for staffing, compliance tooling, legal support, ICT resilience, insurance where relevant, and operational runway. Capital should be demonstrably available in fiat and traceable to clean source-of-funds evidence.
Luxembourg Entity, Substance, and Real Management +
You generally need a Luxembourg legal entity with sufficient substance for the services you intend to provide. A registered office alone is not enough if the real operating model, decision-making, and control functions sit elsewhere without oversight.
The CSSF will typically expect evidence of:
- a Luxembourg company with clear ownership and UBO transparency;
- effective management and governance arrangements that are not purely nominal;
- an organisational structure showing who owns risk, compliance, operations, safeguarding, and ICT;
- local or demonstrably accessible senior management capable of interacting with the CSSF;
- outsourcing arrangements that remain controlled by the applicant, not by vendors.
For non-EU founders, foreign ownership is not the issue by itself. The issue is whether the Luxembourg entity has enough substance, decision-making capacity, and evidence of control to be supervised as a real CASP.
Governance, Board Fitness, and Key Function Holders +
MiCA authorisation requires governance that is credible on paper and in interviews. The CSSF will assess whether directors and senior managers are fit and proper, whether responsibilities are allocated clearly, and whether conflicts of interest are manageable.
- Board members should collectively cover compliance, operations, financial management, technology, and the specific crypto services requested.
- Key functions typically include AML/MLRO responsibility, compliance oversight, and operational or risk ownership proportionate to the business model.
- CVs, criminal record extracts, declarations, time-commitment evidence, and role descriptions should align with the actual org chart and reporting lines.
- Dual-hatting is possible in some models, but only if the firm can justify independence, capacity, and absence of unmanaged conflicts.
A frequent weakness is appointing prestigious names who cannot explain the operating model in regulator meetings. The CSSF usually values credible involvement over decorative governance.
AML/CFT Framework and Travel Rule Readiness +
MiCA authorisation does not replace AML/CFT compliance. A Luxembourg CASP must align with the applicable AML framework and with the Transfer of Funds Regulation for crypto transfers. In practice, this means your onboarding and transaction controls must be operational, not aspirational.
- Business-wide risk assessment tailored to your products, client types, geographies, and channels;
- CDD and EDD procedures for individuals, corporates, UBOs, and high-risk cases;
- sanctions screening, PEP checks, adverse media review, and ongoing monitoring;
- transaction monitoring scenarios that reflect blockchain-specific typologies, not only fiat patterns;
- Travel Rule data collection and transmission workflows for originator and beneficiary information;
- escalation and suspicious reporting process compatible with Luxembourg AML architecture, including interaction with the FIU Luxembourg where required.
Firms that rely on generic AML templates usually fail at the first detailed RFI because the customer journey, alert logic, and blockchain analytics stack are not described concretely.
ICT Security, DORA Readiness, and Outsourcing Control +
By 2026, a serious CASP application must show not only compliance policies but also an auditable operating model for technology and third-party dependencies. MiCA, DORA, and general supervisory expectations converge around the same practical question: can your firm continue operating safely if a system, wallet provider, cloud environment, or vendor fails?
- Documented ICT architecture with clear system ownership and data flows;
- identity and access management, MFA, privileged access controls, and logging;
- backup, disaster recovery, business continuity, and incident response procedures;
- vulnerability management, patching, penetration testing, and change management;
- vendor register, criticality assessment, contractual oversight, and exit planning for outsourced functions;
- evidence that outsourcing does not prevent the CSSF from supervising the firm effectively.
For custody models, regulators increasingly ask how key management, wallet segregation, reconciliation, and emergency access work in practice. Terms such as MPC, multisig, or cold storage help only if the control narrative is precise.
Business Plan, Financial Projections, and Safeguarding Model +
Your dossier must show a business that is economically coherent and operationally controllable. A strong application usually includes a 3-year financial model, a detailed program of activities, and a safeguarding framework proportionate to the services offered.
- The business plan should explain products, client segments, jurisdictions, revenue drivers, and the full client lifecycle from onboarding to offboarding.
- Financial projections should include conservative assumptions, stress cases, staffing costs, vendor costs, and capital adequacy logic.
- Where custody or client money flows exist, the safeguarding package should explain segregation, wallet architecture, reconciliation frequency, incident handling, and the treatment of client fiat with credit institutions or payment partners.
- Complaints handling, conflicts of interest, disclosures, and record retention should be built into the operating model from day one.
The CSSF will usually challenge optimistic volume assumptions faster than low revenue assumptions. A modest but coherent model is often more credible than an aggressive one with no control capacity behind it.
Jurisdiction Comparison
Compare Luxembourg with other jurisdictions by key conditions for obtaining and operating a MiCA/CASP license: regulator, review period, fees, capital, local substance, and passporting.
* This table focuses on MiCA/CASP authorization conditions. Use the settings icon to customize countries and parameters.
Taxation and Operating Costs for Luxembourg CASPs
Luxembourg does not market itself as a low-tax crypto jurisdiction. It is chosen primarily for regulatory credibility, institutional ecosystem, and cross-border structuring quality. For a MiCA applicant, the tax question should be analysed together with legal perimeter, transfer pricing, VAT treatment of specific services, and the practical location of management and key functions.
How to think about tax in a Luxembourg MiCA structure
The right analysis starts with the actual service mix. A CASP that provides custody, exchange, execution, or transfer services may have different VAT and direct-tax implications than a group entity that only performs software development, treasury, or support functions. Token issuance, staking-related economics, and cross-border intragroup arrangements can materially change the tax profile.
Luxembourg corporate taxation generally combines corporate income tax, municipal business tax, and a contribution to the employment fund, leading to an aggregate effective rate that is commonly around the mid-20s in Luxembourg City. Exact outcomes depend on location, structure, deductibility, and whether the entity has taxable presence elsewhere.
Regulatory and operating budget matters as much as tax
For most CASPs, the larger budgeting issue is not tax alone but total annual compliance and operating spend. In 2026, realistic cost planning should include:
- legal and regulatory maintenance;
- AML/KYC and screening tooling;
- blockchain analytics and Travel Rule connectivity;
- annual audit, accounting, and reporting support;
- ICT security testing and vendor oversight;
- local substance, directors, compliance staff, and office costs where required.
RUE coordinates tax, legal, and operating-model review together so the Luxembourg MiCA structure is workable after authorisation, not only on filing day.
Corporate Income Tax
Part of Luxembourg direct tax burden for companies
~24.94%*
Corporate Income Tax
Part of Luxembourg direct tax burden for companies
In Luxembourg City, the combined direct tax burden for many companies is commonly around 24.94%, including corporate income tax, solidarity surcharge, and municipal business tax. This is an indicative benchmark, not a substitute for transaction-specific tax advice. The actual rate depends on municipality, deductibility, group structure, and permanent establishment analysis.
Municipal Business Tax
Applies in addition to corporate income tax
6.75%**
Municipal Business Tax
Applies in addition to corporate income tax
Municipal business tax varies by municipality. In Luxembourg City, the commonly cited rate is 6.75%. This is one reason why location choice inside Luxembourg can slightly affect the overall tax burden, although regulatory and substance considerations usually matter more for CASPs.
Net Wealth Tax
Annual tax on certain net assets of Luxembourg companies
0.5% / 0.05%
Net Wealth Tax
Annual tax on certain net assets of Luxembourg companies
Luxembourg companies may be subject to net wealth tax, generally at 0.5% up to a threshold and 0.05% above it, with minimum tax rules potentially applying. This can be relevant for well-capitalised holding or operating structures and should be reviewed during entity design.
Value Added Tax (VAT)
Depends on service qualification and place-of-supply rules
17% / exempt
Value Added Tax (VAT)
Depends on service qualification and place-of-supply rules
Luxembourg standard VAT rate is 17%. Some crypto-related services may be treated as VAT-exempt financial services, while others, especially advisory, software, or support services, may be taxable. VAT treatment is highly fact-specific and should be confirmed for each revenue stream before launch.
Accounting and Audit
Mandatory annual financial compliance costs
€18,000-€70,000
Accounting and Audit
Mandatory annual financial compliance costs
Typical annual costs for accounting, statutory filings, and audit support for a Luxembourg CASP often start around €18,000 and can exceed €70,000 depending on transaction volume, group complexity, and whether client-asset reconciliation or safeguarding attestations require additional work. See also our accounting services.
Compliance and AML Tooling
KYC, screening, monitoring, and Travel Rule stack
€25,000-€120,000
Compliance and AML Tooling
KYC, screening, monitoring, and Travel Rule stack
Annual spend on AML/KYC vendors, sanctions screening, blockchain analytics, case management, and Travel Rule connectivity can realistically range from €25,000 to €120,000+. Firms with higher-risk geographies, retail onboarding at scale, or multiple service lines usually sit at the upper end.
Key Personnel and Substance
Directors, compliance, AML, and local operating presence
€180,000-€650,000
Key Personnel and Substance
Directors, compliance, AML, and local operating presence
Annual personnel and substance costs for a Luxembourg MiCA structure commonly range from €180,000 to €650,000+, depending on whether functions are internal, outsourced, or hybrid. Budget should cover directors, compliance oversight, AML/MLRO capacity, finance support, and office or serviced-premises costs proportionate to the model.
Banking and Payment Infrastructure
Corporate accounts, safeguarding, and payment rails
€10,000-€80,000
Banking and Payment Infrastructure
Corporate accounts, safeguarding, and payment rails
Annual banking, PSP, EMI, and payment-processing costs vary widely. A CASP with fiat on/off-ramp, safeguarding accounts, and multi-provider redundancy should expect €10,000 to €80,000+ in annual fees and onboarding-related costs. RUE also assists with bank account opening in Luxembourg and crypto business banking.
Compliance and Ongoing Obligations After Authorisation
A Luxembourg MiCA license is not a one-off approval. The CSSF expects continuous compliance across governance, AML/CFT, safeguarding, ICT resilience, and regulator reporting.
Regulatory Reporting and Notifications
- Annual audited financial statements and prudential monitoring
- Notification of material changes in ownership, governance, or services
- Incident and breach reporting where required by the applicable framework
- Maintenance of records, evidence files, and audit trails
- Passporting updates for cross-border services and branches
AML/CFT and Travel Rule Controls
- Customer due diligence and enhanced due diligence for higher-risk cases
- Ongoing sanctions, PEP, and adverse media screening
- Transaction monitoring with blockchain-specific typologies
- Travel Rule data collection and transmission for relevant crypto transfers
- Suspicious activity escalation and reporting under Luxembourg AML rules
Operational and Safeguarding Standards
- Segregation and reconciliation of client assets and related records
- Complaints handling and conflicts-of-interest management
- Client disclosures, fee transparency, and record retention
- Outsourcing oversight and vendor performance monitoring
- Business continuity, disaster recovery, and access-control discipline
Governance and Control Function Maintenance
- Board oversight with documented minutes and action tracking
- Periodic review of policies, risk assessments, and control testing
- Fit-and-proper continuity for directors and key function holders
- Staff training on MiCA, AML/CFT, TFR, and ICT obligations
- Evidence that outsourced functions remain fully controllable by the CASP
RUE handles compliance for you. Our team provides ongoing compliance support, including AML officer services, regulatory reporting, and policy updates. We ensure your license stays in good standing year after year.
Contact us for compliance support →
Legal terminology matters
MiCA license in Luxembourg = market term; legal process = CASP authorisation by CSSF
“MiCA license in Luxembourg” is the keyword most founders use, but the legal concept under Regulation (EU) 2023/1114 is authorisation as a crypto-asset service provider (CASP). In Luxembourg, the competent authority for that process is the Commission de Surveillance du Secteur Financier (CSSF), designated under the Law of 6 February 2025.
This distinction is not semantic trivia. It affects how you read the law, how you structure the dossier, and which authority you address. A CASP application is submitted to the CSSF, not to ESMA. ESMA matters for supervisory convergence, technical standards, and the public register, but it is not the home-state licensing body for Luxembourg CASPs.
RUE uses the market term on the page because that is how businesses search, but we structure applications using the legal terminology the regulator expects.
📝 Check Your Eligibility
Answer a few quick questions to find out if this jurisdiction suits your crypto business
Step 1 of 5
What type of crypto services will you provide?
Exchange (fiat ↔ crypto)
Custody & Wallet Services
Transfer & Payment Services
Advisory / Portfolio Management
Multiple / All of the Above
Step 2 of 5
What is your target market?
European Union only
EU + Global markets
Global (non-EU priority)
Step 3 of 5
Do you already have a registered company in the EU?
Yes, in this jurisdiction
Yes, in another EU country
No, I need to register one
Step 4 of 5
What is your available budget range?
Under €20,000
€20,000 – €50,000
€50,000 – €100,000
Over €100,000
Step 5 of 5
When do you plan to launch?
As soon as possible (1–3 months)
Within 6 months
Within a year
Just exploring options
This Jurisdiction Is a Great Fit!
Based on your answers, this jurisdiction matches your business requirements well. Here's a quick summary:
Recommended License
CASP License
Estimated Budget
€24,000 – €35,000
Estimated Timeframe
4–6 months
EU Passporting
Available
Step-by-Step CSSF Authorisation Process
Step 1
Regulatory Scoping
Define the exact CASP services, token qualification, and whether any part of the model falls under MiFID II, EMT, ART, or other regimes. This phase drives capital class, disclosures, and dossier architecture. Typical duration: 2-4 weeks.
Step 2
Luxembourg Structuring
Incorporate or adapt the Luxembourg entity, map ownership and UBOs, confirm substance model, appoint directors and key functions, and align source-of-funds evidence. Typical duration: 2-6 weeks depending on group complexity.
Step 3
Pre-Application Preparation
Prepare a regulator-facing memo, governance map, outsourcing map, and operating model summary for initial CSSF engagement. This is where major perimeter errors should be eliminated. Typical duration: 1-3 weeks.
Step 4
Dossier Drafting
Build the full application package: business plan, governance documents, AML/CFT framework, Travel Rule workflow, ICT and outsourcing evidence, safeguarding package, and 3-year financial projections. Typical duration: 6-10 weeks.
Step 5
Submission to CSSF
Submit the completed CASP application to the CSSF with all required annexes and supporting evidence. Case management discipline matters from day one because missing consistency creates avoidable RFIs. Typical duration: 1 week.
Step 6
Review and RFIs
The CSSF performs completeness review and substantive assessment, often through several rounds of questions. Statutory windows matter, but practical timing depends heavily on file quality and response speed. Typical duration: 8-20+ weeks.
Step 7
Approval and Passporting
After authorisation, finalise any conditions, operationalise controls, and submit passporting notifications for target EU markets where relevant. Go-live should start only when governance, AML, safeguarding, and ICT controls are actually functioning. Typical duration: 2-6 weeks.
Frequently Asked Questions
Main Services
Terms of Cooperation
Regulated United Europe
