Crypto License in Luxembourg

The CSSF does not delegate anti-money laundering oversight to a separate body. It supervises CASPs directly under the amended 2004 AML/CFT Law, supported by sector-specific guidance including Circular CSSF 25/878 on money laundering and terrorist financing risk factors, Circular CSSF 25/879 on the crypto Travel Rule, and Circular CSSF 25/875 on the suitability assessment of management bodies and shareholders.

The CASP must connect its transaction monitoring system to the CSSF’s goAML platform for suspicious transaction reporting. The compliance officer is responsible for filing reports and maintaining the relationship with the CSSF on AML/CFT matters. Explore LegalBison’s fractional compliance service.

CASPs authorized in Luxembourg also fall within the scope of the Digital Operational Resilience Act (Regulation (EU) 2022/2554), which layers the following requirements on top of the MiCA authorization:

• ICT risk management framework covering prevention, detection, response, and recovery;
• Incident reporting to the CSSF within 4 hours for major ICT-related incidents;
• Digital operational resilience testing, including threat-led penetration testing for significant CASPs;
• Third-party ICT service provider register and oversight framework (including cloud providers, custody technology, and AML software vendors);
• Information sharing arrangements on cyber threat intelligence.

This is not a separate license, but it shapes the operational documentation a CASP must maintain on an ongoing compliance budget. A small CASP should expect to allocate resources for a compliance tooling stack (transaction monitoring, goAML connection, incident reporting) and periodic resilience testing.

A Luxembourg CASP can serve clients outside the EU. MiCA does not restrict the CASP to EU clients only. However, if the CASP wants to provide services to clients in a non-EU country, it must comply with that country’s local regulatory requirements. The CASP cannot rely on its Luxembourg authorization to operate in jurisdictions outside the EU without local licensing.

For non-EU firms seeking to access EU clients, reverse solicitation remains possible under MiCA Art. 42. If a non-EU client initiates the relationship and requests services on their own initiative, the CASP can provide services without a full EU authorization. However, the CSSF and ESMA take a narrow view of reverse solicitation: the client must genuinely initiate the relationship, and the CASP cannot market or solicit business from EU clients and then claim reverse solicitation (reverse solicitation explained).

The EU Anti-Money Laundering Regulation (Regulation (EU) 2024/1624) will apply from 10 July 2027, replacing the current AMLD framework with directly applicable rules across all member states. For Luxembourg CASPs, this means:

• The AML/CFT program must be reviewed and updated to align with the new regulation’s requirements;
• The compliance officer role will become a designated function under the AMLR, with specific competence and independence requirements;
• Customer due diligence thresholds and enhanced due diligence triggers will be harmonized across the EU;
• A new EU AML Authority (AMLA) will have direct supervisory powers over the highest-risk financial entities.

CASPs authorized before July 2027 will need to adapt their compliance frameworks to the new rules. The CSSF is expected to issue transitional guidance.

Corporate income tax in Luxembourg is charged at 15% on income up to EUR 175,000 and at 17% on income above EUR 200,000, with a transitional bracket in between.

On top of this, a 7% solidarity surcharge applies, and municipal business tax adds a further layer, roughly 6.75% in Luxembourg City itself. Combined, the effective corporate tax burden for a Luxembourg City entity lands at approximately 24.94%. Companies based in other communes may see a modestly different effective rate, since the municipal component varies by location.

Crypto-specific income (trading fees, custody fees, exchange commissions) is taxed as ordinary business income at the standard corporate rates. Luxembourg does not impose a separate crypto-specific tax.

A CASP authorization improves banking access considerably compared to operating outside the regulated perimeter, but Luxembourg’s banking sector remains selective, and onboarding is not automatic on the strength of the license alone. Institutions weigh the AML/CFT program, the transaction monitoring framework, and the credibility of the ownership structure.

Building genuine operational substance, real governance activity, documented decision-making, and a functioning compliance program, tends to matter as much to a banking partner as the authorization itself.

Practical steps that improve banking outcomes:

• A complete and tested AML/CFT program with documented risk assessments;
• A transaction monitoring system that is operational (not just planned);
• A compliance officer who has relevant experience and is actively engaged;
• A clear business plan showing legitimate use cases and client onboarding flows;
• Source of funds documentation for all shareholders and ultimate beneficial owners.